What Is a Risk Matrix and Risk Assessment in Aviation SMS

What Is a Risk Matrix

Risk matrices are probably the inter-industry safety standard as the primary tool used in risk evaluation. In aviation safety management systems (SMS) they are ubiquitous.

Risk matrices are simplistic charts (though not necessarily “simple”) that use “probability” and “severity” to quantify the risk priority of a real or hypothetical safety scenario. The quantification is generally broken into 3 categories:

Acceptable risk (green);
Unacceptable risk (red); and
Acceptable with mitigation, meaning risk may not yet be as low as reasonably possible (ALARP) (yellow).

Some organizations use 1 or 2 additional colors, such as light green and/or orange, though these colors only provide further “aesthetic” and risk granularity rather than general quantification. Risk matrices are ultimately used as risk management tools to rank risks with the risk grid and the calculated risk indices.

The Risk Matrix Grid

Risk Matrix in aviation SMS risk management processes

The risk matrix is broken into a grid. The grid is usually 5x5, though it can be larger or smaller depending on company needs – we will use a 5x5 grid in this article, which happens to be the ICAO default risk matrix. The grid is used to assign a calculated “number” to the risk, which is a combination of Probability x Severity and represents the risk priority.

The risk matrix grid:

Usually increases in severity from left (low) to right (high);
Usually increases in probability from the bottom (low) to top (high); but
A risk matrix can move in any direction, so you may see risk matrices that move from right to left and top to bottom, right to left and bottom to top, or left to right and top to bottom.

We will consider the most common use of risk matrices, from left to right and bottom to top. As you can see, there is a lot of flexibility about how the risk matrix "appears" or is "laid out." What matters most is that it is:

consistent and comfortable in your organization;
easy to use;
not changed frequently to preserve historical significance; and
used in training organizational safety professionals as well as department heads and process owners.

Despite the fact that a risk matrix only contains two variables, there is a surprising amount of confusion or misunderstanding about how to use it. I constantly see different opinions about how to use it – some of these opinions are better than others. We will look at the probability and severity below, and then consider the 2 “best use cases” of a risk matrix during risk assessment.

What Is a Probability in Risk Matrix

Using a Risk Matrix in a Risk Assessment

Risk matrix probability can be used by companies in a few different ways, depending on how an organization defines “probability.” Probability can also mean likelihood or frequency, and is commonly known as ranging from “extremely rare in the industry” to “reported often in the company.”

Probability can be used to quantify:

The likelihood of the risk event happening, such as a runway incursion;
The likelihood of negative consequences materializing, such as aircraft damage from bird strike; or
An overall probability of a risk scenario, including the likelihood of a risk event and negative consequences materializing.

Many companies use probability to assess the likelihood of consequences in their SMS' documented risk management processes, though I also highly advocate using it for point #1 because point #1 is “risk event-specific” and, in my experience, a risk event’s probability is easier to assess than the likelihood of potential consequences.

Likelihood is assigned a letter value for each increment in likelihood. Low probability is assigned A, while high likelihood (in a 5x5 grid) is assigned an E. Low likelihood events mean that either the risk event/consequences are uncommon OR that good risk controls are in place to effectively mitigate the probability.

What Is Severity in Risk Matrix

Severity in risk matrices is more straightforward than probability. Severity is a consideration of:

The severity of impacts (consequences) in a safety event; and
Only accounts for “likely” outcomes.

Severity is given on a scale in either letters or numbers, depending on your preference. In the example above, the risk matrix uses letters A, B, C, D, and E, with "A" being the most severe. There are also risk matrices with numbers. For example, a risk matrix could start at 1 (low severity), and increment up by 1 for each row. In a 5x5 risk matrix grid, high severity would be assigned a value of 5.

The advantage of using numbers is that the math is a simple multiplication of probability and severity; however, one could easily assign numeric values to the letters, as in the above risk matrix. For example, A would equal 5.

Severity is generally considered as ranging from:

Negligible (1 rating): slight injury/damage, low financial consequences, and/or little effect on a mission; to
Catastrophic (5 ratings): multiple fatalities, extremely high financial consequences, and/or mission failure

High-severity risk assessments should require extensive investigations by a company and every available resource to mitigate the exposure of the safety incident.

Using a Risk Matrix in a Risk Assessment

When it comes to using a risk matrix for a risk assessment in your SMS' risk management processes, there are 2 primary approaches that companies adopt. It’s important to remember the purpose of using risk matrices in risk assessments:

NOT USED to make decisions; but
USED to rank safety events, as in to say, “here’s basically what we are looking at with this safety incident.”

A risk matrix is a bad tool for making decisions. It is designed to provide a number/letter combination to rank/prioritize an event. During risk assessment, the combination of probability and severity that is decided upon will provide the number/letter combo. Some examples for a 5x5 grid are:

Low probability and low severity: 1A
High probability and high severity: 5A
Medium-low probability and medium-high severity: 4B
Medium probability and medium severity: 3C

The numbers provide a powerful way to assess a company’s historical exposure to risk. For example, by tracking each reported safety issue’s risk index (calculation of severity and probability) in an aviation SMS database or Excel spreadsheet, a company could easily assess averages and frequency of certain severities and/or probabilities occurring.

Final Thought: Performing Manual Risk Assessments (i.e., in Excel)

Even though we discuss the visual aspects of a risk matrix as being integral to its use in risk assessments, a risk matrix can be used even without “physically” having the chart. For example, in an Excel spreadsheet you could:

Have a column for severity where you track each issue’s severity from 1-5; and
Next to the severity column, have a probability column where you track each issue’s probability from A-E.

A risk matrix is just a helpful visual tool for making these assessments.

The most useful aspect of using risk assessments in the SMS risk management process relates to prioritizing the treatment of reported safety issues and audit findings. The safety issue's desired deadline for treating the safety issue is based on the risk assessments. High-priority safety issues are naturally processed first.

After completing the risk assessment, management understands the risk priority of the safety issue and can manage accordingly. There is a documented process, and this documentation will reside in your SMS manual.

Last updated May 2023.

SMS Pro Aviation Safety Software Blog 4 Airlines & Airports

What Is a Risk Matrix and Risk Assessment in Aviation SMS