What Is an Acceptable Level of Safety (ALoS)
The objective of aviation safety management systems (SMS) is to
- Proactively manage safety,
- Identify and report potential safety hazards,
- Determine risk to operational safety; and
- Implement risk controls to mitigate identified risk.
When aviation service provider evaluates their risk to operational safety, they have to ask themselves a very pointed, and sometimes uncomfortable question: "What is our risk appetite?"
The term Acceptable Level of Safety (ALoS) defines an aviation service provider’s minimum level of acceptable risk for a given safety issue. “Acceptable” describes the need for no further mitigatory actions on the part of the service provider for the safety concern in question. This determination will be made based on the probability and severity of the evaluated safety concern.
Related Articles on Risk Assessments in Aviation SMS
- 4 Pillars | What Is Risk Assessment in Aviation SMS
- 5 Questions to Ask Before Making Risk Assessment
- How to Justify Severity of Risk Assessments - Best Practices
Why Is Acceptable Level of Safety Subjective?
Absolute safety is an impossible goal, yet service providers need to be able to set standards for how much risk is admissible. ALoS is the response to this dilemma. Because of this, ALoS is “exclusively concerned with safety performance measurement” (ICAO SSP: 6).
What this means is that, in terms of safety performance, ALoS marks the point at which, for any given hazard or potential mishap:
- The current level of safety performance remains “good enough”;
- Risk control measures needed to further increase the safety margin for the hazard/mishap would be unreasonable/unrealistic to implement; and
- Risk controls are effective enough that the residual risk is willingly taken on by the service provider.
It’s important to note that while defining a level of acceptable safety is a requirement for providers, it’s up to each provider to establish just what is and what isn’t acceptable. In this way, service providers define their ALoS, and then show (e.g., with safety data), that they operating within an acceptable range of risk.
Acceptable Level of Safety is subjective and can change as the environment changes. As an operator becomes more successful and attracts more clients, this operator may become emboldened and increase its risk appetite. When one considers an inverse economic scenario, an operator may determine that their ALoS is too aggressive and that they need to either:
- Adjust their exposure to particularly risky hazards; or
- Adjust operational processes to reduce risk by implementing supplemental control measures.
Relationship between Risk Matrix and Acceptable Level of Safety
The Risk Matrix is the backbone of ALoS in terms of:
- Drawing line between acceptability/unacceptability;
- Ensuring consistent assessment of acceptable and not acceptable risk;
- Setting benchmarks for residual assessments of allowed exposure; and
- Determining organizational authority level required to accept identified risk.
During the early stages of an aviation SMS risk management process, service providers use initial risk assessments from reported safety issues and audit findings to decide whether or not the evaluated concern meets the criteria for acceptable risk. For example, an organization might define acceptability as any risk assessment that is:
- “Green,” low-risk issues, and all other risk assessments as requiring further mitigatory action;
- “Yellow” or “green” (medium or low) risk issues, with only high-risk issues requiring further action; or
- Medium-low issues, where the risk assessment is on the lower “half” of the risk matrix.
The reason there is a variance between aviation service providers is either:
- Differing willingness to take on more risk as being acceptable (risk appetite); and
- Different defining criteria for either probability or severity.
ALoS absolutely requires very clear criteria for probability and severity in order to have consistent risk assessments across the life span of the implemented SMS.
Related Articles on Using Risk Matrix in Aviation SMS
- What Is a Risk Matrix and Risk Assessment in Aviation SMS
- How to Create Your Risk Matrix for Risk Assessments in Aviation SMS
- How to Define Your Risk Matrix in Aviation SMS
Defining Risk Matrix Probability and Severity Criteria
Aviation service providers have the opportunity to define criteria for severity and probability of their risk matrix that aligns with the operator's:
- Geographic region;
- Type of operations;
- Volume of operations; and
- Risk appetite.
This kind of flexibility allows each service provider to define risk assessment criteria that best fit the needs and environment of each operation.
