Safety Risk
Management (SRM)
Example

Presented to:
Presented by: Don Arendt, Ph.D. FAA Flight
Standards Service
Date: Oct 6, 2009

Federal Aviation
Administration
SRM: A Practical Example

Adapted from a presentation delivered by
Capt. Robert Sumwalt, U.S. Airways,
Retired, Member, NTSB to whom we
extend our thanks.

Safety Risk Management Example

Federal Aviation
Administration

2
Risk Management
“We manage risk whenever we modify the way we
do something to make our chances of success as
great as possible, while making our chances of
failure, injury or loss as small as possible.”
– FAA System Safety Handbook

Safety Risk Management Example

Federal Aviation
Administration

3
SMS Concepts: Risk Management
• Understanding the
system and environment
• Identifying hazardous
conditions
• Assessing risk
• Applying risk controls

Safety Risk Management Example

Federal Aviation
Administration

4
SRM

Start

System
Analysis
(Design)

Hazard
Ident

Risk
Analysis

Risk
Assmt

Risk
Control

Safety Risk Management Example

2.1 Hazard
Identification
& Analysis

Design and Context

Specific Information:
Gather Facts

2.2 Risk
Assessment
& Control

Analysis:
Making sense of the data
Assessment: Decision making
Outputs: To Safety Assurance

Action Problem Resolution

Federal Aviation
Administration

5
System Analysis: Operational Process
Operations To: Hilton
Head, SC (HXD)
• 14 CFR Part 91
Business/Executive
Transport
• Medium Turbine A/C
• Professional Crews
Safety Risk Management Example

Federal Aviation
Administration

6
Facilities

Tower Open: 7:00 AM
– 9:00 PM Local
Safety Risk Management Example

Runway 3/21: 4300’ - PCL
Federal Aviation
Administration

7
Physical Environment
HILTON HEAD ISLAND, SC
HILTON HEAD
•

NOTE: Rwy 3, numerous trees 328' from departure end of

•

runway, 428' left of departure end of runway, 86' AGL/

•

106' MSL. Numerous trees 319' from departure end of

•

runway, 390' right of departure end of runway, 83' AGL/

•

97' MSL. Rwy 21, numerous trees 39' from departure

•

end of runway, 357' right of departure end of runway, 94'

•

AGL/111' MSL. Numerous trees 368' from departure

•

end of runway, 332' left of departure end of runway, 73'

•

AGL/87' MSL. Numerous trees 1421' from departure

•

end of runway, 221' right of departure end of runway, 74'

•

AGL/91' MSL. Numerous trees 1207' from departure

•

end of runway, 329' left of departure end of runway, 85‘/99’ MSL

Safety Risk Management Example

Federal Aviation
Administration

8
Approaches Available

Safety Risk Management Example

Federal Aviation
Administration

9
Hazard Identification

HAZARDS
- No precision approach
- No operational tower at night

Safety Risk Management Example

Federal Aviation
Administration

10
Safety Risk Management Example

Federal Aviation
Administration

11
Assess Risk
PROBABILITY
S
E
V
E
R
I
T
Y

Unlikely

Seldom

Occasional

Likely

Catastrophic

2

3

4

4

Critical

1

2

3

4

Marginal

1

1

2

3

Negligible

1

1

2

2

Hazard

Risk Assessment Code

No precision approach

3 (Seldom, Catastrophic)

No operational tower

3 (Seldom, Catastrophic)

Safety Risk Management Example

Federal Aviation
Administration

12
Risk Assessment: Conclusion
High, unacceptable risk of
approach/landing accidents at
night or in low IMC conditions

Safety Risk Management Example

Federal Aviation
Administration

13
Make Risk Decisions
& Develop Controls

• Develop risk control options,
then decide if benefits
outweigh risk.

Safety Risk Management Example

Federal Aviation
Administration

14
Alternatives

Safety Risk Management Example

Federal Aviation
Administration

15
Make Risk Decisions
& Develop Controls
HAZARDS
- No precision approach
- No operational tower
CONTROLS
We will not use this airport:


between sunset and sunrise when
control tower is closed, and



when the weather is forecast below
800/2.

