SMS Pro Aviation Safety Software Blog 4 Airlines & Airports

5 Tips Reviewing Hazards, Risks & Controls in Aviation SMS - With Examples

Posted by Christopher Howell on Dec 17, 2018 5:53:00 AM Find me on:

Problems Monitoring Control Measures to Reduce Risk

SMS Tips Using Hierarchy of Controls

An SMS provides management with a framework to facilitate decision making and to dynamically shape the operating environment. Continuous improvement is a core element of every mature SMS.

Continuously monitoring environments in which your employees work remains crucial to optimal performance in all aspects of your organization's business, including safety.

As SMS skills are learned and practiced, your safety culture naturally matures and operational risk is reduced. Hopefully, these SMS skills become ingrained within your entire organization.

Monitor Effectiveness of Risk Controls

One important characteristic of safe organizations is the adoption of processes that monitor the operating environment to ensure the effectiveness of risk controls and to alert management of emerging hazards.

Based on information learned from continuous monitoring, your managers can adjust operating parameters to reduce risk. But there are problems faced by many organizations. If you are a safety professional, you are most certainly aware of these challenges. How well do you respond to these questions:

  • How can we continuously monitor controls in a sustainable fashion?
  • How can we easily communicate to management that risk is being adequately controlled?

Definitions of Hazard, Risk and Control Measure

Before we begin, we should get some common definitions out of the way so that there are no misunderstandings. In aviation risk management discussions, it is always important that we are speaking the same language. Further below, we will go through a simple risk management example, so we need to be crystal clear on our definitions. Let's quickly define:

  • hazard;
  • risk;
  • risk index;
  • control measure; and
  • "issue."

What Is a Hazard?

"A hazard is any undesirable condition or situation which may cause or contribute to an unsafe event or consequence."

Hazards come in many forms. Hazards are not always physical, tangible objects, such as mountains or birds. Hazards may be political or economic, such as:

  • New government policies;
  • Government currency actions;
  • Regulatory changes;
  • Chronic endemic corruption; and
  • War declarations.

Hazards by themselves are not harmful. It is your interaction with these hazards that cause concern.

Tip #1: Document your hazards in a hazard register, preferably in a database that is integrated with your hazard reporting and risk management system.

Have you read...

What Is Risk?

Aviation safety professionals recognize that risk is "the combination of predicted severity and likelihood of the potential effect of a hazard." In short, think "probability and severity." A very small percentage of aviation service providers also include "exposure" in their risk index calculations.

Have you read...

What Is a Risk Index?

In your SMS, "Risk Index" refers to the calculated "Likelihood" and "Severity" of an unsafe event or hazard-related consequence. If you are using a risk matrix, you may see character descriptions on your matrix such as:

ICAO Risk Matrix for Aviation Safety Management Systems SMS
  • 5A
  • 5B
  • 5C.

The risk index is calculated from your risk matrix based on the intersection of the two variables: likelihood and severity. The purpose of the risk index is to communicate risk to safety management personnel. Other departmental managers may not care about the final risk index calculated results, such as 1A, 1B or 1C. They are more interested in knowing whether risk is either:

  • Acceptable;
  • Mitigatable; or
  • Unacceptable.

Based on evaluated risk, management can act accordingly.

Tip #2: Use ICAO's default 5x5 risk matrix. Don't recreate the wheel. Keep it simple -- otherwise it won't be sustainable in the long run.

What Are Control Measures?

Control measures are your defenses against the realization or escalation of hazards into undesirable consequences. In other words, a control measure is a mitigating action or mechanism that may:

  • Detect the manifestation of a hazard;
  • Prevent the manifestation of a hazard; or
  • Correct or minimize risk from hazard related consequences.

There are many terms in the industry for control measures. Some people simply call them "controls," while others may add other descriptors, such as:

  • Recovery measures;
  • Escalation controls; or
  • Preventative controls.

In the simplest terms, control measures keep bad things from happening or they help the organization recover from hazard related consequences. But don't forget that control measures also play the incredibly important role of "detecting undesireable states."

Have you read...

Control measures may be called something different in your organization, such as:

  • Risk controls;
  • Mitigating measures;
  • Corrective measures;
  • Recovery measures; or simply
  • Controls.

Based on over ten years of empirical evidence, controls, risk controls and control measures seem to be the most popular terms. I prefer "control measures" simply because the laymen can more easily understand what I'm talking about.

What Is Hierarchy of Control?

Risk Management Tips for Hierarchy Of Controls

"Hierarchy of Control" in aviation SMS (and in other risk management circles) refers to a classification system applied to control measures. The classification is based on control measures' perceived effectiveness. The hierarchy is fundamentally useful to  trigger an alert to an observant manager that there may be better solutions to a recurring problem. Alternatively, there may be more effective controls to mitigate risk associated with identified hazards from your Hazard Risk Register. More about this later.

