Risk Management

A Closer Look
Jo Gillespie
Inter Aviation
Jo Gillespie
• 30 years and 14,000 hours as a pilot
• Military, general, business and
commercial
• 30+ years in aviation safety & risk
management
• 17 years Emirates Flight Safety
• Accident/incident investigations
• Flight safety programmes
• SMS implementation
• Expert witness
Who are you?
 Session Overview

• Definitions
• Safety Policy, Objectives & SPIs
• Build the Safety Plan
• Hazard ID & Risk Management
• Risk Assessment Tool (RAT)
 Session Overview

• Risk Register
• Event Risk Classification
• Safety Case
• Safety Reporting
• Investigation
 Ground Rules

Timing
Breaks
Participation
Challenges
Objectives
 What is ‘safety’?
In pairs write down a simple definition of safety
in the context of your work – 2 minutes
 ICAO Definition of Safety

ICAO defines safety as:

“the state in which the risk of harm to persons or
of property damage is reduced to, and maintained
at or below, an acceptable level through a
continuing process of hazard identification and
risk management”
 Would everyone share that
definition?

• Regulators?
• Investors/shareholders?
• Fellow employees?
• Insurers?
• Passengers/families?

Probably not…
 ICAO Definition of Safety

Some more definitions:

ICAO defines safety as:

“the state in which the risk of harm to persons or
of property damage is reduced to, and maintained
at or below, an acceptable level through a
continuing process of hazard identification and
risk management”
 Hazard, Risk & Harm
• Harm
– Loss or damage, injury or death
• Hazard
– Anything with potential to cause harm
• Risk
– A measure of the potential for harm
How do we manage safety and risk?
 ‘A systematic approach to managing safety,
including the necessary organizational
structures, accountabilities, policies and
procedures.’
Safety
Management
System

Safety
Safety Policy & Safety Risk
Safety Assurance Promotion &
Objectives Management
Training

22 January 2018 SMS Executive Training 14

 Safety Policy & Objectives
• Management commitment & responsibility
• Safety accountabilities
• Appointment of key safety personnel
• Co-ordination of ERP
• SMS documentation
Safety
Management
System

Safety
Safety Policy & Safety Risk
Safety Assurance Promotion &
Objectives Management
Training
 Safety Policy
What are the desired safety outcomes?
How do we plan to deliver those outcomes?
What are our safety principles and philosophies?
What do we want our culture to look like?
What is acceptable/unacceptable behaviour?
Who is accountable and responsible? Safety
Policy
How will we keep the policy relevant?
Everyon
e must
stay
safe at
all times
 Safety Policy
In groups devise a short safety policy
 Safety Objectives
Why do we have objectives?

Make money and don’t crash…

 Safety Objectives

S.M.A.R.T.
• Specific
• Measurable
• Achievable
• Relevant
• Time-related
 Safety Objectives

Make money and don’t crash

Zero harm to people and property

S.M.A.R.T?
 Safety Objectives
In groups discuss and create 2 safety objectives
that support your policy
 Safety Measurement

Make money and don’t crash

Zero harm to people and property

How could you measure performance?

 Safety Assurance:
Performance Monitoring
• Audit internal/external
• Safety trend monitoring
• Flight data management (FDM)
• Safety Action Groups (SAG)
• Safety Review Board (SRB)
Safety Performance Measurement
In groups discuss and create safety performance
indicators (SPIs) for your objectives
SMS PROGRESS ASSESSMENT
 Safety Performance Targets
What do we mean?
 Safety Performance Targets
In groups discuss and create targets for your
safety performance indicators (SPIs)
 Safety Plan
Safety Policy

Safety Review
Board
Safety Objectives

Safety Action
SPIs Group

Safety Targets
 Safety Risk Management
1. Hazard Identification
2. Risk Assessment & Mitigation

Safety
Management
System

Safety
Safety Policy & Safety Risk
Safety Assurance Promotion &
Objectives Management
Training
 Hazard Identification

What is a HAZARD?

Anything with the potential to cause HARM

22 January 2018 SMS Executive Training 37
22 January 2018 SMS Executive Training 38
Hazard Identification
Are hazards always ‘bad’?
Are hazards always ‘harmful’?
 Hazard Identification
In groups identify hazards and potential harm
from the pictures provided
 Managing Risk
1. Identify the hazards
2. Establish the context
3. Determine what defences are in place
4. In light of this, what is the risk?
5. Is it ALARP?
6. Is it acceptable?
7. Could/should we do more?
8. Do it!
 Proactive
vs
Reactive

‘The Ambulance Down in the Valley’

https://www.youtube.com/watch?v=Y33eh8XJYDU 3:15
Establish the Context
Establish the CONTEXT
Assess the Risk
 Safety Risk Assessment
1. What is risk defined as?
A measure of a hazard’s potential to cause harm
2. What parameters do we use to ‘measure’ risk?
Probability/likelihood and severity of outcome
3. Severity of what?
The worst case feasible outcome
 Safety Risk Assessment
What is the traditional tool for assessing risk?
Probability LOW MEDIUM HIGH

