Performance and risk based operational management (RISTO)

What does it mean?

Performance is the overall ability of an organization to manage continuously its operations to the required standard and with an adequate level of safety. Traficom evaluates performance using specific evaluation criteria. The results of the evaluation, together with background, reasoning and evidence, form the customer’s organizational profile. The profile is a reasoned subjective representation of Traficom’s current state of customer performance.

If the performance of the organisation’s safety management system is rated high, Traficom will target lighter oversight to that operation and will seek to support the further development of the organisation’s safety management system by other means. If the performance is evaluated low, Traficom will prioritize that organization in its oversight plan and take specific measures to help the organization improve its safety management system.

Based on the organization profile, Traficom manages the following:

• which transport organizations are primarily targeted,
• what measures are targeted on organizations,
• what is the content and scope of governmental measures targeted on organizations
• when the various control measures are carried out
• how often the measures are targeted on organizations
• what resources are needed to implement the various measures

Who is affected?

Performance and risk based operational management applies to Traficom’s customers in the rail, aviation and maritime organization customers.

Since the 2010s, EU regulations on the enforcement of railway safety authorisations and certificates have had varying levels of requirements that oblige national safety authorities to prioritize oversight. For example, the Commission regulation ((EU) No 1169/2010) on a common safety method for assessing conformity with the requirements for obtaining a railway safety autorisation states that "national safety authorities oversight activities shall focus primarily on activities that the national safety authority considers may present the most serious or least controlled risks."

The types of rail organization to which Traficom applies a performance and risk based management model are safety authorisation managers, safety certificate holders and educational institutions. The above-mentioned also include museum operators and the state infrastructure manager.

How is performance evaluated?

Performance evaluation is Traficom’s internal process, which aims to collect organization-specific information, methodically evaluate it, and document it to an organization profile. The evaluation is made by Traficom’s rail experts, typically including inspectors who have handled the organization’s certificates as well as inspectors who have audited the organization, safety management experts or safety information analyst. An expert team reviews the points of the organizational profile, recording the reasoning and the operational needs. Organizational profiles are updated regularly and the information is used to maintain an oversight program and plan.

The performance criteria are based on the legal requirements of the railway organizations and European Union Agency for Railways’ (ERA) model of safety culture. A particular focus is on the effective compliance, effectiveness and efficiency of the safety management system. In addition, attention will be paid to the organization’s safety and management culture, as well as the role, responsibility and commitment of the organization’s administration to operational safety and safety management system.

Safety management systems are an integral part of performance evaluation because they are the most important means for an organization to manage its operations in a comprehensive manner. In addition to the safety management system, the organizational profile takes into account, among other things, the specific characteristics of the transport organization, the nature (especially risk) and extent of the activity, and many other factors.

Traficom is also involved in development work at EU level. In it, national safety authorities, under the leadership of the European Union Agency for Railways, exchange the best practices for assessing and further developing performance and maturity of management systems, in particular through regulatory means. In addition, Traficom also cooperates bilaterally with the security authorities of other EU countries. This cooperation has shown that Traficom’s performance and risk based operational management is similar to other European countries that have the same rail system as Finland.

Why is it used and what are the benefits?

Traficom’s goal is to carry out security work at the highest possible level of effectiveness. Traficom’s vision is that the performance and risk based operational management advances the continuous development of customer organizations’ safety management. Legislation also requires Traficom to operate on a performance and risk basis.

However, the concept of performance has a broader perspective on how different ways and procedures can ensure safety. The focus of performance evaluation is on the operation and its requirements. The existence of a single operating procedure does not guarantee success or good performance. Therefore, the performance is evaluated as a whole in terms of practical results and it includes an assessment of the operator’s compliance with the detailed requirements. As a result, through performance evaluation, organizations have more ways to demonstrate to the supervisory authority that the procedures at their disposal are operational, adequate and compliant. The key is to show that an organization continually maintains an adequate level of security in its operations – each organization can choose the way and style from ever expanding scope. This, in turn, increases commitment to different security procedures and continues to have a positive impact on security level.

It also seeks to secure and focus resources and work where they are needed most, where they are most useful and effective. From the organisation's point of view, this means that when it performs well, the interval between authority audits can be extended. This saves time and resources for the organization as well.

The most important tool in an operational model is an organizational profile, which includes an evaluation of the performance of a single organization. In a bilateral security discussion, Traficom presents the organization with a subjective evaluation of its performance. The organizational profile provides the customer with an indication of Traficom's near future operations. In addition, the customer can utilize the results of the organizational profile to develop their own operations.

Traficom also looks at profiles of organizations with similar types of activities in parallel, as they provide valuable insights into trends. If, for example, a trend analysis shows that all or most of the actors have performance weaknesses on the same topic, these topics can be turned into themes in stakeholder operations and guidance development. Traficom can provide additional guidance or organize information or training sessions on topics that many operators seem to need additional support for. This contributes to security work and information exchange and helps Traficom provide better quality support services to its customers.