Operators implementing formal aviation safety management systems (SMS) need to develop, practice and maintain a documented process of risk analysis, risk assessment, and risk control to an acceptable level of safety (ALoS). We say that the process needs to be formal in the sense that risk assessments/analysis needs to be documented and communicated to employees based on their participatory role in the aviation SMS.
The risk assessment process in aviation SMS starts with hazard identification and hazard reporting. Once reported, aviation safety managers will analyze affected systems and assess the risk in terms of the following:
Probability and severity should take into account existing risk controls. Based on the probability and severity of the reported safety issue, safety managers will determine whether or not the safety issue falls within ALoS.
Usually, the probability and severity are each determined on a scale of 1 (low) to 5 (high) for probability, and A (low) to E (high) for severity.
The aviation industry standard is to document the risk assessment results in a risk matrix. The composite score or calculated result from the risk matrix is called the "risk index."
For full details about what is a risk matrix and how to use the risk matrix in your aviation SMS' risk management processes, refer to our article about what is a risk matrix and how to use it for risk assessments.
A risk matrix is an excellent tool for quickly concluding the overall safety exposure resulting from a safety incident. Safety incidents can be real or imagined scenarios. Performing risk assessments follows a process similar to that of overall safety risk management, known as risk analysis process:
Again, it’s important to remember that risk assessments (#5 above) are only one part of the risk analysis process, as risk analysis and risk assessments have different goals.
The result of performing a risk assessment will be the risk index, which is a combination of one letter for severity and one number for probability.
It’s important to understand the difference between risk assessment and risk analysis. The goals of risk assessment are to:
Decisions should be made based on risk analysis, which is the process of analyzing all factors involved in a safety issue. The reason we use risk analysis rather than risk assessments to make decisions is that risk assessments:
Risk analysis DOES provide those details. However, in order to determine whether or not the risk is acceptable, safety managers should use the final risk assessment number/letter to determine whether the issue is in the “green” acceptable range, or is acceptable with additional mitigation strategies.
Many aviation risk management tools can be used to inform management of the varying levels of operational risk. Some processes and similar risk management tools that we highly advocate for understanding risk exposure are:
Having a combination of the above points will significantly aid in assessing risk in terms of:
The risk assessment requirements of Safety Risk Management in the 4 pillars are satisfied when:
Risk assessments allow management to prioritize safety issues, whether these safety issues come from:
Risk assessments are universal processes in all aviation SMS implementations. They are perhaps the most useful tool in an aviation SMS risk management arsenal. Risk assessments are simple, fast, and easily convey the urgency and importance of the related safety issue. Risk assessments in aviation SMS implementations are here to stay for quite some time.
Quick question: For each reported safety issue that comes into the safety reporting system, how often do you do a risk assessment on average? Once? Twice? Thrice?
Last updated July 2024.