Safety Risk Management Process

If there’s one takeaway for new professionals in aviation safety management, it’s that aviation risk management is a process. It is not a single, solid “thing.”

This process is cyclical and can be identified by several stages that form a systematic approach to safety risk management, including:

1. Establishing acceptable levels of safety, including defining likelihood and severity;
2. Hazard identification, including identification of risks, hazard mechanisms, and other safety weaknesses;
3. Evaluation of safety behavior, bureaucracy, and other factors that influence safety;
4. Creation of control measures designed to mitigate the likelihood and impact of hazards and risk consequences;
5. Implementation of risk controls into the existing safety management system;
6. Monitoring the operating environment and efficacy of risk controls; and
7. Communicating risk to employees and stakeholders.

Related Aviation Risk Management Articles

• Difference between Reactive, Predictive and Proactive Risk Management in Aviation SMS
• What Is the Process of Risk Management in Aviation SMS
• 3 Main Components of Aviation Risk Management

Other resources online will usually identify anywhere from three to five stages in the risk management process, but we have identified seven stages in order to close the feedback loop with Monitoring and Awareness.

Risk Management and Hazard Identification

Hazard identification in the safety risk management process requires several things:

• Awareness of operational processes, relevant safety data, techniques, and strategies;
• Thorough risk analysis activities and documentation of hazards, risk consequences, and mitigation strategies (risk controls); and
• Ability to spot threats in the operational environment (identify), and then document any new hazards.

Hazard and risk awareness are inspired in several different ways:

• Industry experience;
• Experience in a particular location/environment, such as long-term employment with the same company;
• Through safety promotion, such as safety newsletters, lessons learned library, safety meetings, and so on; and
• Probably most obviously, from aviation safety training.

Hazard identification is the end product of safety awareness and should result in enhanced safety hazard reporting activities. Hazard reporting is an essential bridge between Safety Risk Management and Safety Assurance. When hazards are being reported, it's a good indication that they have been properly identified and employees are aware of them.

Hazard identification can occur in two components of the aviation SMS:

• Safety risk management (SRM) during proactive hazard identification activities; and
• Safety assurance (SA) monitoring activities.

Aviation SMS' risk management processes are iterative in nature. Most existing operators have processes and workflows to deliver products and services to their clients. Documented processes provide management the assurances that the company can repeatedly deliver its products and/or services in a safe efficient manner. In an aviation SMS, these documented processes live in the SRM component. Most operators will have a hazard register that lists out operational:

• hazards;
• associated risk consequences should a hazard manifest itself; and
• risk controls to correct, prevent, or detect developing hazards.

Hazard registers may also contain relevant review documentation, such as

• who owns the associated process?
• when was the hazard last evaluated?
• what reported safety issues and audit findings are related to each hazard?

Hazard registers are commonly managed in either:

• spreadsheets (very small operators or unsophisticated SMS data management strategies); or
• SMS databases.

In the early years of SMS implementations, operators will commonly store their list of hazards in a spreadsheet. The problem the spreadsheet presents is that it is disconnected from the SMS risk management system. Operators that use an integrated SMS database can manage their all SMS activities within one system. A simple way of considering these integrated SMS databases to manage hazards is to think of: A system of related data management systems.

Related Aviation SMS Data Management Articles

• 5 Most Important Things to Know before Buying Aviation SMS Database
• 3 Benefits of Aviation Safety Management System (SMS) Databases
• 5 Things Spreadsheets Can’t Do for Your SMS

Aviation SMS Is Also a System of Related Systems

Safety professionals recognize that an SMS implementation covers a wide range of activities that can be grouped under the four pillars:

• Safety policy;
• Safety risk management;
• Safety assurance; and
• Safety promotion.

All four components are essential to an effective, compliant aviation SMS. For example, employees are encouraged to monitor the "operational systems" and report potential hazards using the "safety reporting system." Both safety reporting and auditing are part of the safety assurance (SA) component.

Employees' submitted safety reports and audit findings enter the SMS "risk management system" where risk analysis is performed and affected systems' designs are reviewed. Subject matter experts and process owners review affected systems' designs in the safety risk management (SRM) component.