Severity
MEDIUM HIGH EXTREME
HIGH RISK RISK RISK
LOW MEDIUM HIGH
MEDIUM RISK RISK RISK
VERY LOW LOW MEDIUM
LOW RISK RISK RISK

Risk Matrix
 Safety Risk Assessment
In groups draw up your own risk matrix
Airline A
 Safety Risk Evaluation

ACCEPT

MANAGE

AVOID
 Safety Risk Evaluation
Managing residual risk

High Risk • Notification to CEO/Accountable Manager immediately. Activity should be suspended.

• Corporate Risk: SBU CEO can authorise continued activity in special circumstances however the Division is to
be notified.
• Operational Risk: Risk activity can not recommence until mitigating action has been taken and approved by the
SBU CEO or the AOC Accountable Manager.

Medium Risk • Catastrophic or Major Consequence require GM/Accountable Manager Notification

• Insignificant, Minor or Moderate risk Consequences require notification to the responsible Senior
Manager/Director.
• Risk should be mitigated to As Low As Reasonable Practicable (ALARP).
• Tolerable only if further risk reduction is impracticable or if its cost is greatly disproportionate to the improvement.
• Activity may continue providing due consideration has been given to the activity.

Low Risk • Notification to Line Manager/Supervisor Risk is tolerable and activity may continue, providing due consideration
has been given to the activity.
 Risk Mitigation

O
H U
A T
Z EVENT
C
A EVENT O
R M
D E
S S
 Risk Mitigation
1. Effectiveness
• Level One (Engineering actions): The safety action
eliminates the risk;
• Level Two (Control actions): The safety action
accepts the risk but adjusts the system to mitigate
the risk by reducing it to a manageable level; and
• Level Three (Personnel actions): The safety action
taken accepts that the hazard can neither be
eliminated (Level One) nor controlled (Level Two), so
personnel must be taught how to cope with it.
 Risk Mitigation
2. Reasonableness

Cost/benefit - Do the perceived benefits of the mitigation

outweigh the costs? Will the potential gains be
proportional to the impact of the change required?
Practicality - Is it doable in terms of available technology,
financial feasibility, administrative feasibility, governing
legislation and regulations, political will, etc.?
Challenge - Can the risk mitigation withstand critical
scrutiny from all stakeholders (employees, managers,
stockholders/State administrations, etc.)?
 Risk Mitigation
3. Practicality

• Stakeholder Acceptability - How much buy-in (or

resistance) from stakeholders can be expected?
• Enforceability - If new rules (SOPs, regulations,
etc.) are implemented, are they enforceable?
• Durability - Will the measure withstand the test
of time? Will it be of temporary benefit or will it
have long-term utility?
 Risk Mitigation

4. Remaining questions

• Residual risks - After the risk mitigation

measure is implemented, what will be the
residual risks relative to the original hazard? Is
it ALARP and acceptable?
• New problems - What new problems or new
(perhaps worse) risks will be introduced by the
proposed change?
RISK ASSESSMENT TOOL
 Example Risk Assessment Tool
• Designed to address a specific risk category
• Cause of approximately 30% of accidents
– FSF commercial jet data
• Based on extensive research and analysis
• Offers an example of RAT development
 Organisational Factors
• ‘Culture
– The way we do things around here’
• Commercial pressure
• Get the job done
 Airfield Strategic Risk
• Static characteristics
– Relatively easy to identify
• Example of broader risk evaluation
 Day of Operations
• More dynamic and changeable factors
• Requirement for daily application
• Front line staff need authority to act
• Offers mitigation/management strategies
 Tactical Interventions for Pilots
• Decision making/problem solving aid
– Reduce pilot workload under stress
• Could apply equally well to other team members
 Creating a RAT
1. What is the problem?
2. What are the ‘terms of reference’?
3. What do we know in advance?
4. What does history tell us about this issue?
5. What scope do we have to change things?
– Before we start
– When we plan
– When the operation is under way
 RAT – Inadvertent IMC
Create your own RAT for ‘inadvertent flight in
IMC’ – develop 2 questions for each of Tables A-D
Risk Register
 Risk Register
• Takes time and expertise
• Becomes a live record of risk
• Must be maintained
• Reviewed by SAG/SRB
• Documentary evidence of safety process
 Reactive Risk Assessment
• HIRA is essentially proactive
– We seek hazards and mitigate in advance
• What about reactive risk assessment?
– When something has already gone wrong?
• How can likelihood be a parameter?
Event Risk Classification (ERC)
 Case Study
• Poor weather – probably not real VMC
• Rushed approach – unstable
• Late go-around – main gear touched down
• Some wheel damage
• Diversion to point of departure
• Landing OK
• Aircraft not seriously damaged
• No injuries
 ERC Evaluation
Example Risk Evaluation Criteria:
The Safety Case
 The Safety Case
• Objective
– What are we trying to achieve?
• Argument
– How do we propose to achieve it?
• Evidence
– Proof that it can be done
• Conclusion
– Were we successful?
 Safety Case – Case Study
• Airline A’s Ops Manual IFR only
• Charter to VFR destination
• Requirement to amend the Ops Manual
• Developed Safety Case
• Equal or better level of safety
• Body of evidence
• Convinced CAA
• Ops Manual amended
 Fuel for the SMS

