If an identified control measure is suitable but not available for implementation before the planned activity, product or service; or the control strategy is complex in nature with multiple dependencies on other duty holders (eg CASG, SEG and Defence Industry), a Risk Control Plan (RCP) may be useful for articulating a strategy for future implementation of more suitable controls. For example, an engineering control has been identified but lead time is required for design, test, evaluation, manufacture, approval and implementation or modification program. In such cases, a strategic plan is required to clarify responsibilities, resources and schedules for implementation of the control measure when it becomes available.
Where appropriate, the RCP should be developed in consultation with external stakeholders and other duty holders (eg CASG, SEG, DDG and Defence Industry). The RCP headings and content include:
Background. The background should provide an overview of the current hazards, risks and controls. Include a summary of the situation or trigger that has led to the requirement to plan for additional control options. Include a cross reference to any other RM artefact and any upstream duty-holder documentation. Where applicable, use a table for multiple hazards, risks and controls and their corresponding RM artefacts.
Control options. Provide a detailed description of the control options including any inherent complexities relating to the controls and their implementation. Confirm whether or not new workplace hazards or risks may be introduced by the control options once implemented including consideration towards any adverse control measure interoperability and dependency effects. For example, will failure of a particular control have an adverse effect on the effectiveness of other control measures? Does one control depend on another for effectiveness? Where applicable, include a list of any reputable standards.
Effectiveness of controls. Describe how the control options, once implemented, will be maintained and reviewed for ongoing effectiveness (eg annual workplace inspections, monitoring and analysis of safety event trends, or specific measurement of workplace hazards such as noise levels).
Implementation strategy. Document the strategy to address how the control options will be implemented including any requirements for design, manufacture, test and evaluation, technical certification by an appropriate authority (eg CASG or SEG). Where applicable, list specific tasks in an annex to indicate what control options are being pursued and by whom.
Cost assessment. Detail estimated cost of implementing the new controls and proposed funding arrangements. This may require the RCP to be sent to a higher command or upstream duty holder (CASG). Discuss why the controls are not considered grossly disproportionate.
Roles and responsibilities. Identify the responsible person for each of the steps in the RCP including whether they are other duty holders external to the organisation such as personnel from CASG, SEG or Defence Industry. Individual position, names and contact details should be included where applicable, as well as the details of the RCP sponsor who is responsible for monitoring progress of the plan and reporting updates to the RCP approver (typically the RMA).
Schedule. Provide a schedule for each step in the implementation strategy as well as the target date for implementation of the control options. Provide insight to any risks associated with meeting the schedule (eg access to aircraft or facilities to test and evaluate new controls).
Progress reporting. Describe how the RCP sponsor will report progress to the applicable RMA (eg weekly email with a dot-point summary, updates to CO at safety committee meetings, project milestone report). The RCP should be developed (and signed) by the applicable RO or organisation executive; and be authorised (and signed) by an appropriate RMA or organisation executive. If there are critical dependencies on external stakeholders or other duty holders, then their endorsement of the plan should be provided or cross referenced in the RCP document.