Safety Management Systems

for aviation: a practical guide

SMS 3
Safety risk
management

3rd Edition
ISBN 978-1-76137-005-2- (Print)
ISBN 978-1-76137-006-9- (PDF)

© 2022 Civil Aviation Safety Authority.

First edition published (2012), Second edition (2014)

For further information or additional copies visit CASA’s website: [Link]/sms

Notice: The information contained in this document was correct at the time of publishing and is subject to change without notice. It has
been prepared by CASA Safety Promotion for educational purposes only. This guide outlines basic procedures – it should never be used
as a replacement for official manuals or procedures. Reference should be always made to the appropriate procedures prior to the use of
this information.

The Civil Aviation Safety Authority is responsible for the safety regulation of Australia’s civil aviation operators, and for the regulation of
Australian-registered aircraft outside Australian territory.

Unless noted otherwise, copyright in this work is owned by CASA. This work is licenced under a Creative Commons Attribution 4.0
International (CC BY 4.0) Licence, with the exception of the Commonwealth Coat of Arms, CASA’s logo, any third party material, any
material protected by a trademark and any images and/or photographs.

Use of any part of this work must include the following attribution: ‘Source: Civil Aviation Safety Authority’.

Written requests for permission or enquiries should be emailed to [Link]@[Link].

Before using any third part material in this work, you must contact the owning party directly to seek permission to use it.

Cover image: Adobe stock | Crystal Sing.

2207.4488
 SMS 3Safety risk management 1

Contents

What is safety risk management? 2

Identifying safety hazards 5
Identifying safety risks 8
Safety risk assessment and mitigation 11
Completing a risk assessment 13
Documentation 21
Human factors related risks 22
ALARP and SFAIRP 22
Outcomes‑based and PSOE considerations 26
Toolkit – Booklet 3: safety risk management tools 28
2 SMS 3Safety risk management

What is safety risk activities can co-exist with hazards if they

are controlled appropriately. Therefore,

management? hazard identification is the first critical step

in the safety risk management process,
requiring a clear understanding of your
Safety risk management is the identification,
hazards and their related consequences to
analysis, and elimination or mitigation to an
maintain an acceptable level of safety within
acceptable or tolerable level of the hazards,
your operations.
and their subsequent risks, that threaten
the viability of an organisation (International History shows aircraft accidents not only
Civil Aviation Organization [ICAO] Safety ruin lives, but also affect business if output
Management Manual, Doc. 9859). is lost, assets or equipment are damaged,
insurance costs increase, or you have to go
Before a safety management system (SMS)
to court. Legally, you must assess the risks
can be effectively built or improved, you
to safe operations in your workplace and
must identify the safety hazards to your
implement a plan to control those risks.
operation and ensure you have controls
in place to manage risk. An SMS should Safety risk management is a key component
be risk-based and will vary depending on of an SMS and involves two fundamental
the type of aviation activity. For example, safety-related activities:
the risks involved in operating helicopters
1. identifying safety hazards
regularly at low level are quite different
to those of regular scheduled passenger 2. assessing the risks and mitigating them
services, or those of a maintenance (reducing the potential of those risks to
organisation. Accordingly, each operator’s cause harm).
SMS will need to reflect the nature of the
risks that are identified. SMS Component Element
Safety risk management is a careful
examination of what, in your work, Safety risk Hazard identification
could cause harm, so that you can weigh management
up whether you have taken enough Safety risk
precautions, or should do more to assessment and
prevent harm. mitigation

Safety hazards are inevitable within

aviation. However, the manifestation and Risk management is an integral component
potential adverse consequences can be of safety management and involves some
addressed through mitigating actions essential steps, as shown in the figure on
that aim to control potential hazards, page three.
resulting in unsafe conditions. Aviation
 SMS 3Safety risk management 3

Essential steps involved in safety risk management

Hazard & risk identification

Equipment, procedures,
environment, processes, etc.

Risk severity analysis

The seriousness of the consequence
if it does occur

Risk probability analysis

The likelihood of the consequence
occurring

Implement
new controls/
mitigations
Risk assessment & tolerability
Is the assessed risk acceptable and
within safety performance criteria?

Yes No

Accept the risk Take mitigating action

and document for to reduce risk to an
periodic review acceptable level
4 SMS 3Safety risk management

Aviation safety vs corporate Safety hazards vs

risk management WHS hazards
Aviation safety risk management is the Safety risks associated with compound
process and procedures used to manage hazards simultaneously impacting aviation
risks relating to aviation activities, with the safety as well as workplace health and
key outcome to enhance operational safety. safety (WHS) should be managed through
This is relative to aviation hazards; that is, a a parallel risk mitigation process to
condition or an object with the potential to address the separate aviation and WHS
cause or contribute to an aircraft incident consequences, respectively. Alternatively,
or accident. an integrated aviation and WHS risk
mitigation system may be used to address
Corporate or business risk management
compound hazards.
encompasses all business-related risks
materially affecting the achievement of an An example of a compound hazard is a
organisation’s functions, expectations or lightning strike on an aircraft at an airport
goals. While in some organisations, this may transit gate. This hazard may be deemed by
include aviation safety risks, as they impact a WHS inspector to be a ‘workplace hazard’
on business outcomes, the key outcome to ground personnel within their workplace.
from corporate risk management is the However, within aviation safety, it is also an
achievement of business objectives (e.g. aviation hazard with risk of damage to the
profits, market share). aircraft, and a potential risk to passenger
safety through a consequential aircraft
incident or accident. It is important to
consider both the WHS and aviation safety
consequences of such compound hazards,
as they are not always the same. The
purpose and focus of preventive controls
for WHS and aviation safety consequences
may differ. As a result, organisations
need to consider that if they have already
identified a WHS hazard and implemented
controls to manage a WHS risk, these may
not be effective controls for aviation safety
risk management.
 SMS 3Safety risk management 5

Identifying safety When identifying hazards and aviation

safety risks, organisations should consider

hazards risks regardless of whether their source

is under their control. While hazards can
arise from sources or threats you cannot
A hazard is anything that could cause
directly control, your organisation can
harm, damage or injury, or have a negative
develop controls or mitigations to reduce
consequence, such as bad weather,
any potential safety risks arising from
mountainous terrain, lack of emergency
these sources. This is highly relevant in
equipment, high workload, fatigue, or use of
our industry, where we routinely operate
alcohol and other drugs.
in environments outside our control
The risk management process (e.g. hazards or threats posed from
systematically identifies hazards that exist weather, wildlife).
within the context of the organisation.
There are several useful methods of
These may result from systems that are
identifying hazards:
deficient in their design, technical failures
or human–machine interfaces. However, • brainstorming: small discussion
hazards can also result from failures of groups meet to generate ideas in
existing processes or systems to adapt to a non‑judgemental way
changes in the operating environment. • research of historical safety papers
and articles
It’s not unusual for people to confuse
hazards with their consequences. A hazard • formal review of standards, procedures
is a condition or object that could cause or and systems
contribute to an unsafe outcome, whereas • staff surveys or questionnaires
a consequence is the outcome that is • one person standing back from the
triggered by the hazard. operation and monitoring it critically
There are many ways of identifying and objectively
hazards and quantifying risks, but to • internal or external safety assessments
do it successfully, you have to think and audit reports
laterally, unencumbered by past ideas and • safety incident reviews or
experiences. Operational hazards can be investigation reports
obvious, such as bad weather, or they may
• hazard and safety reporting systems
be subtle, such as the insidious effects of
• use of conceptual models such as:
long-term fatigue.
– SHELL model
The dynamic and variable nature of human
– Reason’s accident causation model
behaviour, human performance and
cultural elements should also be considered – bow-tie analysis.
routinely throughout the risk management
process. Unlike operational hazards, these
human behaviour, performance and
culturally driven hazards are more likely to
change and shift, while also compounding
and influencing operational hazards.
6 SMS 3Safety risk management

There are two main methodologies for Hazard identification should be a

identifying hazards: continuous and ongoing activity. Some
• reactive: involves analysis of past conditions may warrant more detailed
outcomes or events. Hazards are investigation or assessment to determine
identified through investigation of safety potential hazards, including:
occurrences. Incidents and accidents are • instances where the organisation
an indication of system deficiencies and experiences an unexplained increase in
therefore can be used to determine which safety-related events or regulatory non-
hazards contributed to the event compliances
• proactive: involves collecting safety • any significant changes to the
data of lower consequence events or organisation and its activities.
process performance, and analysing
The goal is to proactively identify
the safety information or frequency of
hazards before they lead to an unsafe
occurrence to determine if a hazard
outcome, whether it is a safety-related
could lead to an accident or incident.
occurrence, incident or accident. An
The safety information for proactive
important mechanism for proactive hazard
hazard identification primarily comes
identification is a voluntary safety and
from flight data analysis programs,
hazard reporting system. Information
safety reporting systems and the safety
collected via a safety reporting system
assurance function.
can be supplemented by observations or
findings recorded during site inspections,
safety toolbox talks or audits.

