RISK MANAGEMENT

Objectives
• The aims of this unit are to provide students studying aviation with a thorough grounding in the theory of
risk and its application in the aviation industry.
• The unit will also promote the development of risk theory and practice, and should enable students to
contribute at a high level to risk management strategy decisions within the aviation industry.
Definitions
Risk management is the identification, evaluation, and prioritization of risks followed by coordinated and
economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events
or to maximize the realization of opportunities.
– The processes and related policies, structures, and systems for identifying, analyzing, evaluating, and
responding to risks
– Risk management’s objective is to assure uncertainty does not deflect the endeavor from the business goals
Risks:
– directly reduce the productivity of knowledgeable workers,
– decrease:
– cost-effectiveness,
– profitability,
– service,
– quality,
– reputation,
– brand value, and
– earnings quality.
Risk is the possibility that an event will occur and adversely affect the achievement of an objective
Accident: an occurrence, where a person is fatally or seriously injured or the aircraft sustains damage or structural
failure.
Hazard – A condition that poses a level of threat to life, health, property, or environment.
Safety Event – An exposure or contributing event which alone or in combination could result in an unwelcome
event.
Undesirable Event – A stage in the escalation of an event which could without an active recovery measure become
an incident or accident.
Incident - A hazardous situation that has come to pass is called an incident.
Outcome – Actual or Potential scenario and may be assigned a consequence severity.
Consequence – A measure of personnel injury, equipment damage, material loss or reduction in availability of
function.
“Risk management. The identification, analysis and elimination (and/or mitigation to an acceptable or tolerable
level) of those hazards, as well as the subsequent risks, that threaten the viability of an organisation.” (ICAO Doc
9859).
“Safety risk management (SRM) - a formal process within the SMS composed of describing the system, identifying
the hazards, assessing the risk, analyzing the risk, and controlling the risk. The SRM process is embedded in the
processes used to provide the product/service; it is not a separate/distinct process.”
Risks themselves can be from:
• Internal to the project
– the adoption of a new technology,
– team members that are new to the project manager,
– resource constraints and internal dependencies.
• External :
– the health of the financial markets,
– competitive pressures,
– legal liabilities
– accidents.
The sheer number and type of risks that may (or may not) factor in to a given project gives a good idea of how
complex and problematic risk assessment can become.
Elements of risk management process
• Identify, characterize threats
 • Assess the vulnerability of critical assets to specific threats
• Determine, the risk (i.e. the expected likelihood and consequences of specific types of attacks on specific
assets)
• Identify(seek)ways to reduce those risks
• Prioritize risk reduction measures
Risk management should:
• create value – resources expended to mitigate risk should be less than the consequence of inaction
• be an integral part of organizational processes
• be part of decision making process
• explicitly address uncertainty and assumptions
• be a systematic and structured process
• be based on the best available information
• be tailorable
• take human factors into account
• be transparent and inclusive
• be dynamic, interactive and responsive to change
• be capable of continual improvement and enhancement
• be continually or periodically re-assessed
Dealing with the Risk
Being aware of what the risks are will dictate how effective each of the individual risk management options might be.
Avoid the Risk – This may seem obvious, but it is an actual technique. There are instances where a perceived risk
can be avoided entirely if certain steps are taken.
 E.g. a concern over a vendor supplying a given deliverable at a specific timeframe. It may be decided to
perform the actual work for the deliverable in-house thereby eliminating the risk of the external vendor.
Reduce the Risk – While some risks cannot be avoided, they can be reduced.
 accomplished by fine tuning aspects of the overall project plan or making adjustments to specific areas of
scope.
Whatever the case, reducing a risk reduces the impact it will have on your project.
Share the Risk – If a certain risk cannot be avoided or reduced, steps can be taken to share the risk in some way.
 results in it being spread out over several different injoint venture with a third-party will reduce the downside
risk for the organization as a whole.
 reduces the sunk cost and potential losses of the project if sharing of risk dividuals or groups.
Retain the Risk – This is actually a judgement call.
 Once all options are exhausted, the team members, sponsor and project manager may just decide to retain the
risk and accept the downside potential as is.
 This decision is usually made by first determining the upside potential of the project.
 If it is deemed that the project’s expected upside far outweighs the sunk cost and downside, then the risk
itself may be worth it.
Reinforcing these principles can help demonstrate how a robust risk management program supports achievement of
the organization’s mission and vision.
Risk identification,
Risk analysis,
Risk control,
Risk financing and
Claims management