Safety Risk Management Example

Federal Aviation
Administration

16
Determining Residual Risk
PROBABILITY
Unlikely

S
E
V
E
R
I
T
Y

Seldom

Occasional

Likely

Catastrophic

2

3

4

4

Critical

1

2

3

4

Marginal

1

1

2

3

Negligible

1

1

2

2

Hazard

Risk Assessment Code

No precision approach

1 (Unlikely, Negligible)

No operational tower

1 (Unlikely, Negligible)

Safety Risk Management Example

Federal Aviation
Administration

17
“Carelessness and overconfidence are more
dangerous than deliberately accepted risk”
Wilbur Wright, 1901
Contact:
Don Arendt, Ph.D.
(703) 661-0516 (LL)
(703) 338-7746 (Cell)
don.arendt@faa.gov
Wilbur Wright gliding, 1901
Photographs: Library of Congress

Safety Risk Management Example

Federal Aviation
Administration

18

Safety Risk Management Example

  • 1.
    Safety Risk Management (SRM) Example Presentedto: Presented by: Don Arendt, Ph.D. FAA Flight Standards Service Date: Oct 6, 2009 Federal Aviation Administration
  • 2.
    SRM: A PracticalExample Adapted from a presentation delivered by Capt. Robert Sumwalt, U.S. Airways, Retired, Member, NTSB to whom we extend our thanks. Safety Risk Management Example Federal Aviation Administration 2
  • 3.
    Risk Management “We managerisk whenever we modify the way we do something to make our chances of success as great as possible, while making our chances of failure, injury or loss as small as possible.” – FAA System Safety Handbook Safety Risk Management Example Federal Aviation Administration 3
  • 4.
    SMS Concepts: RiskManagement • Understanding the system and environment • Identifying hazardous conditions • Assessing risk • Applying risk controls Safety Risk Management Example Federal Aviation Administration 4
  • 5.
    SRM Start System Analysis (Design) Hazard Ident Risk Analysis Risk Assmt Risk Control Safety Risk ManagementExample 2.1 Hazard Identification & Analysis Design and Context Specific Information: Gather Facts 2.2 Risk Assessment & Control Analysis: Making sense of the data Assessment: Decision making Outputs: To Safety Assurance Action Problem Resolution Federal Aviation Administration 5
  • 6.
    System Analysis: OperationalProcess Operations To: Hilton Head, SC (HXD) • 14 CFR Part 91 Business/Executive Transport • Medium Turbine A/C • Professional Crews Safety Risk Management Example Federal Aviation Administration 6
  • 7.
    Facilities Tower Open: 7:00AM – 9:00 PM Local Safety Risk Management Example Runway 3/21: 4300’ - PCL Federal Aviation Administration 7
  • 8.
    Physical Environment HILTON HEADISLAND, SC HILTON HEAD • NOTE: Rwy 3, numerous trees 328' from departure end of • runway, 428' left of departure end of runway, 86' AGL/ • 106' MSL. Numerous trees 319' from departure end of • runway, 390' right of departure end of runway, 83' AGL/ • 97' MSL. Rwy 21, numerous trees 39' from departure • end of runway, 357' right of departure end of runway, 94' • AGL/111' MSL. Numerous trees 368' from departure • end of runway, 332' left of departure end of runway, 73' • AGL/87' MSL. Numerous trees 1421' from departure • end of runway, 221' right of departure end of runway, 74' • AGL/91' MSL. Numerous trees 1207' from departure • end of runway, 329' left of departure end of runway, 85‘/99’ MSL Safety Risk Management Example Federal Aviation Administration 8
  • 9.
    Approaches Available Safety RiskManagement Example Federal Aviation Administration 9
  • 10.
    Hazard Identification HAZARDS - Noprecision approach - No operational tower at night Safety Risk Management Example Federal Aviation Administration 10
  • 11.
    Safety Risk ManagementExample Federal Aviation Administration 11
  • 12.
    Assess Risk PROBABILITY S E V E R I T Y Unlikely Seldom Occasional Likely Catastrophic 2 3 4 4 Critical 1 2 3 4 Marginal 1 1 2 3 Negligible 1 1 2 2 Hazard Risk AssessmentCode No precision approach 3 (Seldom, Catastrophic) No operational tower 3 (Seldom, Catastrophic) Safety Risk Management Example Federal Aviation Administration 12
  • 13.
    Risk Assessment: Conclusion High,unacceptable risk of approach/landing accidents at night or in low IMC conditions Safety Risk Management Example Federal Aviation Administration 13
  • 14.
    Make Risk Decisions &Develop Controls • Develop risk control options, then decide if benefits outweigh risk. Safety Risk Management Example Federal Aviation Administration 14
  • 15.
    Alternatives Safety Risk ManagementExample Federal Aviation Administration 15
  • 16.
    Make Risk Decisions &Develop Controls HAZARDS - No precision approach - No operational tower CONTROLS We will not use this airport:  between sunset and sunrise when control tower is closed, and  when the weather is forecast below 800/2. Safety Risk Management Example Federal Aviation Administration 16
  • 17.
    Determining Residual Risk PROBABILITY Unlikely S E V E R I T Y Seldom Occasional Likely Catastrophic 2 3 4 4 Critical 1 2 3 4 Marginal 1 1 2 3 Negligible 1 1 2 2 Hazard RiskAssessment Code No precision approach 1 (Unlikely, Negligible) No operational tower 1 (Unlikely, Negligible) Safety Risk Management Example Federal Aviation Administration 17
  • 18.
    “Carelessness and overconfidenceare more dangerous than deliberately accepted risk” Wilbur Wright, 1901 Contact: Don Arendt, Ph.D. (703) 661-0516 (LL) (703) 338-7746 (Cell) don.arendt@faa.gov Wilbur Wright gliding, 1901 Photographs: Library of Congress Safety Risk Management Example Federal Aviation Administration 18