Hazards are
conditions or objects
with potential to
cause or contribute
to an aircraft
accident or incident
(ICAO Doc. 9859).
Image: Civil Aviation Safety Authority
 SMS 3Safety risk management 7

Safety reporting Voluntary safety reporting systems should

provide the ability to report confidentially,
The main source of identifying hazards is requiring that any identifying information
an organisation’s safety reporting system, about the reporter is known only to the
including voluntary and mandatory safety custodian of confidential safety information
reports. While mandatory reporting is for follow up. The role of custodian
normally used for incidents that have should be kept to a few individuals,
occurred, voluntary reporting provides an typically restricted to the safety manager
additional reporting channel for potential and personnel involved in the safety
hazards, near misses and errors that have investigation. In smaller organisations, this
not resulted in a safety incident. role may be fulfilled by a single person,
It’s important and paramount for the whereas in larger organisations, you may
effectiveness of an SMS that organisations have a team of safety custodians in charge
provide appropriate protections to of confidential safety data.
encourage safety reporting, especially Promoting voluntary reporting, supported
voluntary reporting. Operators should by the ability for confidential reports, helps
consider clearly documenting and facilitate disclosure of hazards, especially
communicating that safety reports will be those resulting from human error, without
used solely to improve safety and not for fear of retribution or embarrassment. While
enforcement or other punitive actions. not encouraging a no-blame reporting
The intent is to promote an effective safety culture, it allows for individuals to feel
culture and proactive identification of supported in reporting when they have
hazards before operational incidents occur. made an error so the system can work
Personnel at all levels across the towards identifying ways to reduce the
organisation should be actively encouraged potential for these errors to occur again or
to identify and report hazards and other lead to unsafe outcomes.
safety issues. To be effective, safety Voluntary safety reports may be de-
reporting systems should be readily identified and archived once necessary
accessible to all personnel. Depending follow-up actions are taken. De-identified
on the size of your organisation, a paper- reports can support future trend analysis to
based, web-based or desktop form could track the effectiveness of risk mitigation and
be used. Having multiple entry methods to identify emerging hazards.
available maximises the likelihood of staff
engagement. Everyone should be made
aware of the benefits of safety reporting,
what should be reported and how to submit
a safety report.
8 SMS 3Safety risk management

Hazard identification checklist

F The organisation has established F Procedures are maintained for the
various ways to proactively identify internal and external reporting and
hazards through discussion groups, recording of hazards and other
reporting or surveys. safety-related issues to enable
analysis and organisational learning.
F The organisation uses the database of
reported hazards to: F The organisation has processes in
– identify hotspots needing particular place to ensure identified hazards are
attention dealt with in a timely manner, and the
results of any actions are fed back to
– conduct trend analysis, which
staff.
can help to improve hazard
identification.

Identifying control of the organisation, such as extreme

weather, wildlife or volcanic ash. Hazards

safety risks related to emerging industry safety risks

are also an important way to prepare for
situations that may eventually occur.
The term risk refers to the chance that
somebody could be harmed by various If you are a small aviation organisation
hazards, together with an indication of with only a few staff, you simply need to
how serious the harm could be. From your apply discipline and make time to examine
identified hazards – something that can all facets of your operations and identify
cause harm – you need to determine what any applicable safety hazards and risks.
the potential safety risk could be, that is, the You need to either eliminate them where
unsafe outcome that could result from the possible, vary the operation or redesign in
hazard. a practical way. You need to be able to be
satisfied that all risks are managed to an
For example, wildlife on the runway is
acceptable level.
a safety hazard, whereas the risk is the
outcome this hazard could cause. An For larger organisations, setting up
example might be kangaroos on the runway discussion groups with several staff and
during aircraft landing resulting in aircraft line managers is a good way of identifying
wildlife strike causing aircraft damage and hazards and risks. The group discussions
potential passenger injuries. will also encourage staff to become
more actively involved in establishing or
For some hazards, there may be more
improving your SMS.
than one possible outcome or safety risk.
In these instances, you should record all To avoid accidents and incidents,
potential safety risks. However, you may organisations should implement multiple
find when undertaking your risk assessment layers of controls or defences. However,
processes that addressing the most controls are never foolproof. For example,
significant risk could also address other having well-trained maintenance engineers
possible risks arising from the same hazard. does not ensure aircraft components
are always fitted correctly, and standard
Hazard and risk identification should also
operating procedures for flight crew are
consider risks that are generated outside
only as effective as competency will allow.
of the organisation and outside the direct
 SMS 3Safety risk management 9

Safety risks are the

consequences or
outcomes of hazards.
(ICAO Doc. 9859)

Image: Adobe stock | fizkes

Communicate and consult Focus group discussions should ask

participants to brainstorm types of safety
Talk to your stakeholders, both inside and hazards they think may threaten the safety
outside your organisation. Who are they? of passengers, employees, or contractors.
What do they want? What is the best way The group should also consider hazards
to involve them? For your safety system to that could damage equipment or harm the
be effective, you need to have everyone’s environment. For example, for flight crew,
buy-in. fuel exhaustion would be a hazard that
Involving all stakeholders also allows for could result in the loss of both an aircraft
different perspectives to be considered and its passengers. For maintenance
when identifying hazards and risks, engineers, fatigue might be a hazard during
conducting risk assessments and identifying night shift operations and could result in
controls. As not all parts of the organisation maintenance errors. Even a procedure
will see hazards and risks in the same light, developed in one part of your organisation
bringing in all relevant stakeholders allows could create a hazard in another.
for a wider consideration of your current There may also be systemic hazards –
hazards and how well you are managing organisational factors that could result
your risks. in the loss of an aircraft or injury to
Bringing together relevant stakeholders passengers. These hazards could include
allows for the consideration of their insufficient or inadequate training, lack
objectives, perceptions, and potential of policies or procedures, or people
biases. Risk perception varies across your not following documented policies or
stakeholders due to different assumptions procedures.
and needs. Factoring in these different
perspectives is an integral part of effective
risk management.
10 SMS 3Safety risk management Case study Case study

Image: Civil Aviation Safety Authority

to fly to the city in the morning. During the

graveyard shift, she wiped away an oil leak
on the hydraulics, but, bone tired, did not
notice the missing fasteners.
Outback Maintenance Services has a
When the GP arrived in the morning, he
close call involving engine cowl fasteners.
discovered the missing fasteners on his
Mick Jones, the safety officer and senior
walk-around and was understandably
licensed aircraft maintenance engineer
unimpressed. ‘If you can’t get this right, what
(LAME), hears from the apprentice, Jayne
else have you missed?’ he asked pointedly.
Yaeger, that an aircraft went out with
the fasteners missing. The other LAME, Peter Lawson called a toolbox meeting.
Geoff White, was due to finish the service ‘There are things that stand between us
on his shift, but had footy practice for and an accident. We’ve got to make sure
the finals that weekend and left in a rush, they’re working properly. How do we learn
saying over his shoulder as he raced out from this, and make sure it doesn’t happen
of the hangar, ‘Mate, all done. Just give the again? Bush Aviation won’t want us doing
aircraft a wipe-over; the doc will be here any more of their maintenance, nor will
in the morning’. Jayne had done double Outback Exploration, if we can’t show more
shifts – 16 hours straight – and had to have professionalism.’
the Beechcraft finished for the local doctor
 SMS 3Safety risk management 11

