This chapter describes the risk analysis approach used by the OGTR and the national and international sources that informed development of this approach. In addition, the role of uncertainty in risk analysis is discussed, and the principles guiding the Regulator’s use of risk analysis are outlined.

Models of risk analysis

The AS/NZS ISO 31000:2009 Risk Management—Principles and guidelines (Standards Australia 2009) has been developed to guide organisations that deal with risk. According to AS/NZS ISO 31000:2009, risk management is the overarching term that is equivalent to risk analysis (as described in this framework). A number of international organisations and treaties such as the World Organisation for Animal Health (OIE 2004), the International Plant Protection Convention (IPPC), and the Codex Alimentarius Commission (Codex Alimentarius Commission 2003) provide standards and guidance for risk analysis in the specific areas of animal, plant and human health risks.

The first comprehensive guidance on risk analysis of GMOs was published by the Organisation for Economic Co-operation and Development (OECD 1986; Bergmans 2006) based on the logic and rationale for health and environmental risk assessments in a 1983 report from the US Academy of Sciences National Research Council (Jardine et al. 2003; National Research Council 1983; National Research Council 2008).

National guidance material on risk analysis of human health and environmental risks from biological organisms, such as that developed for plants (Standards Australia 2006) and micro-organisms (Standards Australia 2010a), also provides useful models for risk analysis of GMOs. Other useful national guidance is provided by the risk assessment model for environmental health (enHealth 2012).

Annex III of the United Nations Cartagena Protocol on Biosafety (Secretariat of the Convention on Biological Diversity 2000) also provides guidance for risk assessments of GMOs, but does not detail how to perform the assessments.

This version of the Risk Analysis Framework is most closely aligned with AS/NZS ISO 31000:2009; however, all of these models were considered in its preparation.

OGTR risk analysis method

The risk analysis method the Regulator uses for GMO licence applications (Figure 2.1) is based on AS/NZS ISO 31000:2009 Risk Management—Principles and guidelines (Standards Australia 2009). However, this process is not necessarily linear as there is significant iteration of each step during the preparation of an RARMP for each licence application.

Figure 2.1: Risk analysis method for GMO licence applications

The risk analysis method the Regulator uses for GMO licence applications is based on AS/NZS ISO 31000:2009 Risk Management – Principles and guidelines. The major components include Risk communication, Risk context, Risk assessment, Risk management plan, a

Components in risk analysis

Risk context

Establishing the risk context (see Chapter 3) is the preparatory step that defines the scope and boundaries, sets the criteria against which risk will be evaluated, and describes the structures and processes for the analysis. This includes setting criteria for what is considered as damage or injury to people or the environment. The risk context is established within the framework of the legislative requirements of the Act and Regulations.

Decisions on licence applications require case-by-case assessment, including preparation of an RARMP. Details of the GMO and the proposed activities, including any proposed controls, limits or containment measures, form the specific context for the RARMP. Details of the parent organism and the environment where activities with the GMO will occur form the comparative baselines.

Risk assessment

Risk assessment (see Chapter 4) is a structured, reasoned approach to consider the potential for harm from certain activities with a GMO, based on scientific/technical evidence and consideration of uncertainty. The aim is to identify, characterise and evaluate risks to the health and safety of people or to the environment from dealings with GMOs posed by or as the result of gene technology. The risk assessment initially considers a wide range of potential pathways whereby harm might occur. Those pathways that identify substantive risks are considered in more detail by characterising how serious the harm could be (consequences) and how likely it is that harm could occur. The level of risk is then evaluated to determine whether measures to reduce risk are required.

Identifying and characterising risk relies on scientific/technical evidence, involving consultation with experts and other stakeholders, as well as consideration of knowledge gaps and other forms of uncertainty.

Risk management

Top of page
Risk management (see Chapter 5) may be described as answering the following questions: Does anything need to be done about the risk? What can be done about it? What should be done about it? Risk management involves judgments about the choice and application of treatment measures to support decisions about whether certain activities with GMOs should be permitted.

Risk management includes the preparation of a risk management plan and monitoring and reviewing to provide feedback on all steps in the risk analysis. The risk management plan includes licence conditions that stipulate measures to control or reduce risk. Monitoring and reviewing ensure that decisions remain valid and that decisions can be adjusted to account for changes in circumstances or new information.

The RARMP forms the basis upon which the Regulator decides whether to issue or refuse a licence, and what conditions to impose if a licence is issued. To issue a licence the Regulator must be satisfied that risks posed by proposed dealings with a GMO can be managed to protect human health and safety and the environment. If the Regulator considers that risks cannot be managed, a licence must be refused.

