What Is Risk Assessment?

In November 2006, ICAO mandated that all member states implement formal aviation safety management systems (SMS). One objective was to provide aviation service providers with a standardized approach to managing safety.

During the aviation SMS implementation, operators must create and maintain a formal process of risk analysis and risk assessment in order to keep safety performance at an acceptable level of safety (ALoS). This process is “formal” in the sense that this process needs to be documented and reviewed.

Performing risk assessments in aviation SMS may start with hazard identification and the subsequent hazard reporting activity. Alternatively, management of change projects may have initiated a systematic review that identified either existing hazards or new hazards.

Related Articles on Risk Assessments in Aviation SMS

• 4 Pillars | What Is Risk Assessment in Aviation SMS
• What Are Hazard Risk Assessment and Hazard Risk Analysis in Aviation SMS
• How to Identify Hazards and Assess Risks in Aviation SMS - with Free Resources

During the risk management process, systems and interfaces are reviewed. After conducting the risk analysis, a risk assessment is performed by subject matter experts to determine whether the risk remains acceptable. When the risk is not reduced to as low as reasonably practical (ALARP), additional risk controls are warranted.

Risk Matrix Standard Tool for Aviation SMS Risk Assessments

In the case of system monitoring by employees or audits, a reported safety issue or audit finding initiates the risk management process. After a safety report is submitted, aviation safety managers and subject-matter experts will review relevant report details and assess risk in terms of:

• Probability of plausible negative outcomes; and
• Severity of most likely negative outcomes.

A common risk matrix is presented at the right. To perform the risk assessment, the probability and severity are each determined on a scale of:

• Probability scale of 1 (low) to 5 (high); and
• Severity scale of A (low) to E (high).

The standard method of performing risk assessments in the aviation industry is with a risk matrix. Your risk matrix may look different from the one illustrated. The red cells may be at the upper right or the lower left. It really doesn't matter how you lay out your risk matrix as long as it is logical, and all employees understand how to use your SMS risk matrix. For a full discussion about risk matrices, refer to our article about what is a risk matrix and how to use it for risk assessments.

Risk Assessments Rank Exposure

With a risk assessment, safety managers choose the number and letter that correspond to the probability and severity of issues, resulting in a number-letter combo such as 4B or 2D. The resulting combo will rank current exposure for the issue. Another common calculation for risk matrices is to use numbers for both axes. Safety managers would then simply multiply the values of the intersected cells. This approach allows safety professionals to "risk rank" or prioritize safety issues entering the risk management process.

Probability and severity represent risk levels regarding the adequacy of existing risk controls. Based on the probability and severity of the reported safety issue, safety managers will determine whether or not the safety issue falls within ALoS.

Risk assessments may be performed at different stages of the risk management process. For example, when reported safety issues are:

• Initially submitted (initial assessment);
• As new information becomes available warranting a re-assessment;
• At issue closure (closing assessment); and
• At determined review periods after the safety issue has been closed and is being passively monitored.

Related Articles on Risk Assessments in Aviation SMS

• How to Justify Severity of Risk Assessments - Best Practices
• How to Assign Severity and Likelihood to Issues When Assessing Risk
• How to Create Your Risk Matrix for Risk Assessments in Aviation SMS

How to Perform Risk Assessment in Aviation SMS

A risk matrix is an excellent aviation risk management tool for quickly ranking the severity and risk exposure of a safety incident. Risk matrices can be used for operational safety issues or safety cases. Assessing risk is an integral part of the risk analysis process.

The basic workflow is this:

1. Evaluate all hazards involved in the safety issue;
2. Review all credible risk scenarios associated with identified hazards;
3. Evaluate how well existing safety risk controls meet each hazard;
4. Evaluate if new risk control(s) is needed, and if so how severe the gap is;
5. Perform risk assessment based on elements involved, what is the severity and probability of negative outcomes in the future;
6. Implement needed changes;
7. (if applicable) Perform re-assessment of risk during implementation;
8. At issue closure, perform closing risk assessment; and
9. Continuing monitoring the system.

Documenting the initial and closing risk assessments is a meaningful metric for tracking safety management performance over time. The average reduction in incident exposure (between initial and closing risk assessments) over time is a worthy key performance indicator or leading indicator.

How to Perform Risk Assessments Without Aviation Risk Management Software

With aviation SMS risk management software, performing initial and closing risk assessments is extremely easy.

• Simply review details; and
• Click the square on the risk matrix grid.

However, not all SMS implementations have the luxury of adequate budget for risk management software – if you are in this situation, I highly recommend SMS Pro, as they have solutions that can fit most budgets.

Without aviation risk management software, risk assessments will need to be performed manually. The workflow to perform risk assessments without aviation risk management software is the same as with software. The main difference is that non-software programs will need:

• To create a document to store assessment data – Excel is a great option;
• Create a table with columns for Issue ID and/or Title, initial assessment exposure number/letter, and closing assessment number/letter.

Related Articles on Risk Assessments in Aviation SMS

• FAA Part 5 Compliance | Safety Risk Management Risk Assessment Element
• 5 Questions to Ask Before Making Risk Assessment
• What Types of Risk Assessments You Should Perform in Aviation Safety

Manual Risk Assessments' Risks and Mitigation

We continue our discussion on doing risk assessments without automated tools to document risk assessments. As safety issues are treated using the aviation SMS' documented risk management processes, associated hazards are reviewed, risk controls are analyzed for effectiveness, and safety issues are risk assessed. Safety managers will need to update their risk assessment document each time they perform a risk assessment. Now, the tricky part with spreadsheets and Word documents is that:

• Data can be lost;
• Data can be entered incorrectly; and
• The document may have duplicated entries in multiple places, and have different data on different documents.

To mitigate these risks, a good solution is to:

• Keep the Excel document on one server, and set permissions as Read Only for all users except the person(s) performing the risk assessments; or
• Create the document on a cloud server, such as with Google Sheets, with appropriate permissions.

Final Thoughts on Performing Risk Assessments Without SMS Software

Many aviation service providers still use spreadsheets as their primary SMS data management strategy. This should not be surprising as spreadsheets are ubiquitous in modern companies. What is surprising is that many medium-sized operators with more than 300 employees are still using spreadsheets to manage SMS data. This is both a problem and a risk.

Small companies with more than 60 employees should have an SMS database to

• collect SMS data;
• store SMS data;
• monitor SMS' safety performance;
• analyze data for trends; and
• track safety issues and notify management of overdue safety tasks.

Even smaller companies with fewer than 40 employees benefit from SMS database software. This is especially true for companies with high employee turnover.

While companies are managing SMS activities using spreadsheets and paper, it is not pretty and spreadsheets are not a sustainable, long-term solution. As the organization collects sufficient data, SMS data becomes very valuable in identifying trends. Without an SMS database, value-added predictive risk management activities will escape you.

If performing risk assessments manually were a good SMS data management strategy, then everybody would be doing it. But the truth is that nobody willingly manages an SMS using archaic tools. An SMS database is well worth the investment and has many other benefits.

Risk management workflows can make or break your ability to perform accurate assessments. See our aviation industry tested and proven workflows and maximize your efficiency.:

Last updated January 2023.