Safety risk Be honest and pragmatic about control

effectiveness, as not all controls will be as

assessment and effective as others. This is especially true

of administrative controls compared to

mitigation engineering controls. Another consideration

for the effectiveness of administrative
controls is to recognise whether all staff
You should already have a good idea of
are actively aware of them and have been
the risks, and of any control measures that
trained appropriately on them. For more
you can easily apply. You probably already
information on types of controls, see
know whether, for example, you have
Hierarchy of controls in the toolkit at the end
employees who commute a long distance
of this booklet.
to work areas, or areas of maintenance that
are more prone to risk. If so, check that You will then have a list of effective
you have taken reasonable precautions to controls, as well as a list of which controls
avoid incidents. need improvement.
If you run a small organisation and are
Current controls and their confident you understand what’s involved,
you can do the assessment yourself, but
effectiveness having another set of eyes to crosscheck
Once you identify your hazards and risks, your assumptions is always a preferred
you should identify possible defences, method. You do not have to be, or employ,
controls or mitigations already in place to a risk specialist, as you will most likely know
manage them. the risks in your small business the best.
They are often the stress points already
One defence against an inflight fire is a
causing some concerns for you.
fire extinguisher; a defence against aircraft
fuel contamination is correct fuel filtration If you work in or run a larger organisation,
procedures and regular fuel testing. This you can ask an advisor to help you. If you
step should provide a list of current controls are not confident, ask someone competent
and defences against each risk, recognising for advice. In all cases, you should make
that some controls will defend against sure that you involve your staff or their
multiple risks. representatives in the process. They will
have useful information about how the
You also need to assess how effective each
work is done that will make your risk
control and defence is. Would the control
assessments more thorough and effective.
prevent the occurrence (i.e. does it remove
the hazard?), or just minimise the likelihood Safety risk assessments and risk mitigations
or the consequence? You can determine need to be continuously reviewed and
how effective a control is by asking, for updated to ensure they remain effective
example: ‘Does the crew know how to in managing and maintaining risks within
use the fire extinguishers, and are the your organisation. This is especially
extinguishers correctly maintained?’ Or ask critical anytime there is a change in your
yourself, if that control did not exist, what operating environment, as changes can
the possible outcome could be. have unintended consequences on the
previously listed effectiveness of controls,
or they can introduce new hazards into
your organisation.
12 SMS 3Safety risk management

7 basic steps for risk management

F 1. Identify safety hazards across F 5. E
 valuate the effectiveness of
your operations that could harm each defence and control.
people, equipment, property or
F 6. Identify additional defences
the environment.
and controls where required.
F 2. D
 escribe how each hazard could
F 7. R
 ecord and continue to monitor
lead to a risk to safe operations.
all this information in a hazard or
F 3. R
 ank the severity and likelihood risk register.
of these risks.
F 4. Identify the current defences and
controls in place to manage them.

© Karen Scrimes
 SMS 3Safety risk management 13

Completing a risk Step 2 – Identify the risks

assessment
Decide what might be harmed and how the
harm might be caused, that is, the risks. For
each hazard, you should identify what might
occur. You will also need to identify the
Step 1 – Identify the hazards possible reasons; these are the root causes
or contributing factors for the risk.
Work out how safe operations could be
harmed. The hazard identification methods An online search for SMS software will
already mentioned are a good start. provide numerous potential suppliers of
However, when you are in your workplace affordable software to manage all this. For
day after day, it is easy to overlook hazards, smaller operators, this could be as simple as
so here are some additional tips to help you using a spreadsheet to record these events.
identify the ones that matter: However, as your organisation grows, move
• Walk around your workplace, observing to a software solution so you don’t lose
work as it’s happening, looking for things all the hard work and risk management
that could reasonably be expected to knowledge you have built.
cause harm. Involve your employees –
What?
they may have noticed things that are
not immediately obvious to you. Incorrect aircraft loading can affect the
• Review your incident and accident safety of flight crew, cabin crew, passengers
records. They can often help to identify on board and people on the ground.
less obvious hazards.
Causes?
• Review previous safety occurrences and
maintenance errors. These will help in Incorrect aircraft loading can result from:
understanding risks and their potential • poor weight and balance calculations
likelihood and consequences. • failure to weigh baggage correctly
• Review CASA or ATSB reports. • miscommunication between flight crew
• Ask similar organisations what they found and aircraft loading staff
and have done about it. • failure to secure freight properly
For example, one of the safety concerns for • loading of the wrong baggage or freight
air transport operators is incorrect loading on the flight
of passengers or freight on the aircraft, • information entered incorrectly into the
which can lead to accidents. flight management system.
14 SMS 3Safety risk management

Step 3 – Evaluate the risks process simple and get global views about
how significant an issue the hazard really is
Having identified the hazards and their in the context of all the risks identified.
potential risks, you then need to decide
what to do about them. You must ‘do An important task in analysing risk is
everything reasonably practicable’ to to determine the risk level based on its
mitigate the risks. You can work this out for consequence and the associated likelihood.
yourself, but the easiest way is to compare Consequence is the potential impact or
what you are doing with good practice or unsafe outcome that may result from the
with what your competitors are doing. hazard. This can range in severity from
Examine what you are already doing. Think negligible or insignificant to catastrophic.
about what controls you have in place and Likelihood consists of two parts:
how the work is organised. Then compare
• the likelihood of a single event occurring
this with good practice and see if there is
more you should be doing to bring yourself • the likelihood of the event occurring
up to standard. Ask yourself: based on exposure and repetition (how
often the task is performed, such as cycles
• Can I eliminate the hazard altogether?
of aircraft maintenance)
If not, how can I control the risks so that
harm is unlikely or reduced further? A simple way to determine the likelihood
• Can I try a less risky option? Prevent is to rank the risk based on its potential
access to the hazard? Reduce exposure to frequency of occurrence. This can
the hazard? be done on a simple five-point scale,
from ‘extremely improbable or rare’ to
Improving safety need not cost an ‘frequent or almost certain’.
enormous amount. For instance, placing
a mirror on a dangerous blind corner Assessing risk severity or
of the airport apron to help prevent consequence
vehicle accidents is a low-cost precaution,
considering the risks. Failure to take simple The procedures for risk management in
precautions can be much more costly if an your SMS should contain a risk assessment
accident does happen. matrix accompanied by descriptors for
levels of severity or consequence. With
Evaluate risk level reference to these descriptors, consider any
current mitigation measures and assess
Factors to consider are the severity
the severity in terms of the worst possible
(how bad the outcome would be) of any
realistic scenario. Realistic is the operative
consequences arising from the hazard,
word here; don’t automatically jump to
and the associated likelihood (how often
the absolute worst possible scenario, be
the hazard might result in the identified
realistic as to what is the most realistic
potential safety occurrence).
unsafe outcome. However, don’t underplay
For example, a serious inflight fire would be unsafe outcomes either. Saying ‘It’s never
catastrophic if it were to occur, but it might happened to us before’ is also not realistic.
be an unlikely occurrence. This may then
rank above a bird strike which, although in
many cases they tend to be less severe, they
are much more likely to occur. Keep the
 SMS 3Safety risk management 15