Editor's Notes

  • #2 {"16":"Please save this voice file in mp3 format with the file name: rs16riskdec\nSo, we decide to control the effects of the two hazards that we’ve identified by limiting operations in two ways:\nOne Restrict operations to hours when the tower is in operation. This will assure that pilots have real time weather, runway condition, and facility operational information.\nTwo Restrict operations when the weather is low IFR. Even though the ceiling of (800 feet) and visibility of (2 miles) stated are above legal limits. This company’s standard provides a higher safety margin.\nAs noted earlier, we can use Savannah as an alternative destination, determine another alternate with similar facilities or delay the operation.\nIn the end, we’ve chosen to change our operations during the conditions listed night or low IFR. A subtle nuance to this analysis is that we have actually already determined that the risk of day VFR or other than low IFR conditions is acceptable. If we had decided, for instance, that the primary hazard was the runway length, our decision might have been to avoid this airport entirely.\n","5":"<number>\nPlease save this voice file in mp3 format with the file name: rs5srm\nIn the Appendix 1 of AC 120-92A you can find the word description of SRM process. The objective here is for you to become comfortable with the SRM process as a flow of decision-supporting and decision-making activities instead of just a list of requirements to “check the blocks.”\nThe SRM work flow follows the 5 steps of any decision making process. These steps are:\nStep 1 Design and Context: This is where the System Analysis block fits, as it requires an understand of the system and the environment in which the system exists.\nStep 2 Specific Information: Hazard identification fits in this block. Here you gather specific information and facts to identify conditions that may represent a danger to your organization.\nStep 3 Analysis: This is where you analysis the Hazards and decide what risks they present to your operation.\nStep 4 Risk Assessment: This is the point in the process where a risk matrix maybe used to determine the Likely Hood of the risk and how severe the consequences of that risk may be if the events of the risk occur. Depending on the outcome of this assessment the risk maybe acceptable or unacceptable. If the risk is acceptable you are finished and the information is transferred to the Safety Assurance work flow.\nIf the risk is unacceptable you move on to \nStep 5: Action Problem Resolution. Here corrective or preventative strategies are formulated to either eliminate the risk or mitigate it to an acceptable level. Once these Controls are implemented they are run back through the Safety Risk Management work flow to ensure they accomplish their purpose without introducing additional risk.\n","11":"Please save this voice file in mp3 format with the file name: rs11alar\nIn spite of the facts that operations into non-towered airports using non-precision approaches are conducted routinely, analysis conducted by the Flight Safety Foundation identifies these two factors as being high on the list of risk factors for approach and landing accidents.\n","17":"<number>\nPlease save this voice file in mp3 format with the file name: rs17risdual\nThe final check on the risk control is to re-assess the risk, under the new conditions with the risk control in place. While there is still a degree of risk with any aviation operation, it can be concluded that the controls will reduce the risk level.\nAt this point, we also need to make sure that we: \nNumber one document the outcome, including in whatever hazard tracking system is employed.\nNumber two monitor the performance and effectiveness of the risk controls and,\nNumber three communicate them to the employees involved in the operations..\nThe necessity for a feedback loop between SRM and subsequent assurance activities is also defined in SMS Framework.\n","6":"Please save this voice file in mp3 format with the file name: rs6analysis\nThe SRM workflow starts with system analysis, which, in turn, starts with identifying the operational process found in the SMS Framework, section 2.1.1. which is in Appendix 1 of \nAC-20-92 as amended. The level of detail needed is only that needed to identify reasonably foreseeable hazards or to address hazards already identified.