Defining Risk Management

Risk is defined as the probability and possible severity of accident or loss from exposure to various hazards, including injury to people and loss of resources. [Figure 9-1] All Federal Aviation Administration (FAA) operations in the United States involve risk and require decisions that include risk assessment and risk management.

Figure 9-1. Types of risk.

Figure 9-1. Types of risk.

Risk management, a formalized way of thinking about these topics, is the logical process of weighing the potential costs of risks against the possible benefits of allowing those risks to stand uncontrolled. Risk management is a decision-making process designed to identify hazards systematically, assess the degree of risk, and determine the best course of action. Key terms are:

  • Hazard—a present condition, event, object, or circumstance that could lead to or contribute to an unplanned or undesired event, such as an accident. It is a source of danger. For example, a nick in the propeller represents a hazard.
  • Risk—the future impact of a hazard that is not controlled or eliminated. It is the possibility of loss or injury. The level of risk is measured by the number of people or resources affected (exposure); the extent of possible loss (severity); and likelihood of loss (probability).
  • Safety—freedom from those conditions that can cause death, injury, occupational illness, or damage to or loss of equipment or property, or damage to the environment. Note that absolute safety is not possible because complete freedom from all hazardous conditions is not possible. Therefore, safety is a relative term that implies a level of risk that is both perceived and accepted.

Principles of Risk Management

Accept No Unnecessary Risk

Unnecessary risk is that which carries no commensurate return in terms of benefits or opportunities. Everything involves risk. The most logical choices for accomplishing an operation are those that meet all requirements with the minimum acceptable risk. The corollary to this axiom is “accept necessary risk” required to complete the operation or task successfully. Flying is impossible without risk, but unnecessary risk comes without a corresponding return. If flying a new airplane for the first time, a CFI might determine that the risk of making that flight in low instrument flight rules (IFR) conditions is unnecessary.

Make Risk Decisions at the Appropriate Level

Anyone can make a risk decision. However, the appropriate decision-maker is the person who can develop and implement risk controls. The decision-maker must be authorized to accept levels of risk typical of the planned operation. In a single-pilot situation, the pilot makes the decision to accept certain levels of risk. In the maintenance facility, an aviation maintenance technician (AMT) may need to elevate decisions to the next level in the chain of management upon determining that those controls available to him or her will not reduce residual risk to an acceptable level.

Accept Risk When Benefits Outweigh the Costs

All identified benefits should be compared against all identified costs. Even high-risk endeavors may be undertaken when there is clear knowledge that the sum of the benefits exceeds the sum of the costs. For example, in any flying activity, it is necessary to accept some degree of risk. A day with good weather, for example, is a much better time to fly an unfamiliar airplane for the first time than a day with low instrument flight rules (IFR) conditions.

Integrate Risk Management Into Planning at All Levels

Risks are more easily assessed and managed in the planning stages of an operation. The later changes are made in the process of planning and executing an operation, the more expensive and time consuming they become. Because risk is an unavoidable part of every flight, safety requires the use of appropriate and effective risk management not just in the preflight planning stage, but in all stages of the flight.


Risk Management Process

Risk management is a simple process which identifies operational hazards and takes reasonable measures to reduce risk to personnel, equipment, and the mission.

Step 1: Identify the Hazard

A hazard is defined as any real or potential condition that can cause degradation, injury, illness, death, or damage to or loss of equipment or property. Experience, common sense, and specific analytical tools help identify risks.

Step 2: Assess the Risk

The assessment step is the application of quantitative and qualitative measures to determine the level of risk associated with specific hazards. This process defines the probability and severity of an accident that could result from the hazards based upon the exposure of humans or assets to the hazards.

Step 3: Analyze Risk Control Measures

Investigate specific strategies and tools that reduce, mitigate, or eliminate the risk. All risks have two components:

  1. Probability of occurrence
  2. Severity of the hazard

Effective control measures reduce or eliminate at least one of these. The analysis must take into account the overall costs and benefits of remedial actions, providing alternative choices if possible.

Step 4: Make Control Decisions

Identify the appropriate decision-maker. That decision-maker must choose the best control or combination of controls, based on the analysis of steps 1 and 2.

Step 5: Implement Risk Controls

A plan for applying the selected controls must be formulated, the time, materials, and personnel needed to put these measures in place must be provided.

Step 6: Supervise and Review

Once controls are in place, the process must be reevaluated periodically to ensure their effectiveness. People at every level must fulfill their respective roles to assure the controls are maintained over time. The risk management process continues throughout the life cycle of the system, mission, or activity.


Implementing the Risk Management Process

To derive maximum benefit from this powerful tool, it must be used properly. The following principles are essential.

  • Apply the steps in sequence—each step is a building block for the next, and must be completed before proceeding to the next. If a hazard identification step is interrupted to focus on the control of a particular hazard, more important hazards may be overlooked. Until all hazards are identified, the remainder of the process is not effective.
  • Maintain a balance in the process—all steps are important. Allocate the time and resources to perform all.
  • Apply the process in a cycle—the “supervise and review” step should include a brand new look at the operation being analyzed to see whether new hazards can be identified.
  • Involve people in the process—ensure that risk controls are mission supportive, and the people who must do the work see them as positive actions. The people who are actually exposed to risks usually know best what works and what does not.