Likelihood of occurrence Safety risks can be conceptually assessed

as acceptable, tolerable or intolerable.
Similar to assessing severity or consequence,
These levels are generally also displayed
SMS procedures for assessing risks should
in a colour-coded traffic light system of
define different levels of likelihood. Consider
green, amber and red to drive attention
any current mitigation measures, their
for recommended actions. To determine
effectiveness to address the root causes
whether a risk is tolerable, you also need to
and contributing factors or minimise
consider your legal/legislative requirements,
the consequence, and whether they are
expert judgements, cost-benefit analysis
currently used. Then assess the likelihood
and industry best practice. For example,
or probability of the risk occurring.
you cannot deem a risk acceptable or
The safety manager will enter the results tolerable if regulations, legislation or other
into the safety report and hazard log. laws require additional actions be taken.
This includes not only CASA legislation,
Use a risk tolerability matrix to assess
but also WHS, state and federal legislation.
how tolerable the risk is using the results
While an SMS is designed to be outcomes
obtained from the assessment of the
based, there will still, in some instances,
consequences and likelihood. Tolerability
be prescriptive compliance requirements
matrixes should be designed with reference
to be met when addressing risks.
to other risk principles designed to assist
in determining whether all relevant, Safety risks assessed as initially falling in
reasonably practical measures have been the intolerable region are unacceptable
taken to manage risks accordingly (see the under any circumstances. The severity or
ALARP/SFAIRP section later in this booklet probability of the consequences of the
for more information). hazards are of such a magnitude, and the
damaging potential of the hazard poses
such a threat to safety, that mitigation
action is required, or activities are stopped.

Safety risk description Recommended action

Intolerable Take immediate action to mitigate the risk or stop the activity.
Perform priority safety risk mitigation to ensure additional or
enhanced preventive controls are in place to bring down the
safety risk index to tolerable.

Tolerable Can be tolerated based on the safety risk mitigation. It may

require a management decision to accept the risk.

Acceptable Acceptable as is. No further safety risk mitigation necessarily

required.
16 SMS 3Safety risk management

ICAO Safety Risk Assessment Matrix

ICAO Document 9859: Safety management manual provides an example of a risk
assessment matrix that illustrates how the risk severity and probability work together
in the risk assessment, resulting in a green, amber or red tolerance within the matrix,
as illustrated below.
It should be noted, however, that this is only one example of how risk levels and
ratings can be assigned and is not the only way to perform risk assessments within
safety risk management.
Risk severity
A B C D E
Catastrophic

Hazardous

Moderate

Minor

Negligible
Risk probability
5 Frequent 5A 5B 5C 5D 5E

4 Occasional 4A 4B 4C 4D 4E

3 Remote 3A 3B 3C 3D 3E

2 Improbable 2A 2B 2C 2D 2E

1 Extremely improbable 1A 1B 1C 1D 1E

Image: Adobe Stock | Martin D Brown

 SMS 3Safety risk management 17

Severity/
Value Consequence Meaning

A Catastrophic • Multiple deaths

• Equipment destroyed

B Hazardous • A large reduction in safety margins, physical distress, or a

workload such that the operators cannot be relied on to
perform their tasks accurately or completely
• Serious injuries or death
• Major equipment damage

C Moderate • A significant reduction in safety margins, a reduction in

the ability of the operators to cope with adverse operating
conditions as a result of an increase in workload or as a
result of conditions impairing their efficiency
• Serious incident
• Injury to persons

D Minor • Nuisance
• Operating limitations
• Use of emergency procedures
• Minor incident

E Negligible • Few consequences

Likelihood Meaning Value

Frequent Likely to occur many times (has occurred frequently) 5

Occasional Likely to occur sometimes (has occurred infrequently) 4

Remote Unlikely to occur, but possible (has occurred rarely) 3

Improbable Very unlikely to occur (not known to have occurred) 2

Extremely improbable Almost inconceivable that this event will occur 1

18 SMS 3Safety risk management

Step 4 – Risk mitigation However, you cannot continue operations

if a risk is assessed as ‘intolerable’ until
Once you determine the risk levels, assess that risk is mitigated to acceptable level.
the safety defences or controls in place to Be reasonable and realistic with your risk
work out how effective they are against the action plans. Don’t take extra time if a
risk. If you determine they are fully effective, mitigation can be implemented effectively
the operation can continue. If not, consider in the shorter term, and even consider the
how to improve controls, or to remove or ability to put temporary risk mitigations or
avoid the hazard entirely. controls in place while more permanent
You should manage the risk to the point effective mitigations and controls are
of being as low as reasonably practicable being developed.
(ALARP) or so far as is reasonably You need to allocate tasks to the right
practicable (SFAIRP). You should consider people, with timelines for getting the
and apply all possible means of mitigation job done. One large successful operator
until the cost of mitigation is grossly makes sure things are done by having the
disproportionate to the benefit you obtain. CEO as the only person who can approve
Don’t just stop your risk mitigation when extensions. There must be a very good
you reach your so-called green tolerability reason for any extension request.
threshold – stop when all reasonable and
practicable steps are in place. A good plan of action often includes a
mixture of different things. There may be
In some instances, there could be a range of a few cost-effective or easy improvements
solutions to manage a risk. Typically, some you can do quickly, perhaps as a temporary
are engineering solutions (e.g. redesign), solution until more reliable controls are
which, although probably the most effective, in place. Remember to prioritise and
may also be expensive. Others involve tackle the most important things first. As
administrative (e.g. operating procedures) you complete each action, tick it off your
and personnel (e.g. training) controls, and plan and consider the effectiveness of
might be less costly. The solution need controls post implementation and in your
not be costly to be effective, as long as it is subsequent risk assessments (see Steps 6
designed to reduce your overall safety risk. and 7).
For example, safety defences or controls While many safety defences and controls
in place to prevent incorrect aircraft in place may be assessed as effective,
loading include: additional measures may still be required,
• securing cargo more effectively which you will detail in a risk management
• cargo and baggage weighed separately action plan outlining short-term and longer
term measures, as shown in this example
• standard load sheet used by pilots to
for our loading risk.
calculate weight and centre of gravity of
the aircraft
• correctly calibrated scales that are
routinely calibration tested.
 SMS 3Safety risk management 19

Short term A risk assessment does not have to

• Extra nets and straps to be made be perfect, but it must be suitable and
available to secure cargo correctly sufficient. You need to be able to show:

• Standard load sheet to always be held • you made a proper check

in the cockpit • you asked who might be affected
• you dealt with all the significant
Long term hazards and their identified safety risks,
• Standard initial and recurrent training for considering the number of people who
all people involved in baggage handling could be involved
and aircraft loading • your precautions are reasonable, and
It is important to involve the ‘end users’ any residual risk is as low as reasonably
and subject matter experts in determining practicable
appropriate safety risk controls. Ensuring • you involved your staff, or their
the right people are involved maximises representatives, in the process.
the practicality of risk mitigations.
If, as in many organisations, you find that
A determination of any unintended
there are several improvements to be
consequences, particularly the potential
made, both large and small, do not try to do
introduction of new hazards, should be
everything at once. Create an action plan
made prior to the implementation of any
to deal with the most significant risks first.
mitigations or controls.
CASA inspectors acknowledge the efforts
of aviation organisations that are clearly
Step 5 – Record your findings trying to make improvements, recognising
effective risk mitigating actions can
and implement them sometimes take time.
Having assessed the risk and the defences
in place, decide how to implement your risk
management plans. You may avoid the risk, Step 6 – Monitor the
accept the risk to pursue an opportunity, effectiveness of your
remove the risk, or share the risk with implementation
another party (see ISO 31000:2018).
Monitor your agreed implementation
Putting the results of your risk assessment solutions to make sure they are working
into practice will make a difference when as intended, and if not, reassess. Safety
looking after people and your business. performance should be monitored to
Record the results of your risk assessment assure the effectiveness of any risk control.
and share them with your staff. It is This is necessary to verify the integrity,
important to document what you have efficiency and effectiveness of the new risk
done so that you can review it later if controls under operational conditions.
anything changes. This is important not Be open to feedback from staff if a control
only for your internal risk management is not working, and honest in your own
processes, but also in case you ever need assessments of the effectiveness of new
to provide information to CASA, the ATSB controls once they have been implemented.
or other regulators. It is better to roll back a control that is not
managing a risk than to allow it to sit on your
register, so it looks like you did something
when in fact your control is ineffective, and
your risk remains ‘intolerable’.
20 SMS 3Safety risk management

