This is the third article in a series about Safety Management Systems (SMS). In the first article (see Aviation Maintenance January 2020 issue, page 48), we examined some hazard identification strategies (looking at ways to identify the things that could go wrong in our systems). In the second article (see Aviation Maintenance May/June issue page 48), we began looking at the process of using risk assessment to analyze identified hazards by explaining how to establish a “likelihood” scale that is relevant to your business needs, and how to calculate a “likelihood” for each identified hazard. This month, we will continue examining risk assessment by looking at the process of using “consequence” as a second metric for analyzing risk. By adding “consequence“ to “likelihood,” we can correlate the two in order to get a product that represents the relative risk associated with the hazard (we will use this risk product to help make decisions, and also to measure the effectiveness of our mitigation efforts).
I strongly recommend that you go back and read the first two articles if you have not looked at them recently. They are each pretty short, and they lay a foundation that will make it much easier to understand what this article is talking about.
Did you review the prior two SMS articles? Good! Then we are ready to continue.
Remember that there are a number of reasons for assessing risk. These reasons were described in some detail in the earlier SMS articles but for review purposes, here is a summary of some basic reasons why one might want to assess risk of hazards
• To better allocate limited resources by directing them to mitigating the most significant risks;
• To have metrics that show when risks have been sufficiently mitigated;
• To facilitate constant system improvement; and
• To help judge your company’s progress on the safety continuum.
We typically assess risk In an SMS system by assigning two values to each hazard. The first value is “likelihood,” (which we examined in the May article) and the second value is “consequence.” Together, they can provide a measure of the risk posed by a particular hazard.
Likelihood reflects the prospect that the hazard condition will manifest itself. Consequence reflects the potential harm if the hazard condition manifests. So, the likelihood that Earth will be struck by an asteroid is remote; but the consequence of such a strike would be devastating. On the other hand, the likelihood that the Earth will be struck by average-size meteors is high (it happens on a regular schedule as we pass through clouds of matter) but the consequence is low (they tend to burn up in the atmosphere before hitting the ground).
In the last article we relied on the FAA certification parameters as a baseline for establishing likelihood but then talked about ways to modify those descriptions to make them more relevant to a repair station environment. We are going to do something similar with “consequence.”
The reason that we assess different levels of consequences is so we can distinguish the hazards that cause significant danger from those that pose little danger. For example, the consequence of a hazard associated with a piece of interior decoration is typically quite low. For example, a passenger might suffer a minor injury, or the hazard might cause an aesthetic issue. The consequence of an engine hazard that could cause an in-flight shutdown of an engine is dramatically higher. If we have two equally likely hazards, with vastly different consequences, then we typically want to first commit out resources to effectively mitigating the hazard that has a higher consequence.
Consequences are always judged based on the hypothesis that the consequence actually occurs, without a discount for likelihood. We have a separate parameter (likelihood) to account for the possibility of occurrence.
You have to define consequences, and levels of consequences, consistent with your own business needs and expectations. This also allows you to mitigate to the desired levels. You may change these levels as your safety management system develops, to continue to evolve the system to meet your safety needs. A good starting matrix for a repair station might look like this:
Notice that this matrix emphasizes consequences that adversely affect the repair station’s ability to support the customer’s aviation safety goals. The assumption in this matrix is that each consequence level is worse than the earlier levels.
As with likelihood, it is important to understand that even though we are assigning numbers to consequences, the measurement is really qualitative, rather than quantitative. This is because the numbers are assigned based on the SMS system that your company has developed. You typically cannot compare your numbers to the numbers generated by another company’s risk assessment.
Because different people can come up with differing opinions about reasonable consequences, a more objective standard can be valuable (so please do not assume that the consequence values in the above table reflect an ideal). When you are establishing consequence values and narratives, don’t be afraid to adjust them to suit the needs of your business (including the need to distinguish events that cause more harm to aviation safety from those that would have less impact to aviation safety). If you do adjust your values after you’ve started assessing risk, though, then you may need to re-analyze past risk assessments to update them to the new standard so you can compare hazards according to the same metrics.
The table includes five different levels of consequence. Your table may include more or less levels. The important thing is that the table you develop for your own system must distinguish among hazards in a way that is useful to your analysis of those hazards. For example, you do not want to make the levels of consequence so close together as to be impossible to distinguish in which category a hazard belongs.
In the next issue, we will look at how to use likelihood levels and consequence levels in order to arrive at a risk product that can be used to compare the relative risk of different hazards. Want to learn more? We have been teaching classes in SMS elements, and we have advised aviation companies in multiple sectors on the development of SMS processes and systems. Give us a call or send us an email if we can help you with your SMS questions. www.pmaparts.org.