There are five possible attributes to organize control measures according to their ability to mitigate risk. These control types are listed with the most effective control types listed first:

  • Elimination - Physically remove the hazard;
  • Substitution - Replace the hazard;
  • Engineering - Isolate assets from the hazard;
  • Administrative - Change the way people and equipment interact with the hazard; and
  • PPE - Protect workers with "Personal Protective Equipment."

Tip #3: Classify your control measures according to their hierarchy. It will prove very useful to communicate effectiveness of your control strategy to upper management.

Tip #4: Hazards, hazard-related consequences, and control measures should be evaluated:

  • Periodically;
  • Whenever hazards manifest themselves;
  • Whenever the operating environment changes; or
  • As new hazards are identified.

How Hierarchy of Control Communicates to Management

 An aviation operation is constantly interacting with hazards. How can managers remain assured hazards' associated risk is mitigated to as low are reasonably practical (ALARP)?

One effective method is to visually organize your controls according to their classifications in the "hierarchy of controls." For example, for keeping moose off the runway, here is an example of a useful report for managers to visually review their control measures for the wildlife hazard. This chart offers insight into implemented controls' effectiveness and to provide guidance as to which controls are most effective.

Report for risk control measures in aviation safety management systems (SMS)

What Is an Issue in Aviation SMS?

When an undesirable state or consequence appears in your daily operations, it is almost immediately detected and reported by employees interacting with the hazard. The employee may report the undesirable situation to management using paper, email, an in-house reporting system or commercially available aviation Hazard Reporting Software.

For the sake of this discussion, when the employee submits a report, we'll call this report an issue. If the report was in response to an "event," you will follow your risk management processes to recover from the event and possibly implement additional mitigation controls to prevent recurrence. However, not all reports are in response to an accident or incident.

In the perfect world, all employees are trained in Hazard Identification. When employees identify a hazard, they should also be reporting these hazards regardless of whether your organization has suffered from any hazard related consequence. In these cases, the issue may be simply a hazard that has been identified, which should trigger a risk assessment and evaluation of existing control measures.

Tip #5: Do not restrict the usage of "Issue" to only identified hazards, accidents or incidents. They may also include:

  • Audit findings and concerns;
  • Customer complaints;
  • Security concerns;
  • FOQA or FDM exceptions requiring further review;
  • Flight duty time exceedences; or
  • Mission delays.

Any of the above "issues" offers management an opportunity to improve operations as they go through their risk management processes.

An Example Monitoring Control Measures in Real Time

We have the ground work laid out for us regarding definitions of hazard, risk, control measure and issue. We will not lose sight of our objective, which is to answer these two questions:

  1. How can we continuously monitor controls in a sustainable fashion?
  2. How can we easily communicate to management that risk is being controlled?

Let's see an example of how you can monitor your controls and communicate to management based on your implemented control measures. Let's take a very common scenario with airport operations involving a bird strike. We'll identify birds near the airport as the hazard.

Bird strikes occur with aircraft in normal flight or in operations near airports as they are operating in lower altitudes. Even though all bird strikes must be reported to regulatory authorities, there is a very low probability of bird strikes causing significant damage. Modern equipment has been designed to withstand bird strikes with minimal damage to aircraft and aircraft operations.

ICAO Risk Matrix for Aviation Safety Management Systems SMS

The most probable hazard related consequences are:

  • Modest aircraft damage; and
  • Inconvenienced passengers.

These hazard-related consequences will be used in the severity axis of our risk matrix.

The probability of a bird strike will depend on our location and the season. In my area of operations, I found that between four to eleven bird strikes occur for every 10,000 aircraft movements. I could normalize this data to align with my company operations to achieve a probability score that is easier to work with in my risk matrix. Using my SMS database, I learned that bird strikes have been reported more than three times per year at our company.

Based on probability and severity, my risk index has been calculated at 4D. I was momentarily torn between "Negligible" and "Marginal." To quickly determine which element to choose, I remember to consider "worst credible scenarios." So my mind is easily made up to select "Marginal" and now my risk index is justified as 4D.

Classifying Issues Using Hazards From Hazard Register

In the perfect world, your aviation SMS database will have an integrated Hazard Register. Many commercially SMS databases come with an integrated hazard register. When your hazard register is not integrated in your risk management system, the task of associating hazards with reported issues becomes unsustainable in all but the very small organizations. Why?

