It should be noted that the Operational Risk Management (ORM) approach to monitoring and evaluating risk and impact controls uses specific language that should be considered when applying the approach described above:
- refers to Control Purpose measures: these equate to the objectives described above and should define the intended outcome of controls. requires that control purpose measures are defined which should be used as indicators of the outcome and impact of the control.
- also refers to Control Theory measures: these equate to the inputs described above and should define the elements required to consistently achieve the outcomes defined in the Control Purpose. The approach suggests defining four types of control theory (or input) requirements and measures including availability, reliability, survivability and erosion factors:
- Availability: to ensure the control is present and available for use.
- Reliability: to ensure the control is able to perform its function consistently to the expected standard.
- Survivability: to ensure the control will continue to function under the operating and environmental conditions and is matched to the hazard.
- Erosion Factors: to assess what can cause the control to deteriorate or fail and how this can be prevented.
Where necessary sites may want to conduct monitoring and evaluation using language defined as part of the system but should ensure that the approach described in Section 1.5 is implemented.