Step 7 – Review your During the year, if there is a significant

change, don’t wait. Check your risk
assessment and update assessment and, where necessary,
if necessary amend it. If possible, think about the risk
assessment when you are planning the
Few workplaces stay the same. Sooner or
change – that way you can be more flexible
later, you will bring in new equipment and
and proactive.
procedures that could lead to new hazards.
It makes sense, therefore, to review what For example, for our loading risk scenario,
you are doing regularly. As a minimum, the documented monitoring process
once a year, you should review where you could include:
are to make sure you are still improving, • internal audit conducted every six months
or at least not sliding back. While initially on aircraft loading procedures
reviewing your risk assessment once a year
• date for an independent annual audit
may be appropriate, this timeline could
noted in diary
be pushed out further using a risk-based
approach (e.g. every 18–24 months), or • staff to be reminded formally at least
more frequent when there are significant twice in scheduled monthly safety
changes within your organisation or several briefings about the safety reporting
smaller changes happening over a period. process in place to report aircraft
loading issues
Aviation is a complex, constantly changing
• training records reviewed every six months
operating environment, so you also need
to ensure all mandatory baggage handling
to consider any other external factors
and loading training is current
that have changed in your operating
environment that can impact your risks, • results of reports communicated to staff
such as a change in ownership of one through company education program.
of your third-party providers, or new
taxiway procedures at an aerodrome you
operate into.
Review your risk assessment. Have there
been any changes? Are there improvements
you still need to make? Have your workers Set a review date for
spotted a problem? Have you learnt anything all risk assessments.
from accidents or near misses? Make sure
your risk assessment stays up to date. This may be an
When you are running a business, it is all elapsed period after
too easy to forget about reviewing your risk implementation, or
assessment until something goes wrong,
and it is too late. Your risk assessments
maybe a trigger date
cannot be a set and forget process – based on another
nothing in our industry remains unchanged, event, possibly even a
so don’t let yourself be lulled into a false
sense of security over your safety risks. seasonal change or type
of operation required to
test the effectiveness.
 SMS 3Safety risk management 21

Documentation Risk management checklist

F The organisation has a formal
All safety risk management outputs
safety risk management process
should be documented. This should
used to:
include the hazard and associated risks,
the safety risk assessment and any safety – identify hazards associated with
risk control actions taken. These are often the organisation’s operations
captured in a register so they can be – analyse and assess the risks
tracked and monitored. associated with those hazards
These risk management documents – implement controls to prevent
become an historical source of future accidents, incidents or
organisational safety knowledge, which occurrences.
can be used as a reference when making F This safety risk management
safety decisions and for safety information process meets the following risk
exchange. This safety knowledge provides management requirements to:
material for safety trend analysis and
– communicate and consult
safety training and communication. It is
also useful for internal audits to assess – establish the context
whether safety risk controls and actions – identify risks
have been implemented and are effective. – analyse risks
– evaluate risks
– treat/mitigate risks
– monitor and review.
F There is a formal record of each
stage of the risk management
process, including assumptions,
methods, data sources, analysis,
results and reasons for decisions.
22 SMS 3Safety risk management

Human factors ALARP and SFAIRP

related risks Where risk is concerned, there is no such
thing as absolute safety. Risk management
Consideration of human factors has is often based on the concepts of ALARP
particular importance in safety risk or SFAIRP.
management as people can be both a
There is wide acceptance that not all risk can
source and solution to safety risks through:
be eliminated. There are practical limits to
• contributing to an incident or accident how far the industry and the community will
through variable performance due to go in paying to reduce adverse risks. Both
human limitations ALARP and SFAIRP principles are designed
• anticipating and taking appropriate to assist in determining whether all relevant,
actions to avoid hazardous situations reasonably practical measures have been
• solving problems, making decisions and taken to manage risks accordingly. However,
taking actions to mitigate risks. be aware, even if your risk is showing in the
acceptable category, the so-called green
Assessing risks associated with human or low risk level, this still may not mean all
performance is more complex than risk reasonably practical measures have been
factors associated with technology or taken. Under ALARP and SFAIRP, you do
environment. This is because: not just stop at broadly acceptable if there
• human performance is highly variable, are still reasonable practical mitigation
with a wide range of interacting measures available.
influences, internal and external to the
When considering reasonably practicable,
individual. Many of the effects of the
you should be assessing what should and
interaction between these influences are
can be done unless it is reasonable in the
difficult or impossible to predict
circumstances to do something less. This
• the consequences of variable human approach is consistent with the aim of
performance will differ according to the providing the highest level of safety that
task being performed and the context. is reasonably practicable. The greater the
This complicates how risk severity and degree of harm that could result from the
probability are assessed. It is therefore hazard or risk, the more significant this
important to involve people with factor will be when weighing up all matters
appropriate human factors expertise or to be considered and identifying what is
experience in the identification, assessment reasonably practicable.
and mitigation of risks. In practical terms, this means, when
See Booklet 6: Human factors and human dealing with future uncertainty within risk
performance for more information on how assessments, you should not just ask ‘Is
human factors can influence safety. the problem bad enough that we need to
do something?’, and instead say ‘Here is a
good control to mitigate a critical safety risk.
Why wouldn’t we do it?’ This shift presents
a positive, outcome-driven approach,
always testing for anything else that can be
done rather than trusting an unrepeatable
subjective estimation of rarity for why
you wouldn’t.
 SMS 3Safety risk management 23
SMS 3Safety risk management 23

Principles and cost-benefit 2. Tolerable risks are those that people are
Principles and cost-benefit Tolerableprepared
2. generally risks are those that people
to tolerate to secure are
analysis generally prepared to tolerate to secure
analysis their benefits. Tolerable risks must be
their benefits. Tolerable risks musttobe
• All efforts should be made to reduce risks properly assessed and controlled
• to
All the
efforts should
lowest levelbe made to
possible reduce
until risks
a point is properly assessed and controlled to
keep the residual risk ALARP or SFAIRP,
reached at which the cost of introducingis
to the lowest level possible until a point keep the residual risk ALARP
and must be reviewed periodically to or SFAIRP,
reachedsafety
further at which the costsignificantly
measures of introducing and must beremain
reviewed periodically to
ensure they that way (e.g. the
further safety measures
outweighs the safety benefit. significantly ensure they remain that way (e.g. the
potential risk of pedestrians walking
outweighs the safety benefit. potential the
riskterminal
of pedestrians walking
• A risk should be tolerated only if it can be between and the aircraft
• demonstrated
A risk should be tolerated between the terminal and the aircraft
that there isonly if it benefit
a clear can be being struck by a moving vehicle is only
demonstrated that there is a clear benefit being struck by a moving vehicle
tolerated if appropriate barricading, is only
in doing so (e.g. there is a compelling
in doing so (e.g. tolerated if appropriate barricading,
operational needthere
in the is organisation).
a compelling security escort and lighting are in place).
operational need in the organisation). security escort and lighting are in place).
ALARP and SFAIRP principles generally 3. Broadly acceptable risks are
ALARP Broadly acceptable
3. considered risks
loware
identifyand SFAIRP
three principles
categories generally
of risk: sufficiently and well
identify three categories of risk: controlled. Further risk low
considered sufficiently and well
reduction is
1. Unacceptable risks are classified controlled. Further risk reduction is
Unacceptable
1. as required only if reasonably practicable
unacceptablerisks are classified
regardless of the required only if reasonably practicable
measures are available. Broadly
benefits associated with theof
as unacceptable regardless the An
activity. measures are available. Broadly
acceptable risks are those that people
unacceptable risk must be eliminatedAn
benefits associated with the activity.
acceptable risks are those that
unacceptable would regard as insignificant orpeople
trivial
or reduced so risk
thatmust beinto
it falls eliminated
one of the would regard as insignificant or trivial
in their daily lives, or which exist, but
other two categories, or there one
or reduced so that it falls into must ofbe
the
in their
other two categories, or there must be have nodaily lives, ormitigator
practicable which exist,([Link]
most
exceptional reasons for the activity or have no practicable
exceptional reasons for the activity or organisations acceptmitigator
that staff(e.g.
could most
be
practice to continue. organisations accept that staff could be
practice to continue. injured on their way to work, but have
injured on their way to work,
little control over what happens on but have
little control
public roads).over what happens on
public roads).
ALARP and SFAIRP categories of risk acceptability

