Airport SMS programs and Airline SMS programs need to use a formal process for ranking various risks. Risk assessments satisfy this need and, based on your Acceptable Level of Safety policy, allow you to know which actions to take next on the issue you are assessing.
The risk assessment process in aviation SMS starts with discovery, which usually happens via:
Once reported, aviation safety managers will assess the risk in terms of the following:
Probability and severity should take into account existing risk controls. Based on the risk assessment, managers will know whether or not the safety concern is acceptable. If the issue is not acceptable, further mitigation actions will be needed.
A common practice is to perform risk assessments in the following way:
A risk matrix is an aviation industry standard grid used to perform risk assessments. Using this grid allows you to:
The elements of a risk matrix are:
For full details about risk matrix, refer to our article about what is a risk matrix and how to use it for risk assessments.
What is an initial risk assessment: once you identify a safety issue (i.e., “discover”) through hazard identification, audit, inspection, etc., the first thing you need to do is perform an initial risk assessment. In an initial risk assessment, you should:
Purpose of initial risk assessment: the main questions you are trying to answer with an initial risk assessment are:
What to do after initial risk assessment: if the risk assessment result indicates that the issue is acceptable, you can perform whatever classification or investigatory actions necessary on the issue and then perform a closing assessment. Otherwise, it’s a good idea to perform one or more reassessments as you implement corrective actions.
What is reassessing risk: if your initial risk assessment found that the issue was outside of an acceptable level of safety, you will need to implement one or more corrective actions such as additional risk controls.
We recommend that for each corrective action, you reassess risk once the action is completed. This will help you:
Purpose of reassessing risk: the main questions you are trying to answer when reassessing risk are:
What to do after initial risk assessment: after reassessing risk, you might continue to reassess risk for each additional corrective action. Once all corrective actions are implemented, you should perform closing actions on the issue and then perform a closing risk assessment.
What is a closing risk assessment: a closing risk assessment is your final assessment of an issue. It should take into account all risk controls, whether they already existed or you just implemented them with corrective actions.
Purpose of a closing risk assessment: the main point of a closing risk assessment is to document that:
What to do after a closing risk assessment: after a closing risk assessment, you may or may not reassess the issue at a later date commiserate with your issue review/validation schedule (Review reassessment). Often, issues that need new controls should enter your review/validation schedule. Very low-risk issues usually are not included in issue review schedules.
What is a review risk reassessment: each time you review an issue during your standard issue review/validation process, you should perform another risk assessment.
Purpose of reassessing risk during issue review: the main purpose of these assessments is to ensure that:
What to do after review reassessment: each time you review an issue, you should review and assess it so long as the issue remains on your issue validation schedule. Once an issue is taken off of your review schedule, no further assessments are required.
Last updated in October 2024.