Risk communication

Risk communication (see Chapter 6) engages in dialogue about the risks to human health and the environment posed by certain dealings with a GMO. It includes extensive consultation with experts and specified stakeholders during preparation of RARMPs for DIR applications. This includes people who may be affected by risks from the GMO or the proposed controls. The Regulator may also consult with experts on DNIR applications.

Risk communication is integral to the processes of risk assessment and risk management. It involves an interactive dialogue between the Regulator and stakeholders to build trust in the regulatory system by discussing issues and addressing concerns.

The Regulator undertakes extensive consultation with a diverse range of expert groups and authorities and key stakeholders, including the public, before deciding whether to issue a licence for the release of a GMO into the environment. In many instances, differing perceptions of risk can influence the approach of stakeholders to particular issues.

The Regulator provides accessible information to interested parties on applications, licences, dealings with GMOs, trial sites, and the processes of risk assessment, risk management, monitoring and compliance activities undertaken by the OGTR. The Risk Analysis Framework is part of the Regulator’s commitment to clarity, transparency and accountability for decision-making processes.


The literature on risk analysis, as well as national and international standards and guidance documents, use a variety of terms to describe similar concepts (FAO & WHO 2006; Hill 2005; National Research Council 1983; OIE 2004; Raybould 2006; Standards Australia 2009; USEPA 1998; Wolt et al. 2010). The main risk analysis terms used in this framework are described in Table 2.1, which also provides alternative terms used in other frameworks to describe components of risk with similar functions.

Table 2.1: Comparison of terms used to describe components of risk analysis

Comparison of terms used to describe components of risk analysis

Sources: FAO & WHO 2006; Hill 2005; National Research Council 1983; OIE 2004; Raybould 2006; Standards Australia 2009; USEPA 1998; Wolt et al. 2010

Risk characterisation relates to assessment of the chance and seriousness of harm. According to AS/NZS ISO 31000:2009 Risk Management—Principles and guidelines, this is described by the terms ‘Likelihood’ and ‘Consequences’, which are used here. However, many other terms are used in the literature depending on the source of risk (Table 2.2).

Table 2.2: Alternative terms to Consequences and Likelihood4

Risk source
Type of concern
Hazard, Dose response
Pathogenicity, Disease
Symptoms, Virulence


Uncertainty is an intrinsic part of risk analysis. There can be uncertainty about identifying the risk source, the causal linkage to harm, the type and degree of harm, or the chance of harm occurring, or the level of risk. In relation to risk management, there can be uncertainty about the effectiveness, efficiency and practicality of controls.

Risk analysis can be considered as part of a first tier uncertainty analysis, namely a structured, transparent process to analyse and address uncertainty when identifying, characterising and evaluating risk. However, there is always some residual uncertainty that remains. If the residual uncertainty is important and critical to decision making, then this residual uncertainty may be subjected to further analysis (= second tier uncertainty analysis), such as building ‘worst case’ scenarios, or by using meta-analysis where results from several studies are combined.

There are several types of uncertainty in risk analysis (Bammer & Smithson 2008; Clark & Brinkley 2001; Hayes 2004). These include:
  • uncertainty about facts
    • knowledge—data gaps, errors, small sample size, use of surrogate data
    • variability—inherent fluctuations or differences over time, space or group, associated with diversity and heterogeneity
  • uncertainty about ideas
    • description—expression of ideas with symbols, language or models can be subject to vagueness, ambiguity, context dependence, indeterminacy or under-specificity
    • perception—processing and interpreting risk is shaped by our mental processes and social/cultural circumstances, which vary between individuals and over time
Some typical approaches to addressing uncertainty in the risk analysis include:
  • establishing parameters for data quality
  • obtaining additional data
  • identifying and correcting errors
  • applying conservative estimates
  • using upper and lower bounds of estimates
  • seeking expert opinion (eg GTTAC) or independent review
  • providing clear definitions of key words
  • prioritising by re-evaluation against objectives, scope and risk criteria
  • applying additional controls/containment to manage risk
  • applying second tier uncertainty analysis.
Explicit consideration of uncertainty in risk analysis facilitates:
  • increased clarity, consistency, credibility, repeatability and transparency in the decision-making process
  • highlighting of areas where more effort is needed to improve conclusions
  • clearer distinction of the values and facts used in decision making
  • addressing issues and concerns of stakeholders
  • more effective communication about risk.
Analysis and treatment of uncertainty are conducted on a case-by-case basis according to the type of uncertainty, proportionality to the level of risk and importance in the decision-making process.
Top of page