Unacceptable Risk cannot be justified unless in

region extraordinary circumstances

Risk is tolerable only if:

• Further risk reduction is
impracticable or if its cost is
Tolerable
grossly disproportionate to the
region
improvement gained,
• Society desires the benefit of the
Increasing individual risks

activity, given the associated risk

and societal concerns

Broadly Level of residual risk regarded as

acceptable negligible and further measures to
region reduce risk not usually required.
No need for detailed working to
demonstrate ALARP

Negligible risk
24 SMS 3Safety risk management

To determine whether a risk is tolerable, ALARP and SFAIRP

you need to consider several criteria:
application
• Legal requirements: aviation
organisations must comply with 1. Identification of hazard and risk
applicable CASA, WHS and other relevant
state-based legislation. A control based A small, certified aerodrome operator,
on a legal requirement must always be located in outback Australia, identifies a
considered ‘reasonably practicable’. safety hazard – wildlife wandering on to
the runway, and potentially colliding with
• Expert judgement: a proposed control
aircraft.
should be considered reasonably
practicable if an appropriate group of Hazard = wildlife on runway, specifically
experts has established it has a clear wallabies, feral camels and donkeys.
safety benefit, and the costs associated
Risk = aircraft striking wildlife, resulting in
with its introduction are considered
aircraft damage and passenger injuries.
reasonable.
• Cost-benefit analysis: where expert Aircraft operations during taxiing, take-off
judgement or contemporary good and landing are exposed to this risk. The root
practice does not provide clear evidence causes or contributing factors are inconsistent
that a specific control or group of wildlife management, seasonal conditions
controls are reasonably practicable, a and the absence of a perimeter fence.
cost-benefit analysis may be necessary.
2. Evaluate the risks and decide
This establishes whether the cost of
implementing a specific control is grossly on precautions
disproportionate to its safety benefit. Discussions with aircraft operators and
• Industry good practice: if the proposed other stakeholders using the aerodrome
control represents current, relevant, reveal no identified incidents involving
established good practice, that is wildlife have resulted in a collision.
sufficient evidence to conclude that it is However, over the last six months, there
reasonably practicable. For example, it: have been five near-miss reports, two
– complies with aviation industry of which involved minor evasive action
standards, rules or procedures (braking by the pilot in command) to avoid
collision. The risk is assessed as ‘moderate’,
– is a practice of other operators that
based on a combination of ‘minor’
are similar in scale and operation to
consequence and ‘possible’ likelihood.
your own
– is established and widely implemented The aerodrome operator decides that
in another industry sector two controls could manage the risk: an
improved wildlife management program,
– matches other countries’ legislated
including possible seasonal eradication
enforcement of the practice
of animals; and constructing an airfield
– is proven to have demonstrably perimeter fence to prevent wildlife access.
improved safety or can be implemented
without significant modification or cost. The airport operator decides the airport
perimeter fence is the most effective control
of the two available and applies ALARP and
SFAIRP to determine if this is justifiable.
They consider the following to determine
whether the risks are tolerable.
 SMS 3Safety risk management 25

Legal requirements: this is a certified 3. Record your findings and

aerodrome under CASR Part 139, with only implement them
one weekly scheduled passenger service
and a variety of non-scheduled passenger The aerodrome operator decides that a
private charter services and general aviation perimeter fence is not justified, based on
operations. Therefore, there is no explicit its cost to build, that such a fence is not
aviation regulatory requirement for a consistent with industry practice, and that
perimeter fence. there is a limited risk of wildlife on the
runway colliding with an aircraft. However,
Expert judgement: stakeholders consulted to ensure that the risks are ‘acceptable’
about the possible construction of a fence based on ALARP and SFAIRP principles, they
agree that it is an effective control, but the decide to improve wildlife management
fence must be maintained and inspected through a more targeted seasonal wildlife
regularly. management program – keeping the grass
Cost-benefit analysis: the cost of the down to minimise food supplies and regular
perimeter fence construction and ongoing sweeps of the runway to deter wildlife.
maintenance program is determined to
be beyond the funds of the aerodrome 4. Review your assessment and
operator, and local government is unable update if necessary
to assist with finances. The small number of They review the wildlife management
incidents therefore suggests that the cost is program annually, with aerodrome users
not justifiable. reminded to report wildlife activity on or
Industry practice: a quick survey of similar- near the aerodrome.
sized registered aerodromes suggests that They also contact CASA for resources
not all have perimeter fences, and some to assist in wildlife identification and
are only partially fenced. While perimeter management and develop a wildlife
fencing is recommended, industry practice hazard management plan.
suggests that this is not consistent.

Image: Adobe stock | Jacob Lund

26 SMS 3Safety risk management

Outcomes‑based trended and analysed to assess whether

they identify any unmitigated hazards

and PSOE demonstrates an active risk management

process, which can be evaluated to

considerations determine the effectiveness of safety risk

management procedures.
To move from compliance-based safety risk The overall outcomes-based approach
management to become outcomes-based, strives for key personnel through the
organisations cannot simply document the organisation to be aware and understand
elements of this component. Instead, you risks relative to their responsibilities and are
need to consider how your documented continuously seeking out new hazards and
elements will actually be displayed, risks, while also re-evaluating existing risks
monitored and evidenced as being a lived and controls.
safety management process.
As your SMS moves from implementation,
For example, having a safety reporting to operational and through to maturing, the
system in place for hazard identification is Present, Suitable, Operating and Effective
compliance-based, but ensuring that staff (PSOE) evaluation of your safety risk
are appropriately trained in what to report management should also naturally shift,
and how, providing feedback to reporters as shown in the examples below.
on their reports, and ensuring reports are

Image: Adobe Stock | Trueffelpix

 SMS 3Safety risk management 27

Safety risk management

Evaluation

Implementing Present Suitable Operating Effective

Safety risk There is a Multiple sources Hazard and The organisation

management process that of hazards are risk registers is continuously
processes have defines how considered and are being built identifying
been outlined hazards are reviewed, as up and risks hazards and
but are not yet identified appropriate. are starting to understands
fully developed. through reactive be managed its biggest risks
Severity and
and proactive in a proactive and is actively
likelihood
methods. manner. managing
criteria are
them, with
There is a clearly defined Risk analysis and
proactive safety
process for the and fit the assessments
management.
analysis and organisation’s are carried out
assessment of actual in a consistent Risk controls
safety risks. circumstances. manner based are practical
on the defined and sustainable,
The level of risk Risk matrix and
process. applied in a
the organisation acceptability
timely manner,
is willing to criteria are Human and
and do not
accept is clearly defined organisational
create additional
defined. and usable. factors related
risks.
to hazards are
Responsibilities
being identified. Risk controls
and timelines
take human
for accepting the
factors into
risk are clearly
consideration.
defined.