Components of Risk Management

Risk identification is just what it sounds like

• What are the risks presented to the equipment or organization with the scenario in front?
• the risk of having an accident due to poor maintenance of the car
• failure to keep gas in the tank,
• Speeding
• driving under the influence
• the risk of damaging property – either the car itself or someone else’s property.
 • There is a risk of:
• financial loss if there isn’t proper liability insurance in place
• one getting a speeding ticket to death etc.

The analysis
• What is the worst that could happen?
• Put another way, how often could these adverse events happen (frequency), and if it does happen, what’s
the worst it could be (severity)?
– lose of life.
– Lose of property
– Lose of time
– Lose of name
e.g. the driver is never on the highway, only drives in good weather during daylight, on roads with speed
limits of 30 miles per hour or less, in a well-maintained car, etc.
The analysis part of the risk management process should take the individual through several of these “what if”
questions to help arrive at potential frequency and severity of an event.
Risk control
• Offers opportunities for:
– risk avoidance,
– risk prevention and
– risk reduction.
• Risk prevention aims to reduce the frequency or likelihood of the event or loss.
– preventing breakdowns by following maintenance and inspection schedules,
– keeping air in the tires and gas in the tank and following all operating laws.
• Risk reduction aims to lower the severity of a particular loss that has already occurred, for example ensuring
property damage to another person’s vehicle is repaired quickly so the time they are without a car is limited.
• The risk control program implemented will consider the various strategies already in place, and may introduce
new techniques based on the findings of the analysis activity.
Risk financing, is a way to finance losses that the risk control techniques implemented did not stop from happening.
In our example, even with all the proper maintenance on the car, safe driving, etc. an accident may still occur.
 By having appropriate insurance, funds are generated by the insurance company to pay for the losses, or in
this case, damage to the car.
Claims management.
When a loss occurs, a claim may be filed to recover damages. If the driver at fault was not insured, a different course
of action may be necessary to hold the driver personally responsible for paying for the damage.
Description
• The complete elimination of risk in aviation operations obviously is an unachievable and impractical goal (being
perfectly safe would require stopping all aviation activities and to grounding all aircraft) as not all risks can be
removed and not all possible risk mitigation measures are economically practical. In other words, it is accepted
that there will be some residual risk of harm to people, property or environment, but this is considered to be
acceptable or tolerable by the responsible authority and the society.
• Risk management, being a central component of the SMS, plays vital role in addressing the risk in practical
terms. It requires a coherent and consistent process of objective analysis, in particular for evaluating the
operational risks. In general, Risk Management is a structured approach and systematic actions aimed to achieve
the balance between the identified and assessed risk and practicable risk mitigation.
Aviation Maintenance Hazard Identification and Risk Management
Objective
The objective of Risk Management is to ensure that the risks associated with hazards to flight operations are
systematically and formally identified, assessed, and managed within acceptable safety levels.
ICAO Provisions
Several Annexes of the Chicago Convention aim to harmonise and extend the provisions relating tosafety
management by aircraft operators and aviation service providers. These changes introduce a framework for the
implementation and maintenance of a safety management system (SMS) by the operators/service providers. The
framework consists of four main components:
 Safety Policy and Objectives
  Safety Risk Management
 Safety Assurance
 Safety Promotion
Risk Management Elements
Risk management consists of three essential elements:
Hazard identification - Identification of undesired or adverse events that can lead to the occurrence of a hazard and
