Business Processes, Policy Analysis, and Maturity Model for a Risk and Safety Program

The U.S. Office of Management and Budget has issued a memorandum to the heads of executive agencies entitled, "Updated Principles for Risk Analysis". These principles are guide agency managers in the coordination of risk assessment, risk management, and risk communication policies and programs to address technical, environmental, health, and safety risks. This dissertation develops a systematic approach to achieve the compliance of a risk program office with the recently updated guidelines and similar guidelines. The dissertation defines a risk program as a risk, safety, or reliability assurance division or an office of a major federal agency that is charged with administering interrelated risk assessment, risk management, and risk communication activities on a large scale. The dissertation defines three canonical questions of the program as: (a) What is the scope of the risks to be managed; (b) What is the allocation of program resources across these risks; and (c) What performance is required of the program to strategically manage current and emergent risks. The dissertation develops three interrelated methods for support of such a program: (i) a business process model; (ii) a scenario-based impact analysis of policy activities; and (iii) a risk program maturity model. It is acknowledged that formal proof of the efficacy of such methods alone and in combination may be impossible. A case of two incidents at a Taiwan arsenal is presented to illuminate the applicability of the methods in practical settings.;Keywords: Risk assessment, risk management, risk communication, risk analysis, scenario-based impact analysis, maturity model, program management, systems analysis...