Why You Need to Know the Difference Between Hazards, Risks, and Controls

Aviation management personnel and employees who truly understand the differences between hazards, risks, and different types of controls are more effective at preventing accidents and reducing costs related to preventable accidents and incidents.

Furthermore, hazards and risks are most commonly misunderstood by safety managers who need to either create or review their company's hazard and risk registers.

Can you easily tell another employee the difference between a hazard and a risk? What about the different types of control measures? Are you sure your definition and understanding are correct?

Misunderstandings About Hazards and Risks

We all have heard about hazards and risks our entire lives, so these definitions sound so easy, but in reality, I repeatedly see misconceptions about what are hazards and risks. To be completely honest, my definitions were inaccurate before I became an SMS professional over ten years ago. Hazards and risks, in my layperson view, were reversed and I could not tell you much about controls except that they keep bad things from happening.

Our understanding of each risk management term needs to be harmonized across the industry to ensure ALL aviation risk management personnel are on the same page. When safety professionals discuss hazards and risks, and how to mitigate these everyday elements, it is much easier when your definitions of hazards, risks, and control measures are the same as all the other safety professionals. Otherwise, we see confusion and very common mistakes.

Since we deal with hundreds of companies, our exposure to these misconceptions is higher than most safety consultants who deal with a considerably smaller subset of clients. Otherwise, I would not be writing this article.

In short, we all need to use the same terminology when we discuss safety and SMS. When I speak of hazards, I don't want you to erroneously conclude that my hazards are risks or vice versa. Therefore, let's start with some simple definitions in a format that allows us to compare these elements side by side:

What Is a Hazard?

As we have seen from the above table, a hazard is "anything with the potential to cause harm to people, equipment or property." A hazard is not limited to tangible objects, such as

• mountains;
• wind turbines;
• wildlife; or
• untrained employees.

Hazards can include elements beyond the physical realm, such as:

• political instability;
• economic downturns; or
• distractions.

Aviation-related hazards appear in all areas of operations. It is useful to categorize your hazards in a way that makes it easy for YOU and YOUR TEAM to manage. For example, when you create a list of hazards for your hazard register, you should group hazards in a way that makes sense for your type of operation, whether you are an:

• airline;
• airport;
• aviation maintenance organization;
• flight school;
• ATC; or an
• FBO.

Have You Read

• How to Identify Hazards and Assess Risks in Aviation SMS Programs - With Free Resources
• Moving from Reactive to Proactive Hazard Identification in Aviation Safety Programs
• How to Identify Hazards in Aviation SMS

How to Start Your Hazard List

Safety professionals and department heads with risk acceptance authority over a particular area of operations need to be familiar with operational hazards and to review their identified hazards regularly. Many safety managers and department heads do not have an existing hazard register. Otherwise, they may have inherited an incomplete hazard list or they may not have one to start with.

The best way to start a hazard list is to download an existing hazard list that has already been created by aviation industry safety professionals. Some of the better aviation SMS database software programs will have an integrated hazard analysis tool that comes with such a hazard list to serve as a template or inspiration for over-worked safety professionals.

What Is a Risk?

To help me NOT make mistakes between hazards and risks, I like to think of risk as the consequence of interacting with a hazard over a defined time period. The word "consequence" gets me started, but because of my training, I know that risk is comprised of two (or three) elements:

1. Probability (universally used);
2. Severity (universally used); and
3. Exposure (used by approximately 5% in aviation SMS).

Based on over ten years of empirical evidence, 95% of aviation service providers only consider probability and severity when determining risk. "Exposure" is a third dimension that allows for a more complete risk assessment; however, exposure adds another layer of complexity that many in your company may not be trained in.

Since exposure is seldom used in the aviation industry to assess risk, we'll skip exposure in this discussion. If you want to learn more about "Exposure," I recommend this resource:

• How to Use Exposure in Aviation Risk Management

Probability and Severity in Risk Assessments

A common misunderstanding for new safety managers is how to perform a risk assessment in the proactive hazard identification process. When you are reviewing your hazards, risks, and control measures, you will be expected to analyze and assess risk. You have to ask yourself this most important question: What am I risk assessing?

It makes little sense to risk assess the hazard because you may not be exposed to the hazard. By itself, a quick hazard analysis may not offer a complete picture, such as what happens when we interact with the hazard. What you should be focusing on are the "hazard-related consequences" stemming from "credible" risk scenarios.

When evaluating risk, you will be coming up with a metric that can be easily communicated to stakeholders. At a high level, the risk assessment will tell you whether the risk is:

• Unacceptable;
• Mitigable; or
• Acceptable.

In most cases, assessment is based on the "Probability" of the hazard manifesting itself and "Severity." I said "most cases" because there are more sophisticated practitioners that also include "Exposure," which we are leaving out. After all, chances are that you only use probability and severity in your risk assessments.

To circle back to the question as to what you are risk assessing is that you are assessing all credible risk scenarios. When you are risk assessing your "credible risk scenarios," you should also consider all of your implemented control measures. More about control measures are down below.

For a more in-depth treatment on risk assessments, see:

• What Is a Risk Matrix and Risk Assessment in Aviation SMS Programs

Prioritize Risk to Focus Risk Management Strategies

As you assess your risk scenarios (possible things that go wrong when you interact with hazards) you should also consider prioritizing your risk scenarios. This allows stakeholders to focus on the most severe or important risk scenarios and to develop defenses (controls) to:

• Detect hazard manifestations;
• Prevent occurrence; or
• Mitigate the consequences of an event.