Complex operators may have more than one risk matrix in their aviation SMS. Each risk matrix will be used to risk assess safety concerns for their specific division, whether the "division" is:
- Functional (flight ops, maintenance, engineering, ground side, etc); or
- Geographical region (North America, Middle East, Africa).
Other complex operators may be operating charter flight services and also maintain one or more FBOs or part 145 repair stations. I've also seen these types of companies use different risk matrices based on their "divisions."
While some aviation service providers have distinct risk matrices for each division, the general rule of thumb is to use the same risk matrix across the entire company. While this is not required, it is certainly a best practice as it increases consistency and reduces ambiguity and confusion among the managers who have to review reports based on risk assessments.
Risk matrix criteria are simply the tangible “markers” of a particular level of severity/probability. For example, you might define specific criteria for a level of severity based on:
- Financial loss;
- Damage to equipment;
- Injury/loss of life;
- Effects on operations; and
- Environmental damages.
The more criteria listed for each level of severity the better. Next, you might define specific criteria for a level of probability based on:
- Number of times occurred in company/industry in the past; or
- Rate per number of flight operations expected in the future (such as on occurrence in 100k operations, however, you define operations) given existing conditions and controls.
Establishing an Acceptable Level of Safety
Operators should create their risk matrix criteria, and decide which combination of severity likelihood is the minimum requirement for acceptance. The practices for creating a risk matrix that is swiftly being adopted is to color code cells and maybe label them as:
- Low-risk items as green, indicating "acceptable;"
- All medium risk issues (if applicable) in yellow indicating "acceptable with mitigation measures;"
- Higher grade medium risk issues (if applicable) in orange, also indicating "acceptable with mitigation measures;" and
- Unacceptable risk will be red.
Of course, each aviation service provider will need to establish what is “acceptable” as they document their aviation SMS risk management processes. However, as safety management systems are organic, “living” entities, the criteria for acceptability may change over time as:
- Oversight agencies express concern for the current level of acceptability;
- Current ALoS cannot be justified with safety data;
- SMS implementation matures and becomes more sophisticated;
- SMS implementation changes significantly in efforts to reduce complexity;
- A great number and more robust set of risk control measures are developed;
- A growing database of safety data offers a more specific picture of safety needs; and
- Safety performance improves.
Basically, at certain points in the development of an SMS' risk management processes, it makes sense to intensify the requirement for acceptability to strive towards continuous improvement and to also reduce risk to as low as reasonably practical (ALARP). These “intensifications” should be small/subtle adjustments, such as making a change that risk assessments of 2C are no longer within an acceptable range (a 2b is now required).
Whenever modifications to a risk matrix are considered, management must decide on how to treat legacy data that had been risk assessed using the historical criteria. Small changes to the risk matrix will have significantly less impact on historical reports than a large change. What can be construed as a large change? Examples include:
- Changing from a 3x3 dimensional risk matrix to a 5x5;
- Switching the X and Y axis in a risk matrix; or
- Drastically changing the layout of colored cells, such as moving red cells to the lower right when they used to be in the upper left position.
Related Articles on Performing Risk Assessments in Aviation SMS
- What Types of Risk Assessments You Should Perform in Aviation Safety
- Difference between Hazard Risk Assessment and Hazard Risk Analysis
- How to Perform Risk Assessments without Aviation Risk Management Software
Final Thought: Justifying Criteria for ALoS in Aviation Industry
As discussed, you need to justify your established criteria for the level of acceptable risk. Justifying risk matrix criteria involves using:
- Safety performance indicators; and
- Safety performance targets.
Safety targets and key performance indicators are composed using:
- Organizational safety goals and objectives;
- Safety initiatives and feedback originating from the Civil Aviation Authority (CAA);
- Safety data, such as from an aviation safety database;
- Safety charts and metrics; and
- Demonstration of “acceptable” issue safety performance.
A good way to begin this process is to review:
- Key performance indicators (KPIs) related to risk assessments;
- Leading indicators related to risk assessments; or
- Custom graphs that show hazard classifications based on risk assessments.
For a list of leading indicators that can help you get started with defining your acceptable level of safety, please see the following free resource:
Last updated Sept 2023.