Before employees report safety issues, they need training on what sort of anomalies to be aware of. Employees need training and a continual reminder to remain alert for potential safety concerns. Safety training and increasing employee awareness are managed in the "safety promotion" component.

Finally, to encourage safety reporting activities, employees need some assurances and protections against management reprisals for self-reporting. Who is responsible for reporting safety issues? Who is responsible for managing the reported safety issues? These SMS elements are managed under the safety policy component.

As we can see from a very simple example, all four components are related and are important for an organization to successfully practice safety risk management processes.

Determining Acceptable Level of Risk

An essential part of hazard identification is the risk analysis where subject matter experts and safety professionals:

1. Evaluate the adequacy of existing controls for reducing the likelihood of hazard expression or subsequent accident;
2. Evaluate existing conditions of the company, such as safety culture, behaviors, Norms, quality of documentation and analysis, etc.;
3. Determine overall exposure (based on severity and likelihood); and
4. Assess the risk of hazard expression or accident/incident.

Evaluation and risk assessment of safety issues involves:

• Determining the future likelihood of the issue having negative consequences;
• The potential severity of likely negative consequences;

Traditionally, risk assessments are performed on the risk of a hazard - i.e., the likelihood of a risk occurring, and the severity of damages from the risk.

However, many oversight agencies tend to be open to performing risk assessments on the likelihood and relative danger level of hazard expression (dangerous condition), which allows organizations to control danger at an earlier stage in the flow of safety events and mitigate danger at root causes/hazard mechanisms. In general, this is a very proactive practice, but you just need to make sure you can explain and justify any risk assessment.

Aviation service providers usually don't receive findings for the "correctness" of their actions, but rather their inability to show their processes, explain their processes, or document relevant information.

Related Aviation Risk Management Articles

• What Are Important Factors of Aviation Risk Management Process
• 8 Stages of Safety Events in Aviation Risk Management Process
• How to Document Your System Processes in Aviation SMS

Safety Risk Management and Developing Risk Controls

Risk controls are your aviation SMS' front line of defense against hazard occurrence and accidents. An essential part of the SRM process is developing risk controls where needed. By "where needed" we mean:

• Existing risk controls don't bring the condition to an acceptable level of safety (inadequacy, drift);
• No risk control exists for a condition (non-existence); or
• New hazards or risks are introduced by a risk control (substitute risk).

In either of the above scenarios, risk controls will need to be:

• Created;
• Analyzed; and
• Implemented.

Controls are generally implemented through the management of a change process or issue management process, depending on the nature and scope of the new/updated control.

Safety Risk Management Processes Never Stop

Through the safety risk management process, there is a trend toward ever-occurring continuous improvement of the operator's system and operational processes. As time passes and hazards have been mitigated, the system will naturally improve. Yet there will never become a time where the operator enjoys complete safety unless they cease operations.

The "aviation system" is an open system and the operating environment always changes. Risk will never be completely mitigated in an open system. The continual treatment of safety concerns as they arise will afford the best risk management solution that we can develop at this point of our existence. This is the reason we have required aviation SMS implementations: operators would not seek out and adopt effective risk management processes without government intervention.

Related Aviation SMS Implementation Articles

• Why Should We Implement Aviation SMS?
• SMS First Steps - How to Create an SMS Implementation Plan
• Implementing Aviation SMS for Small Providers

Final Thought: Risk Management Self Evaluation

Evaluating your own processes in the risk management process is vital. It’s important to pay attention to things like:

• How efficient are your risk management tools?
• How in-depth is your safety data – i.e., how complex are your metrics?
• How straightforward are your bureaucratic processes (could a stranger easily understand your processes)?

The SRM process is what you do to:

• Identify hazards;
• Assess risk;
• Identify risks scenarios (risk consequences); and
• Manage risk controls.

All of your risk management activities will be revolving around these concepts as you design new systems or monitor existing operational processes.

These workflows and guides for safety performance may be very useful in honing your risk management processes.

Last updated in August 2023.