the analysis of mechanisms by which these events may occur and cause harm. Both reactive and proactive methods
and techniques should be used for hazard identification.
Risk assessment - Identified hazards are assessed in terms of criticality of their harmful effect and ranked in order of
their risk-bearing potential. They are assessed often by experienced personnel, or by utilising more formal techniques
and through analytical expertise. The severity of consequences and the likelihood (frequency) of occurrence of
hazards are determined. If the risk is considered acceptable, operation continues without any intervention. If it is not
acceptable, the risk mitigation process is engaged.
Risk mitigation - If the risk is considered to be unacceptable, then control measures are taken to fortify and increase
the level of defences against that risk or to avoid or remove the risk, if this is economically feasible.
• Flow chart below depicting the Risk Management process:
• Risk Management process (extracted from ICAO Doc 9859 - Safety Management Manual)
• Furthermore, effective Risk Management requires that the safety “cost-benefit” of the planned and
implemented course of actions is analysed, including the case of choosing a “do nothing” strategy.
• If it is decided to act for limiting the exposure to the identified risks, each risk control measure needs to be
evaluated, to reveal possible latent hazards and dormant risks that may arise from activating that measure.
• Once these control measures are implemented, the organisation needs to ensure they are engaged in a correct
way, and this is achieved through a set of arrangements, processes and systematic actions, which build
the Safety
Assurance domain of the SMS.
 Risk Management is based on a variety of hazard identification means. According to ICAO Doc 9859 this SMS
component may include both proactive and reactive methods and techniques. Safety occurrence
reporting and investigation, being assigned to the reactive category, are well known essential means for
identifying key risk areas and corrective risk mitigation measures. In addition, the increasing integration,
automation and complexity of flight operations requires a proactive, systematic and structured approach to risk
assessment and mitigation using predictive and monitoring techniques. Risk assessment need to be conducted for
any changes that may impact the safety of services provided by the operator/service provider.
The risk management concept is equally important in all aviation sectors and should be implemented in a consistent
manner by airline operators, air navigation service providers, certified aerodrome operators, maintenance
organisations and training organisations. Its strategies include identifying the risk, assessing the risk, avoiding or
reducing the risk and accepting certain risks.
Risk Controls – Any system, activity, action or procedure introduced to reduce the risks associated with a hazard.
 Mitigation options include – Elimination of the hazard or Reduction in the frequency of the hazard by impacting
either the likelihood or severity of outcome.
 There are essentially two ways the hazard will come to our attention, either through the raising of an issue by a
contributor, through incident, accident or observation, or by identifying the risk or exposure through various
organisational processes designed to identify the problems.
 The raising of an issue
– There are typically 2 reasons why this will happen:
– i/ Because something has happened and it has to be reported
– ii/ Because something could happen and it should be reported
– In respect of (i) we have to make sure that all maintenance personal are aware of the reporting procedures.
– In respect of (ii) we are faced with behavioural and cultural issues, there is a tendency within the
maintenance environment to under report or to fail to report
b) By identifying the risk or exposure through various organisational processes designed to identify the problems.
Organization Tools which may be employed to support the mitigation of hazards include:
– i/ Selective Brainstorming of selected Personnel (Qualitive)
– ii/ Focused studies aimed at exposing Hazards (Qualitive)
– iii/ Checklists (Qualitive)
– iv/ Audits (Qualitive)
 – v/ Surveys (Qualitive)
– vi/ Continuous Collection of Data through feedback activities (Quantative)