FUEL

Safety Management System

Safety
Safety Policy and Safety Risk Safety
Promotion and
Objectives Management Assurance
Training
 Fuel for the SMS

• Safety reports
• Hazard reports
• FDM
• Investigations
• Audits/DCC
• SPIs & targets
• Safety trends
• ….
 Fuel for the SMS:
Reporting
• Management don’t want to know
• Nothing changes
• I’ll get into trouble
• I can’t be bothered
 Reporting
• Reactive
– Occurrence/incident reports
– Something went wrong
– Stop it happening again
• Proactive
– Hazard reports
– Something could go wrong
– Stop it happening…
Accident Investigation
 Why investigate?
• What happened?
• Why and how did it happen?
• What can we do to stop it happening?
Why investigate?

• What happened?
– Outcomes
• Crash, severe damage, injuries, fatalities…
– Sequence of events leading to the outcome
• Step by step sequence of facts
– No opinion or conjecture
Why investigate?
• How/why did it happen?
– Technical failures
– Poor maintenance
– Inadequate procedures
– Meteorological factors
– Organisational pressure
– Operational errors
– Inadequate training
– Substance abuse…
Why investigate?

• How/why did it happen?

– Causes: the things that actually led to the accident
– Contributory factors: things that increased the
probability of the accident
Why investigate?
• What to do to stop it happening again
–Review procedures
–Improve training
–Replace parts/improve systems
Annex 13 to the Convention on
International Civil Aviation (Chicago)

• Applies to all signatory states

• Standards & Recommended Practices for the
conduct of accident investigations
• Provides clear guidance on the determination
of what, how/why and what to do
• Even formats the final report!
• Does it apply to operators?
Annex 13 to the Convention on
International Civil Aviation (Chicago)

Published in separate English, Arabic, Chinese,

French, Russian and Spanish editions by the:

INTERNATIONAL CIVIL AVIATION ORGANIZATION

999 University Street, Montréal, Quebec,
Canada H3C 5H7
Standards & Recommended Practices
(SARPs)
Standard: Any specification for physical characteristics,
configuration, matériel, performance, personnel or procedure,
the uniform application of which is recognized as necessary
for the safety or regularity of international air navigation and to
which Contracting States will conform in accordance with the
Convention;

Recommended Practice: Any specification for physical

characteristics, configuration, matériel, performance, personnel
or procedure, the uniform application of which is recognized as
desirable in the interests of safety, regularity or efficiency of
international air navigation, and to which Contracting States
will endeavour to conform in accordance with the Convention.
What is an Accident?
a) A person is fatally or seriously injured
What is an Accident?
b) aircraft sustains damage or structural
failure which:

• adversely affects the structural strength,

performance or flight characteristics of the
aircraft, and
• would normally require major repair or
replacement of the affected component
What is an Accident?
c) the aircraft is missing or inaccessible
Objective of an Investigation
3.1 The sole objective of the investigation of an
accident or incident shall be the prevention of
accidents and incidents. It is not the purpose of
this activity to apportion blame or liability.

5.4.1 Any investigation conducted in accordance

with the provisions of this Annex shall be
separate from any judicial or administrative
proceedings to apportion blame or liability.
Responsibility:
for Instituting & Conducting the Investigation

5.1 The State of Occurrence shall institute an

investigation into the circumstances of the accident and
be responsible for the conduct of the investigation…

…but it may delegate the whole or any part… to

another State
Participation
in the Investigation

5.18 States of Registry, of the Operator, of Design

and of Manufacture each entitled to appoint an
accredited representative (acc rep) to the
investigation

Accredited representative. Designated by a State to

participate in an investigation – normally from an
accident investigation authority
Participation
in the Investigation

5.24 A State entitled to appoint an acc rep also

entitled to appoint one or more advisers to
assist the acc rep in the investigation