Have You Read

• The Difference Between Hazard and Risk
• Difference Between Hazard Risk Assessment and Hazard Risk Analysis
• Going from Reactive to Predictive Risk Management in Aviation SMS

What Is a Control Measure?

Control measures are anything used to prevent harm to

• people,
• equipment,
• environment,
• mission performance and
• reputation.

We also encourage operators to include security.

Control measures cover an extremely wide variety of elements with varying ranges of effectiveness. A simple way the aviation industry can classify controls is by using the accepted "hierarchy of controls" classification. The hierarchy of controls is listed below in order of effectiveness.

1. Elimination (Physically remove the hazard);
2. Substitution (Replace the hazard);
3. Engineering Controls (Isolate sensitive resources from the hazard);
4. Administrative Controls (Change the way people work - policies and procedures); and
5. Personal Protective Equipment (PPE).

I'm hoping that you noticed that PPE is at the bottom of the hierarchy. This indicates PPE has the ignoble distinction of being the least effective control type. Therefore, when you are evaluating or implementing control measures, you should attempt to implement other types of controls first.

Importance of Control Measures in Risk Assessments

To effectively assess the risk of any risk scenario, you MUST factor in any existing controls. Risk assessments performed without considering control measures are not valid. Simply said, every safety manager and department head must be aware of implemented controls. How else can you accurately assess risk?

How do you evaluate your implemented controls?

Are your control measures documented so you can easily reference them?

Who has the most complete knowledge of controls in each area of operations? Are these the same people who document and review these control measures for effectiveness?

These questions are meant to stimulate your thought process. If you are not using an SMS database solution to manage your hazards, risks, and control measures, I wager that you are neither efficiently nor effectively managing risk in your aviation SMS. In short, there are too many moving parts to perform this activity using an MS Excel spreadsheet and paper.

Have You Read

• How to Evaluate and Justify a Risk Control in Aviation SMS
• How to Implement Effective Control Measures
• How to Monitor the Effectiveness of Control Measures

When to Review Hazards, Risks, and Control Measures?

1. When do you review your hazards?
2. Who reviews your hazards?

These are important questions. If they are not answered properly, you have already received an audit finding or you will definitely receive an audit finding if you neglect to manage the hazard identification process properly.

There are two types of review:

• Periodic monitoring; and
• Continuous monitoring.

Periodic monitoring is commonly a scheduled event performed on a quarterly, semi-annual, or annual basis. How often you review hazards, risks, and control measures depends on the complexity of your operations and the size of your hazard register. Yes, this makes sense, but in all honesty, there are a couple of other factors at play:

• Level of training received by management;
• Culture; and
• Tools at hand.

When managers know how to review hazards, risks and control measures, then this area of your SMS is more likely to pass an audit. From my impression, it seems as if the majority of managers consistently procrastinate and ultimately neglect to review these essential risk management elements. I sum it up as a lack of training, but I also know that safety culture plays an important role.

Safety managers OFTEN take it upon themselves to conduct these reviews without the active involvement of managers with "risk acceptance authority." In these cases, safety managers are sending the wrong message to department heads. What we have repeatedly seen is that since the department heads were not involved in the initial hazard identification process, they don't know that they need to perform periodic reviews. Alternatively, your earnest department heads may not have been trained on how to document these elements. Then the auditors come and issue the deserved finding.

Lack of tools suitable for the purpose is another reason that hazard reviews are neglected. To be effective, you need user-friendly tools to reduce the workload of

• organizing,
• documenting,
• report generation; and
• reviewing.

Continuous monitoring is the review of hazards, risks, and controls as they are affecting operations. This is often performed in real time. To properly monitor hazards and controls on a continuous basis, and to make this a sustainable process, you will need an SMS database solution that allows managers and department heads to easily evaluate hazards and control measures when they are treating audit and hazard reports.

The easiest way we have found to offer continuous monitoring is to integrate your hazard register into your risk management workflow for dealing with everyday reported issues and audit findings. When one classifies an "issue" with a hazard, there is an opportunity for managers to review the hazard's associated:

• Risks; and
• Control Measures.

Who Should Review Hazards, Risks and Controls?

Aviation safety managers are rarely subject matter experts across all operational areas. Yet we repeatedly see safety managers shouldering the burden to solely create and manage hazard registers.

Depending on the size and complexity of your organization, your hazards, risks, and control measures may be evaluated by:

• Single department head with risk acceptance authority; or
• Safety committee.

What you don't want to happen is for the safety manager to do all this work in a vacuum, i.e., without the participation of knowledgeable and responsible managers. Properly managing a hazard register can prove to become a large, thankless task that is best performed by a group of qualified subject matter experts with in-depth knowledge of company operations.

When department heads with the risk acceptance authority lack the time to properly document these activities, it is appropriate for a data entry subordinate to perform the documentation activities, but the respective department head should be reviewing and accepting the risk during the review process.

Monitoring Hazards and Control Measures Is Ongoing Task

In conclusion, monitoring hazards, their associated risks and control measures is a fundamental and ongoing activity in your SMS. When you can pinpoint the exact hazards and failing controls that are causing you the most grief, you are one step closer to focusing your risk management activities.

Your current SMS potentially exists in two or more disconnected data stores, such as:

1. Hazard register design data from risk management activities and
2. safety assurance data from audits and employee hazard reporting

When your SMS data is scattered among different data stores, creating a sustainable hazard-monitoring process becomes increasingly challenging. Having all your SMS data in one centralized database offers significantly more efficiency and effectiveness in monitoring.

Do you need tools to effectively manage your hazards, risks, and controls in your aviation SMS? We can help you look like a rock star!

Last updated April 2024.