A sustainable process requires simplicity and ease when repeating this process multiple times. If the process is not easy to perform, chances are that you will not continue the process for an extended period of time. This is especially true when you have turnover in your safety department.

When you classify issues using hazards from the hazard register, you will have access to control measures designed to mitigate risk for the associated hazard. This was the most important statement in this blog article.

Having immediate access to control measures related to identified hazards allows managers to review the following items each time an issue is reported:

  • Hazards;
  • Associated risks; and
  • Control measures.

Another important side-note is that this technique allows your organization to continuously monitor hazards, risks and controls as they appear in your daily operations.

In review, this is an abbreviated workflow:

  • Issue is reported;
  • Safety team analyzes issue;
  • Safety team determines the risk index;
  • Safety team and other managers associate issue with identified hazards;
  • Risk and control measures are reviewed and evaluated for effectiveness;
  • Control measures revised or new controls implemented when warranted.
  • Continuous monitoring resumes.

I purposely kept this list short to avoid confusion. To review, the hazard register and associated system description documentation is your "Design." During normal business operations, you are putting your "design" into practice. When problems are detected, you should be:

  • Putting out the fire, so to speak to reduce further damage; and
  • Review your design and try to improve upon your system design.

Up until now, we have demonstrated an example how to continuously monitor your control measures for effectiveness. The next question we promised to answer is how to assure management that everything is under control and risk is reduced to ALARP.

How to Communicate to Management Risk is Controlled

Management understands that accidents happen and that there will never be a guarantee of an accident free environment. As long as uncertainty exists in this open system (aviation industry exists in an open system), risk will never be completely mitigated. However, management needs assurances that everything possible is being done to prevent damage, injury or death.

When an accident or incident occurs, management will reluctantly "take their lumps." In most cases, this means "paying a price" from damage or the implementation of additional controls.

How can you, as a safety professional, assure management that they will not have to continue suffering from the same type of occurrence? They will undoubtedly like to understand what is being done to mitigate the risk. This following report does this nicely.

Management report of control measures to mitigate risk

 The above chart was taken from SMS Pro, a commercially available SMS solution designed specifically for the aviation industry. In this case, the report was for a relatively common occurrence in North America: moose on the runway.

Looking at the chart above, we can see the description of hierarchy of controls at the left, and the implemented controls on the right. Control measures are grouped according to how they were classified, such as:

  • Elimination;
  • Substitution;
  • Engineering;
  • Administrative; and
  • PPE.

The above chart is a very powerful communication tool. Management can see their existing controls and mentally evaluate whether implemented controls should be effective to prevent recurrence. This is how we communicate to management that "everything is under control" and that we should not continually suffer from the same event.

What happens if the same event recurs? Simply repeat the risk management process described above. Review controls and implement additional controls when necessary. Risk management is a continuous process and the process decribed above help you fulfill the Safety Assurance pillar's element: "Continuous Improvement of the SMS."

Do you have any techniques to continuously monitor your controls? Please share them in the comments below.

Review Control Measures Tips

  1. Document your hazards in a hazard register, preferably in a database that is integrated with your hazard reporting tools.
  2. Use the ICAO's default 5x5 risk matrix. Don't recreate the wheel. Keep it simple -- otherwise it won't be sustainable in the long run.
  3. Classify your control measures according to their hierarchy. It will prove very useful to communicate effectiveness of your control strategy to upper management.
  4. Hazards, hazard-related consequences, and control measures should be evaluated:

    • Periodically;
    • Whenever hazards manifest themselves;
    • Whenever the operating environment changes; or
    • As new hazards are identified.
  5. Do not restrict the usage of "Issue" to only identified hazards, accidents or incidents. Examples may also include:

    • Audit findings and concerns;
    • Customer complaints;
    • FOQA or FDM exceptions requiring further review;
    • Flight duty time exceedences; or
    • Mission delays.

Do you need a list of hazards? Looking at an external list of hazards is beneficial for reviewing your hazard register.

Hazard Register

 

SMS Database Software

Commercially available SMS database software with an integrated hazard register allows you to easily manage risk. You save time and money when all your SMS data is in one system.

Request Live SMS Pro Demo


Topics: 3-Safety Assurance

Site content provided by Northwest Data Solutions is meant for informational purposes only. Opinions presented here are not provided by any civil aviation authority or standards body.

 

 

Benefits of SMS Pro Database

Request live demo to learn about aviation safety management system database software

Best Practices for SMS Programs

 

Watch SMS Pro Demo Videos

These two on-demand videos offer:

  • High-level overview of SMS Pro;
  • Hazard Reporting & Risk Management walk-through.
Watch SMS Demo Videos
 
 
 
 

Subscribe to Email Updates

Recent Posts