Adviser. Appointed by a State to assist its

accredited representative in an investigation –
typically from the operator
Final Report
Appendix to Annex 13
• Factual Information
– The facts and nothing but the facts
• Analysis
– Of the Factual Information; and nothing else
• Conclusions
– Findings and causes drawn only from the Analysis
• Safety Recommendations
– Based upon the Conclusions
Final Report
Factual Information
1.1 History of the Flight 1.11 Flight Recorders
1.2 Injuries to Persons 1.12 Wreckage & Impact
1.3 Damage to the Aircraft 1.13 Medical & Pathological
1.4 Other Damage 1.14 Fire
1.5 Personnel Information 1.15 Survival
1.6 Aircraft Information 1.16 Tests & Research
1.7 Meteorological 1.17 Organisational &
1.8 Aids to Navigation Management
1.9 Communications 1.18 Additional
1.10 Aerodrome 1.19 Useful Techniques
Final Report
Analysis

Analyse, as appropriate, only the information

documented in Factual Information and which is
relevant to the determination of conclusions
and causes and/or contributing factors
Final Report
Conclusions
Findings, causes and/or contributing factors established
in the investigation - should include both the
immediate and the deeper systemic causes and/or
contributing factors.

Final Report
Safety Recommendations
Briefly state any recommendations made for the
purpose of accident prevention and identify safety
actions already implemented.
They will handle it, right?
They will but it takes time…

• Operators cannot afford to wait for Final Report

• Customers, shareholders, insurers, employees all
expect the airline to ‘DO SOMETHING’
• Priority to support families
• Equally important to support state investigation
• BUT we must conduct our own process
• WITHOUT stepping on toes
What operators need to do:
• Establish contact with state investigation
• Allocate tasking for first 24 hours
• Activate investigation hub/location
• Identify likely ‘go’ individuals and get them to
prepare (including rest if possible)
• Nominate liaison with ER - separate
investigation process from ER but ensure
information channels open
• Say NOTHING to the media or anyone else!
What operators need to do next:
Quarantine documentation

• Crew records – flight and cabin, experience, training and

qualification
• Aircraft records – maintenance, airworthiness, weight &
balance
• Navigation documentation – en route and aerodrome charts
• Operational records – weather, NOTAMs, loadsheet, flt plan,
OFP and flt docs, fuel sheet, catering, communications
• Software – nav database, LPC/BLT performance programme,
loading software
• Technical documentation – OM, MOE, CAME, AFM etc
• Regulatory documentation – current version
• Quick Access Recorder – safeguard data
What operators need to do next:
• Convene the investigation group
– Usually the safety team
• Brief senior management
– What do we know so far?
– What questions are we seeking to answer first?
– Do we have access to crew/personnel?
• Analyse the available data
– Reports, met, QAR, transcripts…
• Interim safety recommendations
– Anything we can do right away
A340 Melbourne, Australia
http://www.atsb.gov.au/media/3532212/ao-2009-
012%20animation%20final.avi
Response:
• 1730 - Call received from Ops
• 1745 – Conference call with senior managers
• 1805 – Call to safety investigation team
• 1830 – Established contact with ATSB
• 1850 – Briefed Ops to arrange travel
• 1900 – On-line ETA (visa)
• 1930 – Contacted local staff
• 2000 – Collected ‘go-kit’ from HQ
• 0145*- Departed for accident location
Go-team
• Physical health
– Vaccinations, rest, illnesses, medications…
• Mental health
– Shock, loss, fear…
• Qualification
– Training (BBP), experience, authority, visas…
• Resources
– Tablet, phone, credit card, go-kit…
Go-kit
• PPE
• Clothing
– Climate specific
• Administrative
– Paper, pens, tape…
• Recording
– Camera, mp3…
• Measurement
13½ Hours later…
• A whole Australian day had passed
• Crew in hotel
• Unable to interview pilots
• Cabin crew welfare
Take off calculation 2
Take off calculation 3
ATSB Report – Safety Actions
8.1 Aircraft operator
During the preliminary stages of this investigation, and before the
investigation had identified any safety issues, Emirates undertook and
advised the ATSB of the following proactive safety action:

• Human factors – including the pre-departure, runway performance

calculation and cross-check procedures, to determine whether the
enhancement of those procedures was feasible and desirable, with
particular regard to error tolerance and human factors issues.
• Training – including the operator’s initial and recurrent training in
relation to mixed fleet flying and human factors.
• Procedures – including the introduction of a performance calculation
and verification system that would protect against single data source
entry error, by allowing at least two independent calculations.
• Hardware and software technology – including liaising with
technology providers regarding the availability of systems for detecting
abnormal take-off performance.
Interviewing witnesses
Group exercise in pairs
Interviewing witnesses
• Appointment – stick to time
• Comfortable quiet place – refreshments
• Set the rules and clarify roles
• Let them talk – do not lead
• Clarify and confirm – question doubts
• Who did what? Not we…
• Take contemporaneous notes
• Summarise and explain next steps
Risk Management
A Closer Look
Jo Gillespie
Inter Aviation