What Are Components of Risk Matrix

During the issue management life-cycle, safety managers commonly conduct initial and residual risk assessments on reported issues. In most cases, the risk is a combination of both:

• Probability (frequency), and
• Severity (consequences).

Occasionally, you will see organizations that also include "exposure" as a third dimension to their risk assessment. Based on our experience, only three to five percent of aviation service providers have adopted a three-dimensional risk assessment approach.

Most commonly, risk assessments are documented using a risk matrix.

How to Justify Severity of Risk Assessment

When evaluating the severity of risk assessments, safety managers are placed in a delicate situation, i.e., they may be required to justify their risk assessment. How is severity measured for reported hazards that have not yet manifested themselves? In short, how should I conduct risk assessments on reports where "something is wrong, and we should take action before somebody gets hurt?"

For this discussion, let's keep it simple. We should be evaluating severity across multiple areas, including:

• Personnel;
• Environment;
• Assets (aircraft and facilities);
• Security; and
• Company reputation.

There is a human tendency to overthink severity. Safety managers are a diligent and hard-working group. This is based on my experiences working with literally hundreds of safety managers. Safety managers want to do a good job and they also need to be able to communicate risk to the rest of the organization.

Best Practice for Justifying Severity of Risk Assessment

When it comes to conducting risk assessments, safety managers are torn when it comes to evaluating severity. There are two important questions that conflict managers:

• Should I assess the risk as to the actual harm resulting from the reported issue?
• Or should I assess risk based on what could credibly occur?

This very old debate has consumed considerable time within risk management circles.

The accepted best practice is to evaluate severity based on what could credibly occur whenever the event occurs, and not focus too heavily on the event in question. We may have been lucky this time.

Let's take an example of when I (allegedly) backed the tug into the aircraft. I saw the aircraft shudder a moment before I realized how closely I backed the tug toward the aircraft. Maybe it was the wind, maybe I actually made an impact. I'm not sure and my marshaller was distracted, so he couldn't verify contact. Being a responsible ground handler, I reported the issue (event). I could detect no damage.

Safety Managers Assess Severity Based on Credible Outcomes

How should this reported issue be assessed? Upon inspection, we discovered no evident hull damage. I think we got lucky this time, so should the severity dimension of the risk assessment be "negligible" or "significant?"

Common practice would be to assess risk as "significant," because we have all seen cases where significant hull damage resulted from tugs making contact with aircraft.

Related Aviation Risk Assessment Articles

• What Types of Risk Assessments You Should Perform in Aviation Safety
• Flight Risk Assessment Tool Good Aviation SMS Backbone?
• 5 Questions to Ask Before Making Risk Assessment

Problem With Assessing Risk Based on Potential Harm vs Actual Harm

In order to improve operations, we treat this issue as more severe than what actually transpired. Control measures must be evaluated, and if they are deemed inadequate, additional control measures should be implemented. Management is happy because our system is improving. We learned from this "close call," and hopefully we'll avoid future events where damage is substantial.

How should management view severity resulting from risk assessments?

On one hand, I can see we have issues that could credibly result in significant damage. On the other hand, I may be in the mindset that I need to be able to quickly evaluate actual organizational harm.

How to Evaluate ACTUAL Severity From Risk Assessments?

As we indicated before, safety managers document risk assessments based on credible risk scenarios. The shortcoming of this approach is that management is left guessing as to the actual damage or harm that the organization has suffered within a certain time period.

A simple, alternate approach to conventional risk management processes can overcome this shortcoming.

We suggest that risk assessments be conducted as per best practices, i.e., assess severity based on what could credibly result should this event occur or re-occur.

How to Document Actual Consequences Suffered?

In addition to your risk assessment, your aviation SMS software program should also be able to document actual severity. By documenting actual severity, your aviation SMS software should be able to easily generate reports advising management as to whether actual consequences to your operations are increasing or decreasing based on some point in time.

Management is interested in easily evaluating recent damage to:

• Personnel;
• Environment;
• Assets (aircraft and facilities);
• Security; and
• Company reputation.

Furthermore, management needs to know where damage is increasing this week (or month) compared to the past.

No Need to Beg Safety Departments for Routine Reports

You don't need sophisticated SMS software products to implement this risk management strategy; however, aviation SMS software does make this task effortless and reports are generated in real time. This ensures management can easily evaluate current risks without having to beg safety departments for reports.

Modern, web-based risk management software amplifies the effectiveness of safety departments. Furthermore, SMS software should accommodate managers beyond the safety department and provide useful, real-time information to allow management to make timely decisions.

In conclusion, if your current risk management data-capturing process fails to distinguish between actual damage suffered and credible risk scenarios, you should consider a change.

To see how risk assessment best practices are incorporated into an aviation safety management system software, watch the demo video via the link below.

Last updated March 2024.