See Booklet 8: SMS Resource Kit for the SMS evaluation tool to assist with evaluating this
element of your SMS using PSOE.
28 SMS 3Safety risk management

Toolkit Image: Civil Aviation Safety Authority

Booklet 3: Toolkit purpose and use

safety risk
Contained within the following toolkit are
examples of ways an organisation can

management develop certain elements within the safety

risk management component of an SMS.

tools These are examples only to assist in building

overall SMS knowledge, being compiled
from various sources, and are in no way a
This toolkit contains the following: CASA recommendation regarding templates
F Toolkit purpose and use or standards to meet regulatory compliance.

F Error prevention strategies for

organisations
F Bowtie model
F Hierarchy of controls
F Risk register example
F Case study: Outback Maintenance’s
hazard and risk identification
F Involving staff in safety risk
management
F Case study: Bush Aviation’s Hazard
report form
F Fatigue risk management system
 SMS 3Safety risk management 29

Error prevention strategies program allowing multiple opportunities

to detect a fatigue crack before it reaches
for organisations critical length.
Three strategies aimed at error prevention,
which is a form of risk mitigation, are Guidance on error prevention
briefly outlined below. These strategies and risk mitigation issues to be
are relevant to flight operations, air traffic considered by organisations
control or aircraft maintenance.
ICAO advocates some fundamental
Error reduction strategies are intended strategies aimed at error prevention, which
to intervene directly at the source of the is a form of risk mitigation. These include:
error itself by reducing or eliminating
• an open and transparent error-reporting
the contributing factors to it. They seek
program, not one focusing on culpability
improved task reliability by eliminating any
and blame
adverse conditions leading to an increased
• human factors training provided with the
risk of error. Error reduction is the most
specific application of error identification,
frequently used strategy.
capture, and management
• Examples of error reduction strategies
• non-jeopardy-based observational
include improving the access to a part
auditing programs that examine the
for maintenance, improving the lighting
threat and error management skills of
in which the task is to be performed and
safety-critical workers
providing better training.
• the organisation advocating strict
Error capturing assumes the error has
adherence to standard operating
already been made. The intent is to ‘capture’
procedures and standard communication
the error before any adverse consequences
phraseology
of the error can be felt. Error capturing does
• equipment design being human-centred
not directly reduce or eliminate the error.
• systems to continually learn the lessons
• Error capturing strategies include
of previous occurrences
post‑task inspection, verification or
testing (e.g. crosschecking a checklist). • consideration given to using automation
However, a possible drawback to this where possible, particularly for routine
error prevention strategy is that people and monotonous tasks relying heavily on
may be less vigilant when they know operator vigilance.
there is an extra defence in place to The importance of reporting hazards and
capture their errors. having a systematic and effective process
Error tolerance refers to the ability of a for reporting them cannot be over stressed.
system to accept an error without serious This must be supported by management
consequence. For example, as a strategy commitment and responsibility, the culture
to prevent the loss of both engines on an of the organisation, which must encourage
aircraft involved in extended twin-engine employees to report errors and to identify,
operations, some regulatory authorities report and monitor hazards.
prohibit the same maintenance task being
performed on both engines prior to a flight.
• Examples of measures to increase
error tolerance are the incorporation of
multiple hydraulic or electrical systems
on the aircraft, and a structural inspection
30 SMS 3Safety risk management

Bowtie model
The bowtie model consists of different elements that build up a safety risk picture. Bowtie
is one of many barrier risk models available to assist the identification and management of
risk. Bowtie is a visual tool which effectively depicts risk providing an opportunity to identify
and assess the key safety barriers either in place or the ones lacking, between a safety
event and an unsafe outcome.
Organisations can elect to use the bowtie model as part of their hazard and risk
identification processes within their SMS. However, it is only one of several useful methods
in this process and is not essential for safety risk management – like all methods or model’s
available operators need to identify which work best for their operation when considering
size, complexity, and activities.

The bowtie safety risk picture revolves around the hazard (something in, around or part of
an organisation or activity which has the potential to cause damage or harm) and the top
event (the release or loss of control over a hazard known as the undesired system state).
Consideration is then turned to the threats (a possible direct cause for the top event),
consequences (results of the top event directly ending in loss or damage) and the controls
(any measure taken which acts against some undesirable force or intention).
The controls can be populated on either side of the model showing:

Left hand side of the model Right hand side of the model

Preventative measures which eliminate the Measures which reduce the likelihood of
threat entirely or prevent the threat from the consequence owing to the top event
causing the top event recovery. being "live" or mitigate the severity of the
consequence
 SMS 3Safety risk management 31

The bowtie model explores the escalation Experience has shown that the most
factors (the reasoning to why a control may effective format for building the bowtie
be defeated or less effective) of all controls is within a facilitated workshop, involving
allowing the allocation of escalation factor all relevant parties who can contribute
controls. These prevent the escalation to managing the risk. As with any risk
factors having an impact on the prevention assessment it is essential to have input
or recovery controls. Further attributes, from the relevant subject matter experts
such as control effectiveness or criticality (SMEs) to identify the important issues
can be allocated to the bowtie model to and produce an assessment that is a
evaluate the safety risk picture as part of an realistic representation. Not only that but
effective SMS. involving various stakeholders provides a
more comprehensive risk picture, creates
In the bowtie, controls change the likelihood
understanding of roles between different
or consequence of a risk, but escalation
stakeholders in mitigating a shared risk, and
factors are conditions that can vary the
assisting in identifying any potential transfer
effectiveness of likelihood or consequence
of risk between different stakeholders.
controls. Escalation factors might include
fatigue impairment, technical competency, The UK Civil Aviation Authority has
the environment, human error, etc. developed a bowtie document library
against the significant seven, being the
Some benefits of using bowtie include:
seven top safety risks identified by the
• full range of initiating causes can be CAA. In total, three bowties for each of
shown the significant seven were identified with
• existing controls are depicted a core bowtie selected and developed
• causal pathway in which these combine for each topic to address the highest risk
and escalate can be shown scenarios. They include all the basic bowtie
components plus additional classifications
• consequence management (right) side
and ratings for the various diagram
shows post-event controls
elements to maximise their potential. For
• multiple possible consequence outcomes example, the expert judgement of SMEs
can be depicted was an important component for decisions
• causal pathway effects of controls are related to the control effectiveness ratings.
made explicit These can be found at: [Link]
[Link]/safety-initiatives-and-resources/
working-with-industry/bowtie/bowtie-
templates/bowtie-document-library/
30
32 SMS 3Safety risk management

Hierarchy of controls
Selecting the most appropriate risk treatment option or control involves balancing potential
benefits derived in relation to the achievement of safety outcomes against efforts and
disadvantages of implementation. This directly links back to ALARP and SFAIRP philosophy
for risk management.
Risk treatment options are not necessarily mutually exclusive or appropriate in all
circumstances. When determining appropriate controls, the hierarchy of controls
pyramid can assist in decision-making.

Most
effective Physically remove
Elimination
the hazard

Substitution Replace the hazard

Isolate people from

Engineering Controls
the hazard

Administrative Check the way

Controls people work

PPE Protect the worker with Personal

Least Protective Equipment
effective
 SMS 3Safety risk management 33

Control Details

Elimination Eliminating the hazard and the risk it creates is the most effective
control measure. The best way to eliminate a hazard is to not
introduce the hazard in the first place. For example, you can eliminate
the risk of a fall from height by doing the work at ground level.
It may not be possible to eliminate a hazard if doing so means you
are unable to deliver your service. If it is not possible to eliminate the
hazard, then you can still attempt to eliminate as many of the risks
associated with the hazard as possible.

Substitution Substitution is the process of removing a risk by replacing it with

or isolation another risk that is either less likely to occur or less severe in its
potential damages. Isolation is performed by placing some form of
barrier between the person and the risk factor to provide protection.
It’s important to conduct a new risk assessment after substitution or
isolation has been completed to identify any new risks created by the
substitute/isolate process.