Guiding principles of risk analysis

For risk analysis to be effective, a number of principles are followed to ensure the goals of the gene technology regulatory scheme are achieved. These guiding principles are adapted from AS/NZS ISO 31000:2009 Risk Management—Principles and guidelines. They are also consistent with those described by the Australian Government Department of Health and Ageing for environmental health risk assessment (enHealth 2012). They are:
  1. Risk analysis creates and protects value.Risk analysis contributes to the demonstrable achievement of objectives to protect the health and safety of people, and to protect the environment.
  2. Risk analysis is an integral part of all organisational processes.Risk analysis is not a stand-alone activity that is separate from the main activities and processes of the organisation, but integral to the whole regulatory process.
  3. Risk analysis is part of decision making.Risk analysis helps the Regulator make informed choices, prioritise actions and distinguish among alternative courses of action.
  4. Risk analysis explicitly addresses uncertainty.Risk analysis explicitly takes account of uncertainty, the nature of that uncertainty, and how it can be addressed.
  5. Risk analysis is systematic, structured and timely.A systematic, timely and structured approach to risk analysis contributes to efficiency and to consistent, comparable and reliable results.
  6. Risk analysis is based on the best available information.The inputs to analysing risk are based on information sources such as scientific evidence, historical data, experience, stakeholder feedback, observation, forecasts and expert judgment. This takes into account any limitations of the evidence or the possibility of divergence among experts.
  7. Risk analysis is tailored.Risk analysis is aligned with the regulatory context and risks to the health and safety of people and to the environment.
  8. Risk analysis takes human and cultural factors into account.Risk analysis, in particular risk communication, recognises the capabilities, perceptions and intentions of OGTR staff and external people who can facilitate or hinder achievement of the regulatory objectives.
  9. Risk analysis is transparent and inclusive.Appropriate and timely involvement of stakeholders and, in particular, the Regulator and OGTR staff ensures that risk analysis remains relevant and up to date. Involvement also allows stakeholders to be properly represented and to have their views taken into account in determining risk criteria.
  10. Risk analysis is dynamic, iterative and responsive to change.Risk analysis continually senses and responds to change. As external and internal events occur, context and knowledge change, monitoring and review of risks take place, and new risks emerge, change or disappear.
  11. Risk analysis facilitates continual improvement.Strategies are developed and implemented to improve risk analysis expertise.
In addition to these general principles, the Regulator supports the ethical application of gene technology by researchers and users. The National Framework of Ethical Principles in Gene Technology 2012 issued by the Gene Technology Ethics and Community Consultative Committee (GTECCC) provides 10 key ethical principles relating to gene technology, and to genetically modified organisms (GMOs):

Principle 1—Acting with integrity
Act with integrity in the search for and application of knowledge and benefits in gene technology research, both in the design of the research and by having appropriate scientific qualifications to undertake the work and follow relevant codes of best scientific practice.

Principle 2—Avoiding conflicts of interest
Declare and properly manage any conflicts of interest under the terms of the Australian Code for the Responsible Conduct of Research or other relevant requirements.

Principle 3—Maintaining records of scientific data
According to best scientific practices, maintain accurate and comprehensive records of all relevant facts and data in dealings with gene technology to the standards required by regulatory authorities, including records of all negative as well as positive results.

Principle 4—Caring for the environment and sustainability
Conduct dealings with gene technology so as to protect the environment, including genetic diversity, organisms, species and natural ecosystems, and to promote improvements in human health and sustainable agriculture and industry.

Principle 5—Avoiding harm to humans and animals
Minimise risks of harm or discomfort to humans and animals likely to be adversely affected by gene technology research by ensuring compliance with the gene technology legislation.

Principle 6—Assessing long-term impacts
Conduct dealings with gene technology with regard to the impact on present and future generations, including assessment of the long-term side-effects of applications of gene technology.

Principle 7—Sharing knowledge and benefits
Respect intellectual property rights, endeavour to promote access to scientific developments and share knowledge, and ensure that the Australian community benefits from gene technology.

Principle 8—Promoting benevolent purposes
Conduct dealings with gene technology that promote their benevolent application and discontinue dealings that involve risk outside the relevant authorisation requirements.

Principle 9—Ensuring transparency
Conduct dealings with gene technology in a manner that ensures transparency and public scrutiny of the processes and that allows community consultation with those with a direct or potential interest.

Principle 10—Considering responsibility beyond national borders

Ensure that dealings with gene technology do not cause damage to the environment in Australia or beyond the limits of the national jurisdiction.Top of page

4Hazard is also considered as a source of potential harm that is equivalent to ‘risk source’ (see Glossary).