Risk management has always been the core element of effective aviation safety programs. Before the advent of formal aviation safety management systems (SMS), aviation service providers managed operational risk in their everyday activities, but certainly not in a formal, structured process that has now become the adopted worldwide standard.
This standard has been initiated by the International Civil Aviation Organization (ICAO) in 2006. You can learn more by reading the SMS guidance material.
Aviation service providers around the globe have been spending considerable time and energy implementing ICAO-compliant SMS. For those operators that are not merely "checking the box," they have realized that there are many benefits to a sincere, wholehearted implementation. These operators are structuring their risk management programs according to best industry practices, most of which have been handed down by ICAO's safety management guidance materials.
Safety professionals today must be intimately familiar with the modern aviation risk management cycle, which is based on ICAO's risk management concepts. These concepts are broken out into these phases:
Employees, customers, and other stakeholders interact within your operating environment. They are working or using your services. During these interactions, they often identify whether a potential risk exists. When it is convenient, most will report identified hazards using formal hazard reporting tools. These reported issues are not always hazards but may cause accidents, incidents, or irregularities.
Most aviation service providers today have simple, user-friendly hazard reporting systems that minimize resistance, from the reporters' perspective to reporting these "safety issues." For example, hazard reporting systems have multiple methods for stakeholders to submit these accidents, incidents, and irregularities. They may include:
The point is that these hazard reporting systems must be easy to use to reduce friction and encourage reporting. Otherwise, stakeholders won't participate in the aviation SMS. Consequently, you will not have any reported issues to manage.
Paper-based reporting is still used, but the days of filling out a paper form and dropping it into the black hole may soon be over. Electronic reporting has some obvious benefits over the paper, including:
Reasons to continue using paper-based hazard reporting forms include:
We have seen how safety tools affect safety cultures. A good case in point is the FAA-sponsored WBAT software. In a dozen years, I have never heard a good thing said about it. Employees don't use it unless they have to. When your SMS database affects safety culture, the safety team must mitigate the risk to the SMS.
Hazard reports are no longer tied only to maintenance and flight operations. The original intention of aviation SMS is to involve the entire organization. An SMS is tied very closely to improving not only safety but also the quality of operations. Many airlines and airports have integrated safety and quality into the same departments. The beauty of this approach is that safety becomes a real and recognized cost driver to the organization.
After issues enter the hazard reporting database, the safety team commonly determines the severity and probability of risk using a risk matrix. The most common risk matrix in the aviation industry today is the 5x5 ICAO risk matrix, such as the one seen here.
Whenever potential risk to operations remains negligible, such as low to medium severity and low likelihood of occurrence, no actions may be necessary unless the issue repeats itself over time. The safety team will need to determine whether the costs to mitigate the risk outweigh the benefits of having these low-risk issues entering the system on a recurring basis. After all, one must not simply weigh the monetary costs, but also the costs to personnel in reporting the issue and the safety team's cost in managing the issue multiple times.
Safety teams must continue reactive risk management strategies whenever risk can potentially cause injury or damage to
Once the safety team has determined the level of risk, safety professionals will need to determine how to control the identified risk. In order to understand the risk, the safety professionals must be subject matter experts and have expertise in the type of affected operations. For example, a safety manager with flight ops experience may not always understand the risks associated with maintenance-related issues. In this case, safety committees should be created for more complex operations.
Safety committees are more effective at evaluating risk and determining the most appropriate corrective/preventive actions. Their proposed corrective/preventive actions will be based on the severity of the risk and the likelihood of recurrence. Their objective is to mitigate risk to as low as reasonably practical (ALARP).
Safety professionals will often brainstorm various alternatives and perform a cost/benefit analysis when necessary. Safety action plans with the highest utility and the lowest cost are naturally the most attractive.
Assigned personnel are instructed to implement corrective/preventive actions formulated in the previous phase to either mitigate or transfer the identified risk. There are often two types of corrective/preventive actions:
The short-term corrective actions are designed to recover from an event or an impending event. Long-term corrective actions are designed to reduce recurrence and prepare the airline or airport in case the hazard manifests itself again.
Once all corrective/preventive actions have been implemented, the safety team will re-assess the risk to determine whether the implemented corrective actions actually satisfied their desired intent. Whenever risk levels are not within acceptable levels, the safety team must return to the previous phase develop additional corrective/preventive actions, and then implement them.
As one can see, this may be an iterative process and may require several iterations until ALARP is achieved.
After all identified risks have been mitigated to an acceptable severity level or transferred, risks should be tracked to ensure the implemented corrective actions remain effective. Safety managers should not neglect to follow up and enter any newly identified hazards into the airline or airport's hazard register. The hazard register is also regularly reviewed. This ensures there are at least two mechanisms in place to monitor risk.
As time passes, safety teams need to conduct periodic reviews of the implemented corrective actions. The object here is to ensure that any new actions do not aggravate hazards or introduce unnecessary risk to the operation.
Whenever hazards repeatedly manifest themselves, the risk management cycle must begin again, starting with the hazard reporting and risk analysis phases. Hazards' risk control measures must be reviewed for effectiveness and when necessary, additional controls must be scheduled and implemented.
All aviation industry segments will follow a similar risk management cycle. More complex organizations will have more elaborate safety committee review processes. While simpler organizations will have very streamlined risk management processes.
Regardless of whether your organization is simple or complex, safety professionals must continue to communicate risk to all affected stakeholders. I believe this is the final phase of the risk management life-cycle that many aviation safety professionals overlook.
If you want to compare your risk management processes with industry-accepted best practices, these workflows may prove helpful.
If you need risk management tools to manage your aviation SMS program, here are some short demo videos to offer you some insight into what is possible.
Last updated July 2024.