Engineering Reduce the risks through engineering changes or changes to

systems of work. Engineering controls is the process of designing
and installing additional safety features in the workplace or on
equipment.
System redundancy features within aircraft design is an example of
engineering risk controls enacted at the aircraft manufacturing stage.

Administrative Use administrative actions to minimise exposure to hazards and

reduce potential level of harm. Administrative controls are work
methods or procedures designed to minimise exposure to a hazard.
In most cases, administrative controls use systems of work to control
the risk.
Measures could include developing standard operating procedures,
providing dedicated training targeted at the risk or using signs to
warn people, such as minimum equipment list or unserviceable tags.

Personal Use PPE to protect people from harm. This level is designed around
protective assuming an incident will occur and protecting an employee from
equipment harm when it does.
(PPE)
PPE includes items such as hard-hats, hi-vis clothing, noise-reducing
ear protection or cut-resistant gloves.

While implementing and using administrative controls and PPE are often the simplest and
most cost-effective means, they do not control the hazard at the source. They also rely
on human behaviour and supervision and, used on their own, tend to be least effective in
minimising risks.
34 SMS 3Safety risk management

Use administrative controls and PPE only: followed, and PPE may not always be
• as last resorts when there are no other worn. Further controls, such as signs or
practical control measures available supervision, may be needed to make a
control more likely to be effective or to raise
• as an interim measure until introducing a
awareness of the control in the first place.
more effective way of controlling the risk
• to increase the effectiveness of higher However, be aware that using a hierarchy
level control measures. of control response and ALARP or SFAIRP
can result in hazard controls sinking to
When considering each control or the bottom and resulting in ineffective
combination of controls, you must consider risk mitigation.
the likelihood of a particular control being
effective. Isolation guards designed to Some examples of hazard sinking
reduce aircraft/ground equipment collision mentality that undermines safety culture
may be removed, standard operation and risk management are shown in the
procedures may not be understood and following figure.

The hierarchy of responses – How hazards sink to the bottom

1 Eliminate the Hazard

“That’s far too expensive. Tell Ops they’ll have to manage this”
“You know this one is one of the most profitable lines...”

2 Substitute the Hazard

“No, changing the process will be really difficult”
“Have our competitors done this?”

3 Isolate the Hazard

“Not really practical. Put a sign on it and tell them to be careful”
“We may replace this process in the refurb in 3-years. Let’s wait”

4 Use engineering controls

“No we can’t change the tooling as it’s approved. Not viable for us”
“Have you got a budget for this?”

5 Use Administration Control

“We’re really busy right now. Can we do the training next year?”
“Do we really need a procedure for this. It’s common sense...”

6 Use Personal Protective Equipment

“What do you mean the equipment is uncommittable”
“Sorry, that’s the job. You’re going to have to deal with it!”
 SMS 3Safety risk management 35

Risk register example

[insert name of Risk Register Log number
organisation]
The risk: Existing The consequence of Additional Residual risk Action and Monitoring
• What can controls an event happening mitigation owners and review
required requirements
Report Reference

happen
Date entered in

• How

Level of risk

Level of risk
can this

Likelihood

Likelihood
happen
Number

Severity

Severity
register

Date: xx/xx/xxxx Version: x Form SMS 3

36 SMS 3Safety risk management Case study Case study

Hazard and risk

identification

Hazard Fatigued personnel at shift handover

Risk Fatigued staff resulting in inadequate shift handover leading to missed procedures
and maintenance errors

Current
controls/ Control Further controls/
mitigations effectiveness Reason defences required Responsibility

Shift Low In a manual in Half-hour overlap Cheryl Lawson

handover Peter’s office – between shifts to allow
procedures nobody reads for proper briefing,
them and for log to be fully
completed

Shift Low Not in central To be transferred Cheryl Lawson

handover log enough place – to hangar PC, and
goes missing completed online

Regular Low Not held Schedule regular Mick Slater

staff safety consistently fortnightly toolbox
(safety officer)
meetings enough meetings.

Rostering Low Not enough staff With planned growth, Peter Lawson
to cover the take on new staff
required shifts

Recording Low Ad hoc system Hazard & risk register Mick Slater &
– is only done on hangar PC. Everyone Cheryl Lawson
sometimes gives and receives
feedback
 SMS 3Safety risk management 37

Involving staff in safety After completing these steps, you

should have:
risk management
• a list of safety hazards and risks
To avoid accidents and incidents, any identified by employees, ranked in
organisation should have multiple layers order of importance
of controls or defences. However, controls
• a list of current controls and defences
are never foolproof. For example, having
in place to manage these risks
well-trained maintenance engineers does
not ensure that aircraft components are • a list of further controls and defences
always fitted correctly. Standard operating required to improve safety across
procedures for flight crew are only as the operation
effective as those who follow them. Air • staff involvement in identifying safety
transport operators and maintenance deficiencies and priority areas for
organisations should regularly identify what improved risk management.
defences they have to contain recognised
safety hazards as an early warning
safety system.
To achieve this, 7 simple steps are
suggested for involving staff in the process:
1. Communicate and consult
2. Identify safety hazards across your
operations that could harm people,
equipment, property or the environment,
and the resulting safety risks
3. Rank the severity and likelihood of
these risks
4. Identify the current defences and
controls in place to manage them
5. Evaluate the effectiveness of each
defence and control
6. Identify additional defences and
controls where required
7. Record all this information in a
hazard or risk register
38 SMS 3Safety risk management Case study Case study

Hazard report form

Reported by:
Name: _______________________________ Position: _______________________________
Subject:
[ ] Workplace hazard [ ] Hazardous work practice
[ ] Public hazard [ ] Aviation safety hazard
Description of hazard and any action taken:
__________________________________________________________________________________________
__________________________________________________________________________________________
__________________________________________________________________________________________
Is further action required? Yes [ ] No [ ]
Reported to: _______________________________
Aviation safety officer: _______________________________
Safety committee/rep: Yes [ ] No [ ]
Reporting person’s name: _______________________________
Signature: _______________________________
Date: _____ /_____ /_____

Supervisor use only

Date report received: _____ /_____ /_____
Action taken or recommended:
__________________________________________________________________________________________
__________________________________________________________________________________________
Date implemented: _____ /_____ /_____
Name: _______________________________
Signature: _______________________________
 SMS 3Safety risk management 39

Fatigue risk management system

Fatigue risk management systems (FRMS) are increasingly being adopted by air transport
operators to control the risks of fatigue-related accidents and incidents. An FRMS is simply
an extension of the overall SMS and should leverage off all the elements of your SMS that
are already in place.

SMS component Elements Fatigue management aspects

Safety policy • Safety policy • Fatigue risk management policy

and objectives • Management • Management and employee fatigue
responsibilities and responsibilities
accountabilities • Key fatigue roles and accountabilities
• Key personnel • Fatigue safety committee
• Safety committee

Safety risk • Hazard and risk • Specific fatigue hazard identification

management identification processes: proactive, predictive, and
• Risk assessment and reactive
mitigation • Specific fatigue mitigations/controls:
strategic and tactical
• Monitoring fatigue control
effectiveness
• Fatigue risk assessment procedures
• Fatigue risk registers

Assurance • Monitoring and • Fatigue safety performance indicators

measuring performance • Fatigue management audits and
• Safety investigations reviews
• Data analysis and • Fatigue assessments in safety
information investigations
• Management review
and improvement

Training and • Training and education • Training in fatigue science and

promotion programs fatigue risk management for involved
• Communication and personnel
consultation • Fatigue specific communication
strategies.

As fatigue is a safety hazard in all aviation operations, regardless of whether you are
developing an FRMS, your SMS still needs to manage the risk of fatigue within your
operation, like any safety risk.
For further information regarding fatigue management and FRMS, see the CASA website:
[Link]/operations-safety-and-travel/safety-advice/fatigue-management
40 SMS 3Safety risk management
[Link]