Remember that well-meaning, motivated, experienced technicians can make

· mistakes. Learning about and adhering to sound risk management practices can help prevent common errors that
can lead to tragic consequences. Understand the safety hazards associated with human fatigue and strive to eliminate
· fatigue contributors in your life. Fatigue has been linked to forgetfulness, poor decision making, reduced vigilance,
and other factors that can interfere with your ability to do your job safely. Pay particular attention to the safety and
security of the items that undergo
· maintenance and any surrounding components that may have been disconnected or loosened (possibly to ease
access) during that maintenance. Carefully follow manufacturers’ instructions to ensure that the work is completed
as
· specified. Always refer to up-to-date instructions and manuals when performing a task, and ask questions of
another qualified person if something is unfamiliar to you. Have a qualified person, other than the person who
performed the maintenance,
· inspect the safety and security of critical items that have received maintenance. Be thorough when performing
routine inspections. Ensure that items needing
· immediate attention are addressed rather than deferred.
4 Elements of Safety Risk Management (SRM)
1 - Safety Risk Management is a Process
The most important thing to always keep in mind about SRM is that it is a process. This process is circular, and loops
back upon itself. Different industries will use SRM slightly differently, such as by stressing the importance of
different SRM elements, but the basic principles are the same everywhere:
Hazard identification, including identification of risks, mechanisms of hazards, and other safety weaknesses;
 Understand the safety behavior (human factors) and bureaucracy that influence safety; and
 Development of control measures designed to mitigate exposure.
 Other resources online will usually identify anywhere from 3-5 stages in the risk management process, but
the basic points are understanding hazards and risks, and then taking measures to control them.
2 - SRM is One of the 4 Pillars of SMS
 The four pillars of SMS are the cornerstone of safety. They were created by the International Civil Aviation
Organization (ICAO) and every civil aviation authority uses the four pillars as the centerpiece of their SMS
requirements.
 As said, while the four pillars are supposed be equal, in actuality SRM receives the most treatment by aviation
service providers and civil aviation authorities. Why is it important that SRM is one of the four pillars? Because
it acknowledges the fact that SRM is a worldwide acknowledged cornerstone of safety management systems:
– Determines need for risk controls;
– Evaluates adequacy of existing controls; and
– Assesses whether or not areas of exposure within acceptable limits.
These are the basic components of the SRM process as defined by most civil aviation authorities.
3 - Assess and Control Hazards, Risk, and Consequences
 Much of safety risk management quality revolves around the ability to adequately assess various safety
elements such as:
 Risk control adequacy;
 Likelihood of hazard or mishap occurring;
 Severity of mishap; and
 What kinds of measures are needed to reduce exposure.
 The ability to control these elements will depend on the ability to assess them. Poor assessments lead to poor
controls. Assessments include:
 Risk analysis; and
 A risk matrix.
 Based on the findings of the analysis and assessment, safety managers should be able to identify what
hazards and risks need in order to maintain acceptable exposure. Controls are:
  Safety policy and procedures;
 Checklists;
 Aviation safety training;
 And so on.
 During aviation SMS implementation, this aspect of SRM will occupy much of a safety manager’s time.
4 - Define Acceptable Level of Safety (ALoS)
Acceptable Level of Safety (ALoS) establishes an aviation service provider’s minimum level of acceptable risk for a
hazard or risk. Acceptable describes the need for no further mitigatory actions on the part of the service provider for
the safety concern in question. This valuation will be made based on the probability and severity of the safety
concern in question.
• Absolute safety is impossible. At the same time, service providers need to be able to establish thresholds for
how much risk is acceptable. ALoS is the answer to this problem. What this means is that ALoS marks the
point at which, for a given hazard/potential mishap:
• The current level of safety performance satisfactory;
• It would be impractical or far too expensive to take the measures needed to lessen exposure; and
• Controls are strong enough that the residual risk is willingly taken on by the service provider.
• It’s up to each provider to establish how much exposure is and what isn’t acceptable. In this way,
service providers define their ALoS, and then show to civil aviation authorities (e.g., with safety data), that
they operating within an acceptable range of risk.
• Final Thought: SRM Relation to Other Pillars
• While SRM is stressed more than other pillars, it none the less depends on them.
• Safety Assurance monitors SRM processes to ensure that SRM is working;
• Safety Promotion develops the kind of aviation safety culture that allows SRM to flourish; and
• Safety Policy documents many SRM resources and activities.
Safety Risk Management
• Hazard identification
• Risk assessment & mitigation
• Safety Assurance
• Safety performance monitoring & measurement
• Management of change
• Continuous improvement of the SMS
• Safety Promotion
• Training & education
• Safety communication