What Is Risk Assessment in Aviation SMS

Operators implementing formal aviation safety management systems (SMS) need to develop, practice and maintain a documented process of risk analysis, risk assessment, and risk control to an acceptable level of safety (ALoS). We say that the process needs to be formal in the sense that risk assessments/analysis needs to be documented and communicated to employees based on their participatory role in the aviation SMS.

The risk assessment process in aviation SMS starts with hazard identification and hazard reporting. Once reported, aviation safety managers will analyze affected systems and assess the risk in terms of the following:

• Probability of negative outcomes; and
• Severity of most likely negative outcomes.

Related Aviation Risk Assessment Articles

• How to Identify Hazards and Assess Risks in Aviation SMS - With Free Resources
• How to Perform Risk Assessments Without Aviation Risk Management Software
• How to Justify Severity of Risk Assessments - Best Practices

Risk Assessments Account for Existing Risk Controls

Probability and severity should take into account existing risk controls. Based on the probability and severity of the reported safety issue, safety managers will determine whether or not the safety issue falls within ALoS.

Usually, the probability and severity are each determined on a scale of 1 (low) to 5 (high) for probability, and A (low) to E (high) for severity.

The aviation industry standard is to document the risk assessment results in a risk matrix. The composite score or calculated result from the risk matrix is called the "risk index."

For full details about what is a risk matrix and how to use the risk matrix in your aviation SMS' risk management processes, refer to our article about what is a risk matrix and how to use it for risk assessments.

How to Perform Risk Assessment in Aviation SMS

A risk matrix is an excellent tool for quickly concluding the overall safety exposure resulting from a safety incident. Safety incidents can be real or imagined scenarios. Performing risk assessments follows a process similar to that of overall safety risk management, known as risk analysis process:

1. Evaluate all hazards involved in the issue;
2. Analyze whether hazards influence other "systems;"
3. Evaluate how well safety controls meet each hazard;
4. Evaluate if a new risk control(s) is needed, and if so how severe the gap is;
5. Based on the elements involved, what is the severity and probability of negative outcomes in the future;
6. (if applicable) Implement needed changes (i.e. mitigation actions) to get the affected system to an ALoS; and
7. Resume operations and monitor.

Again, it’s important to remember that risk assessments (#5 above) are only one part of the risk analysis process, as risk analysis and risk assessments have different goals.

The result of performing a risk assessment will be the risk index, which is a combination of one letter for severity and one number for probability.

Related Aviation Risk Assessment Articles

• Difference Between Hazard Risk Assessment and Hazard Risk Analysis
• How to Create Your Risk Matrix for Risk Assessments in Aviation SMS
• How to Assign Severity and Likelihood to Issues When Assessing Risk

Goals of Risk Assessments in Safety Risk Management

It’s important to understand the difference between risk assessment and risk analysis. The goals of risk assessment are to:

• NOT to make decisions; but
• Quantify safety events;
• Rank safety events;
• Determine overall exposure from safety issue;
• Document proof of performed risk analysis; and
• Track exposure.

Decisions should be made based on risk analysis, which is the process of analyzing all factors involved in a safety issue. The reason we use risk analysis rather than risk assessments to make decisions is that risk assessments:

• Give a 32,000-foot, a macro overview of exposure;
• Does not provide necessary details needed for making safety decisions; and
• Provide information for management to prioritize safety initiatives.

Risk analysis DOES provide those details. However, in order to determine whether or not the risk is acceptable, safety managers should use the final risk assessment number/letter to determine whether the issue is in the “green” acceptable range, or is acceptable with additional mitigation strategies.

Risk Management Tools to Aid in Assessing Risk

Many aviation risk management tools can be used to inform management of the varying levels of operational risk. Some processes and similar risk management tools that we highly advocate for understanding risk exposure are:

• Bowtie analysis;
• Fishbone diagrams;
• Hazard Risk Register;
• Aviation safety database; and
• Aviation leading indicators.

Having a combination of the above points will significantly aid in assessing risk in terms of:

• Quality/accuracy of risk assessments;
• Efficiency of determining risk assessments; and
• Ability to make quality safety decisions based on the risk analysis process.

Related Aviation Risk Assessment Articles

• 5 Questions to Ask Before Making Risk Assessment
• How to be Compliant With ICAO Safety Risk Assessment and Mitigation
• What Types of Risk Assessments You Should Perform in Aviation Safety

Final Thought: Satisfying Risk Assessment Element of 4 Pillars

The risk assessment requirements of Safety Risk Management in the 4 pillars are satisfied when:

• There is a structured process for risk analysis that is consistent;
• Documentable evidence that reported safety issues are analyzed and assessed;
• Documentable actions that mitigation actions (see step 5 in risk analysis process above) are implemented based on risk analysis;
• Risk assessments are appropriately justified;
• Over time, risk assessments demonstrate a continuous improvement in safety exposure (increase in “green” assessments, and decrease in “yellow” and “red” assessments).

Risk assessments allow management to prioritize safety issues, whether these safety issues come from:

• audits;
• employees submitting safety concerns;
• proactive hazard identification process; or
• new management of change projects.

Risk assessments are universal processes in all aviation SMS implementations. They are perhaps the most useful tool in an aviation SMS risk management arsenal. Risk assessments are simple, fast, and easily convey the urgency and importance of the related safety issue. Risk assessments in aviation SMS implementations are here to stay for quite some time.

Quick question: For each reported safety issue that comes into the safety reporting system, how often do you do a risk assessment on average? Once? Twice? Thrice?

Last updated July 2024.