Aviation safety managers must monitor risk controls for effectiveness as they are associated with many hazards encountered in daily operations. There is an expectation of regulatory agencies that aviation service providers' implemented safety management systems (SMS) will:
Hazards mitigated with implemented risk controls may be:
In this article, we will discuss common strategies for controlling and documenting risk associated with operational hazards. These strategies should be well understood by not only the safety managers but also by members of the safety committees at your organization.
Before we discuss risk controls, we need to ensure we are speaking the same language. There are often conflicting definitions between hazards and risks among laypersons. For us to proceed, let's take a brief moment and define hazards and risks as they apply in aviation SMS discussions.
Hazards at airlines, airports, and aviation maintenance organizations are anything that can potentially harm:
Each of these hazards has measurable risk should the hazard manifest itself. Risk is the probability that a hazard will cause harm to people, property, environment, or business reputations. Risk must be "controlled" to acceptable levels to ensure all stakeholders maintain confidence in the aviation "system."
In aviation SMS, we call processes or mechanisms that reduce risk to acceptable levels
Best practices dictate that risk is minimized to as low as reasonably practical (ALARP) with the implementation of "controls in depth." Implementing "controls in-depth" means that there will always be redundancy or a failover mechanism should a hazard manifest itself and the primary risk control strategy fail.
The cost of controlling hazards' risks is almost always taken into account whenever determining what is "reasonably practicable." Cost really jumps to the forefront of any risk management discussion whenever costs are grossly disproportionate to the risk. For example, implementing expensive risk controls may not be required for managing low-level risk hazards.
Managers should never justify "exorbitant costs" as a reason for neglecting hazards with unacceptable levels of risk. Along with the same note, managers should never ignore risks with the "hope" that "things will work themselves out." This is pure negligence and unacceptable. This is not to say that "short-term" corrective actions and preventive actions have no place in your risk management processes.
Short-term corrective and preventive actions often play important roles in mitigating risk until the operator has sufficient time and resources for a long-term solution. Risk control is not always of a corrective or preventive nature. Another very important type of risk control in aviation SMS is "detective risk control." Detective risk controls are designed to alert either users or monitoring equipment that a hazard is developing. It is highly likely that your risk management processes have a combination of all three types of risk controls.
Safety managers find it useful to have a repeatable strategy or process to determine which are the most effective controls for any given situation.
The best method of controlling risk is to remove the hazard.
Again, the best method of controlling risk is to remove the hazard.
One tactic to reach ALARP is to get as many controls in place to reduce risk to as low as possible. This may sound fine on paper, but in the real world, there are many competing demands, including, but not limited to:
Health and safety professionals around the world have adopted a popular strategy called the "Hierarchy of Controls." Sometimes it is called hierarchy of hazard controls. The purpose is to determine appropriate control measures to reduce the risk to ALARP.
As we can see from the image at the right, the hierarchy is:
Again, the best method for controlling risk is to remove the hazard. Therefore, it should be no surprise that "Elimination" is at the top of the list.
Let's take an example of using the hierarchy of controls at an airport that lost a bank of lights on runway 12R. The hazard is "lack of adequate signage and lighting." The risks are potentially:
Elimination: hire a contractor to repair the lights, thereby completely eliminating the hazard
Substitution: use a different runway
Engineering Controls: place barricades and lighting to redirect traffic. Or put up temporary lighting.
Administrative Controls: Communicate to all air traffic control to alert pilots and others of the hazard. Have systems in place to ensure traffic abides by new traffic patterns.
PPE: Provide passengers and crew with helmets, shoulder pads, etc (definitely not an option!)
As you determine potential corrective actions and preventive actions to mitigate risk, conduct a residual risk assessment. When one control is not enough to reduce risk to an acceptable level, your team will have to either;
After the controls have been implemented, they should be documented. This is typically performed in two locations:
Documentation is very important. Your auditors will want to see it.
After all your hazards and controls have been documented, they can be closed. There are two trains of thought here:
I prefer the latter approach because your hazard may need to be reviewed multiple times over the coming years. Most safety managers need some sort of resolution. Therefore, we prefer to close and set future notifications when the hazard requires review.
Safety professionals require adequate risk management tools to
An SMS database will make the process of monitoring risk controls considerably less burdensome. Furthermore, the accountable executive also has the additional assurance that safety tasks will not slip through the cracks, such as when safety teams rely solely upon spreadsheets to manage SMS documentation requirements.
As of 2019, I am still surprised at how many mid-sized operators continue to use spreadsheets as their primary SMS data management strategy. Monitoring risk controls using spreadsheets is simply not sustainable. There are too many time-sensitive activities that require alerts and subsequent reviews. I don't care how organized you believe your risk management processes are, but without an SMS database, monitoring risk controls in your aviation SMS implementation will be a simple haphazard exercise. Why?
An SMS implementation requires the participation of not only the safety team but also the operational department heads. To facilitate the participation of multiple team members and subject matter experts, your SMS will become more efficient and compliant when backed up by an SMS database.
Your aviation SMS hazard/risk register should be reviewed on a regular basis. Best practice dictates that each section be reviewed on an annual basis by either subject matter experts or the process owner, which is commonly an operational department head. Documentation trails will alert auditors that your hazards are reviewed regularly.
Internal and external audits are also useful for monitoring hazards and their associated risk controls. Audits have a way of bringing these "pesky details" to the front of managers' minds. Finally, routine workplace inspections can alert safety managers of potential problems before the hazard manifests itself.
Hazard monitoring is an ongoing exercise that involves all employees. Management must review the hazards regularly and also communicate these hazards to employees through:
From my experience, the majority of employees (and managers) have the belief that the accident will never happen to them. I know this because when I was young, I wore a Superman cape. I was indestructible.
Fortunately, I wasn't working around a 45-ton aircraft that would have squished me like a bug.
Safety professionals play an invaluable role by providing objective oversight to all those Supermen who are focused on the mission. Safety professionals develop and monitor risk controls in order to allow all of us Supermen to achieve our mission.
You may be interested in risk management workflows. These are helpful to compare your workflows with others.
Last updated December 2023.