\nIn this case, the flight operations are being planned into the Hilton Head, SC airport. As the slide says, the operations are being conducted under 14 CFR part 91 by a corporate flight department, transporting company executives to business activities.\nThe operations are being conducted in medium turbine airplanes by professional crews.\nFrom here, we will go though a brief description and analysis of the system, the environment, and the operational tasks.\nThis airport is in a coastal area on the east coast of the Unites States. The airport elevation is 19 feet, above Mean Sea Level and there is open water of the Port Royal Sound immediately Northeast of the airport.\n","12":"<number>\nPlease save this voice file in mp3 format with the file name: rs12assess\nThis risk matrix, developed by the company was used to evaluate the overall level or risk. This is part of the risk acceptance process established in the SMS Framework that expects the organization to use tools for risk assesment. \nThe Policy section and the SRM component of the SMS Framework also have expectations for the company to define levels of management who have the authority to accept risk. This makes it necessary that these individuals have at least a basic knowledge of the assessment tools and be proficient in the use of these tools\nWhile not being in the highest likelihood category, the potential severity of consequences of an approach and landing accident places the risk at a higher level than the company was willing to accept.\nIt’s important to note that the hazards are what creates the risk but we are not assessing the hazard directly. We are assessing the likelihood and potential severity of a consequence, in this case, an approach and landing accident.\n","1":"Please save this voice file in mp3 format with the file name: rs1intro\nThis presentation demonstrates a practical application of the Risk Management portion of a Safety Management System. \n","18":"Please save this voice file in mp3 format with the file name: rs8end\nAs you can see even before their famous flight of December 17, 1903 the Wright brothers recognized the need for risk management. This quote from Wilbur Wright, written two years earlier exemplifies the Wrights’ attitude. It is clear that their attitude toward risk management was a key element in their ultimate success.\nWe trust this presentation has been helpful in explaining the principals of Safety Risk Management, however if you have any other question or need further assistance please contact the SMS Program Office at the numbers listed.\n","7":"Please save this voice file in mp3 format with the file name: rs7facilities\nNext we take a look at the facilities of the airport.\nHere is the airports’ single runway. It is 4300’ long, which is adequate for the aircraft used but possibly marginal for operations at high weights, at night, or in low IFR conditions.\nThe airport has a tower but it is only operational during daytime and early evening hours. During night operations, pilot-controlled lighting (PCL) is available.\n","13":"Please save this voice file in mp3 format with the file name: rs13conclusion\nThe conclusion of the analysis is that the risk is unacceptably high, given the conditions.\nRemember that risk management is a decision making activity. Thus there may be no “absolute right or aboslute wrong” outcome of the analysis. The SRM process is a decision tool. That is another reason why the people who make operational decisions need to be involved in the process.\nThe Policy section of the SMS Framework has an expectation for the organization to designate levels of management who are authorized to make these decisions\n","2":"Please save this voice file in mp3 format with the file name: rs2contributed\nThis example was contributed by Capt. Robert Sumwalt, U.S. Airways (retired), Member and former Vice Chair of the NTSB.\nIt is based on an actual operation from a corporate flight department.\n","8":"Please save this voice file in mp3 format with the file name: rs8physcial\nNow we continue to look into the airport’s physical environment for anything that might affect the safety of arrivals and departures into and out of the airport.