In the beginning of the Safety Management System (SMS) implementation, all Safety Risk
Assessments (SRA) have been performed almost exclusively by the members of the Safety Office
Even though we were very soon aware of the shortcomings of such approach (lack of specific domain
knowledge, no executive power to perform changes, ...) we couldn’t make any changes, because in
that time safety was considered to be only Safety Office concern.
Several years ago everything changed when we performed immense revision of our traditional Hazard
Register. Instead of hundreds of “hazards” (actually a confusion mix of hazards, threats and
consequences) all of them assigned to the Safety Office team members, we identified less than a
hundred hazards (conditions, objects or activities) that were part of our normal business processes.
According to the Air Operator’s Certificate (AOC) main responsibilities, we have distributed all hazards
among five managers with executive power: Accountable Manager and four Nominated Persons;
namely NP Flight Operations, NP Ground Operations, NP Crew Training, NP Continuing
Following these changes, the responsibilities for managing hazards and related risks have been
transferred to appropriate hazard owners. All operational managers have been trained to obtain
required skills for performing risk assessment and to submit it to the related hazard owner for
approval. For particular risks where a single person was not capable of performing adequate SRA
alone, a dedicated group of people having required knowledge, experience and skills were involved to
perform risk assessment as a team.
TEAM MEMBERS (ROLES)
Hazard owner is responsible for managing related safety risks in a proactive way. For complex risks
(e.g. for new destinations as described in my previous blog), new aircraft type in the fleet,
communicable diseases (e.g. Ebola), … ) he may decide to form a team of competent people to
perform risk assessment together and team moderator.
Depending on the company size and organization, moderators might be from the Safety Office team or
from operational organizational units under the responsibility of nominated persons.
Hazard Owner may decide to be one of the team members or to attend only the presentation of SRA
results at the end of the process. In any case, the hazard owner's primary responsibilities are to initiate
the process and final approval of safety risk assessment results
Moderator usually helps Hazard Owner in selecting Team members, planning team dynamics and
establishing appropriate process methods.
Moderator’s primary responsibility is to manage Team session(s) and related SRA. He/she needs to
have basic knowledge and understanding of risk related subjects, but not need to be an expert. Team
managing skills (incl. communication, time management, … ), workshop experiences and ability to
consistently keep SRA records are needed as he/she shall bring a methodology knowledge and
regulatory requirements to SRA.
Every team member is responsible to participate in team work with his/her expert knowledge and
experience. Usually team members are selected out from middle and lower operations managers,
special function holders and specialists. Team shall bring a domain knowledge needed for particular
SRA. All members together should hold all knowledge which might be possibly needed for that
The first session should start with discussion about the identified risk which the group has received for
SRA as a task. It is important that all present team members have a common understanding about the
identified risk before SRA actually starts. In general, SRA can be divided into 5 phases:
Phase 1 – Threats & Potential Outcomes:
Which threats may lead us to the point where we no
longer have adequate control over the hazard is usually a starting question. What are potential
outcomes/consequences of our Risk? (If more convenient, we can do it in the opposite way, first
identifying consequences and then looking for the events that may cause such a scenario).
Phase 2 – Existing Safety Controls:
What are existing preventive and recovery safety controls in
place and how effective and reliable they are, are main topics for the second phase.
Phase 3 – Risk Analysis and Evaluation:
For each threat/safety control combination we have to
associate appropriate likelihood of occurrence. The same has to be performed for each combination of
consequence/safety control. According to above identified quality levels of Likelihood and Severity,
risk evaluation/tolerability will be defined using Safety Risk Assessment Matrix (e.g. ICAO 5 x 5
(If risk is found acceptable, phase 4 is not necessary to be performed)
Phase 4 – New Safety Controls:
If evaluated risk is not acceptable (or tolerable), existing safety
controls are not enough. In such a case, team members have to find out how to improve the
effectiveness of existing safety controls or which additional safety controls shall be implemented and
how effective they should be.
Phase 5 – Approval from Hazard Owner:
Phase 3 result (risk tolerability) and Phase 4 result
(proposal for improved or new safety controls) shall be formally presented to the Hazard Owner in
order to get his Approval for SRA of existing situation and/or for proposed improvement/new safety
Many times, as a result of safety investigations or safety data analysis and trend identification,
initiative and potential risk identification may also come from the Safety Manager. However, even in
such cases, the final decision for SRA falls under the responsibility of operational managers (hazard
owners) with executive power. Even in case of company SMS, Accountable Executive/Manager is
responsible for SMS implementation. (Safety Manager is responsible only for day-to-day management
Any means of visualization would help a team to focus on SRA and to have a better view over the
SRA elements and their interactions. Therefore moderators shall be skilled also in the visualization
method used. For efficient team work, it is very convenient if visualization tool drawing is statistically
supported by automatic calculation of risks and recording of applicable SRA element characteristics.
For visualization purposes we were using (in Phases 1,2,4 and 5) wall projecting of live drawing of
Bow-Tie performed by Moderator simultaneously with on-going team discussion, modifying Bow-Tie
until consensus would be reached by the team. In Phases 3 and 5 we were using wall projecting of
ICAO 5 x 5 Safety Risk Assessment Matrix.
On one side group of people seating in SRA team session(s) means more time spent and therefore
higher costs. On the other side it also means higher SRA quality and consequently higher safety
margin(s), resulting in safer operations. Result of related Cost Benefit Analysis and consequential
Yes/No decision for team performed SRA greatly depends on related Hazard Owner safety awareness
Involving more people in SRAs will not only improve the quality of SRAs, but will also improve safety
awareness and attitude of people involved, finally over a longer period resulting in overall better
company Safety Culture.
Aviation Safety and Compliance Consultant