Aviation Risk Management Cycle
Risk management has always been the core element of effective aviation safety programs. Before the advent of formal aviation safety management systems (SMS), airlines and airports managed risk in their everyday activities, but certainly not in a formal, structured process that has now become a world-wide standard. This standard has been initiated by the International Civil Aviation Organization (ICAO) in 2006. You can learn more by reading the SMS guidance material.
Airlines and airport around the globe have been spending considerable time and energy implementing ICAO compliant SMS programs. For those operators that are not merely "checking the box," they have realized that there are many benefits to a sincere, whole-hearted implementation. These airlines and airport are structuring their risk management programs according to best industry practices, most of which have been handed down by ICAO's safety management guidance materials.
Safety professionals today must be intimately familiar with the modern aviation risk management cycle, which is based on ICAO's risk management concepts. These concepts are broken out into these phases:
Hazard Reporting Starts the Aviation Risk Management Cycle
Employees, customers and other stakeholders are interacting with your environment. They are working or using your services. During these interactions, they often identify whether potential risk exits. When it is convenient, most will report identified hazards using formal hazard reporting tools. These reported issues are not always hazards, but may be accidents, incidents or irregularities.
Most airlines and airports today have simple, user-friendly hazard reporting systems that minimize resistance, from the reporters' perspective, to receiving these "reported issues." For example, hazard reporting systems have multiple methods for stakeholders to submit these accidents, incidents and irregularities. They may include:
- Web based electronic forms;
- Email that feed into hazard reporting databases;
- Telephonic transcriptions services tied into hazard reporting databases; and
- Mobile apps.
The point is that these systems must be easy to use to reduce friction and to encourage reporting. Otherwise, stakeholders won't participate in your airline or airport's SMS program. Consequently, you will not have any reported issues to manage.
Paper-Based Hazard Reporting Exists, But Not For Much Longer
Paper based reporting is still used, but the days of filling out a paper form and dropping it into the black hole may soon be over. Electronic reporting has some obvious benefits over paper, including:
- Automated notifications to safety teams;
- Increased accountability as "electronic hazard reports" are difficult to lose or hide;
- No need for safety teams to transcribe paper based reports into another system, as the work load has been distributed to the reporter; and
- No need to keep printing paper reporting forms that seem to get covered in dust.
Reasons to continue using paper-based hazard reporting forms include:
- Poor Internet connectivity at most areas of operations;
- Older, computer-illiterate workforce; and
- Lack of top-management support for modern aviation SMS software tools.
Modern Aviation Risk Management Affects Entire Organizations
Hazard reports are no longer tied only to maintenance and flight operations. The original purpose of aviation SMS programs is that it involves the entire organization. SMS programs are tied very closely to improving not only safety, but also the quality of operations. Many airlines and airports have integrated safety and quality into the same departments. The beauty of this approach is that safety becomes a real and recognized cost driver to the organization.
Safety Managers Risk Assess Reported Issues
After issues enter the hazard reporting database, the safety team commonly determines the severity and probability of risk using a risk matrix. The most common risk matrix in the aviation industry today is the 5x5 ICAO risk matrix, such as the one seen here.
Whenever potential risk to operations remains negligible, such as low to medium severity and low likelihood of occurrence, no actions may be necessary unless the issue repeats itself over time. The safety team will need to determine whether the costs to mitigate the risk outweigh the benefits of having these low risk issues entering the system on a recurring basis. After all, one must not simply weigh the monetary costs, but also the costs to personnel in reporting the issue and the safety team's cost in managing the issue multiple times.
Safety teams must continue reactive risk management strategies whenever risk can potentially cause injury or damage to:
- Environment; or
- Airline or airport reputation.
Corrective Action Preventive Action Plan to Mitigate Risk
Once the safety team has determined the level of risk, safety professionals will need to determine how to control the identified risk. In order to understand the risk, the safety professionals must be subject matter experts and have expertise in the type of affected operations. For example, a safety manager with flight ops experience may not always understand risks associated with maintenance related issues. In this case, safety committees should be created for more complex operations.
Safety committees are more effective at evaluating risk and determining the most appropriate corrective/preventive actions. Their proposed corrective/preventive actions will be based on the risk's severity and likelihood of recurrence. Their objective is to mitigate risk to as low as reasonably practical (ALARP).
Safety professionals will often brainstorm various alternatives and perform a cost/benefit analysis when necessary. Safety action plans with the highest utility and the lowest cost are naturally the most attractive.
Implement Corrective Actions to Mitigate or Transfer Risk
Assigned personnel are instructed to implement corrective/preventive actions formulated in the previous phase to either mitigate or transfer the identified risk. There are often two types of corrective/preventive actions:
- Short term; and
- Long term.
The short term corrective actions are designed to recover from an event or an impending event. Long term corrective actions are designed to reduce recurrence and prepare the airline or airport in case the hazard manifests itself again.
Once all corrective/preventive actions have been implemented, the safety team will re-assess the risk to determine whether the implemented corrective actions actually satisfied their desired intent. Whenever risk levels are not within acceptable levels, the safety team must return to the previous phase and develop additional corrective/preventive actions and then implement them.
As one can see, this may be an iterative process and may require several iterations until ALARP is achieved.
Monitor Risk By Tracking Corrective Preventive Actions
After all identified risks have been mitigated to an acceptable severity level or transferred, risks should be tracked to ensure the implemented corrective actions remain effective. Safety managers should not neglect to follow up and enter any newly identified hazards into the airline or airport's hazard register. The hazard register is also regularly reviewed. This ensures there are at least two mechanisms in place to monitor risk.
As time passes, safety teams need to conduct periodic reviews of the implemented corrective actions. The object here is to ensure that any new actions do not aggravate hazards or introduce unnecessary risk into the operation.
Whenever hazards repeatedly manifest themselves, the risk management cycle must begin again, starting with the hazard reporting and risk analysis phases.
Final Thoughts on Modern Aviation Risk Management Strategies
All aviation industry segments will follow a similar risk management cycle. More complex organizations will have more elaborate safety committee review processes, while simpler organizations will have very streamlined risk management processes.
Regardless of whether your organization is a simple or complex organization, safety professionals must continue to communicate risk to all affected stakeholders. I believe this is the final phase of the risk management life cycle that many aviation safety professionals overlook.
If you need risk management tools to manage your aviation SMS program, here are three short demo videos to offer you some guidance.