\nThis could consist of many things but, for the purposes of this example, notice there are “numerous trees” mentioned in the departure procedures for the airport. \n","14":"<number>\nPlease save this voice file in mp3 format with the file name: rs14controls\nThe next step is to develop risk controls.\nThe first place to look is back at the hazards – what is it about the set of conditions that make the risk of these operations what it is? Is there anything that we can do to eliminate or alter one of the conditions, or alter the operations, or make our people better able to cope with them?\nBe careful with the risk/reward determination. It can easily get translated to a perception that high risk is acceptable if the reward of mission criticality is high. \nThis can be especially problematic in emergency operations such as emergency medical transport, firefighting, law enforcement, other situations. where well-intentioned but misplaced priorities can lead people to take on inappropriate levels of risk.\n","3":"Please save this voice file in mp3 format with the file name: rs3handbook\nA previously published FAA System Safety Handbook has the following quote that is particularly appropriate to problems regarding continuing operational safety and risk management.\nRisk management is not an additional task – as something “added on at the end.” It is the way we perform our daily business. It is what we do in the operations and activities involved in providing products and services.\n","9":"Please save this voice file in mp3 format with the file name: rs9approaches\nFor IFR operations, the Hilton Head airport has only non-precision approaches, although none uses intermediate step-downs, none has vertical guidance.\nThe most accurate of the approaches, the Localizer/DME approach to runway 21, also requires radar to initiate the approach.\nTwo of the approaches, and the only one that allows for a straight-in landing on runway 3 require operational, approach capable, IFR approved Global Positioning System (GPS) equipment with a current database.\n","15":"Please save this voice file in mp3 format with the file name: rs15alternatives\nIn our search for a mitigating strategy, we should consider the alternatives. The availability of practical alternatives may affect our choice of how to attack the problem. As in hazard identification, we need to consider changing the operation, changing an element of the system, or changing how people cope with the conditions or operate equipment.\nIn this case, a ready alternative presents itself. If we need to avoid the Hilton Head airport, the Savannah International Airport, with precision approach facilities and tower an approach control facilities is in a reasonable distance.\n","4":"<number>\nPlease save this voice file in mp3 format with the file name: rs4concepts\nLet us review and emphasizes the key aspects of risk management.\nFirst, we have to have a firm grasp on the systems, the operations, and the operational environment that is involved.\nThis allows us to identify potential hazards such as system problems, operational tasks difficulties, and environmental conditions that could pose a risk to the organization.\nNow that the risk has been established you can determine likely hood or severity of that risk, thus allowing you to make an informed decision about risk acceptability and the need for risk controls. \n","10":"Please save this voice file in mp3 format with the file name: rs10hazards\nFrom our analysis of the system, the operations, and the environment, we identify two potential hazards:\nOne the lack of precision approach facilities\nTwo the lack of an operational tower at night\nWe might have identified other hazards but, for the sake of the example, we’ll stick to these two, because it is not expected that companies will be able to address every conceivable hazard but they are expected to exercise due diligence to identify and address reasonably foreseeable hazards .\nThe expectations of the SMS Framework is that companies needs to have a method of documenting and tracking hazards and actions taken. This can be paper, a simple computer file, or a sophisticated IT system, depending on the operator.\nOn the surface, neither of these hazards is an immediate “no-go.” In fact, many pilots will say that the airport has relatively good facilities and conditions for an experienced, competent crew, however, for routine operations, we want to look at making our risk as low as reasonably practical.\n"}