1. To perform a QRA, a team must first identify the hazards that exist through a Process Hazard Analysis, which may include a HAZOP review.  The regulation, OSHA 3133, Process Safety Management Guidelines for Compliance, provides an explanation of the methods for this analysis.
2. Then identify the consequences that result if the hazards are released upon the plant or the surrounding community.  There are a number of tools readily available to conduct consequence analysis, such as PHAST .
3. Once a consequence has been established, the second key part of the QRA is needed: determining the probability of an event.   This probability can be determined through various methods, such as fault tree analysis, or layer of protection (LOPA) analysis.  Executing a fault tree analysis can be prohibitively expensive, and the results depend on the team recognizing all of the failure modes of complicated systems.  For this reason, many organizations are using LOPA to estimate the consequences of a loss of containment of a hazardous material.
4. A company can then analyze its risk based on the position of various events on a consequence vs. probability plot, which describes the exposed risk.  The organization can then make the determination whether the risk of a particular event is too great based on a number of factors, and implement changes or improvements to bring that risk in line with the organization’s goals.

Like any method for estimating probabilities, the limitations of the QRA include such factors as predicting human behavior during stressful conditions (although one can apply a factor for this.)  The reliability of any safeguards is also important to consider.  This is highly dependent on the safety culture of an organization, because maintenance and testing of safeguards is a key part of making sure these work when called upon.

Organizations such as the Center for Chemical Process Safety (CCPS at www.aiche.org) provide a wealth of reference materials and training courses that can help an organization determine how best to perform a QRA and implement the changes needed to mitigate the risk associated with a facility, specific operating unit, or a process.