What Is Risk Analysis

Managing risk is one of the main activities of any ICAO compliant SMS program and without a doubt, your airline or airport has practiced risk management processes defined in some manner or another.

The process of risk management has been occurring for hundreds of years. The most well known industry for understanding the process of risk management is the insurance industry. Their profit stems from their shrewd analysis of risk and understanding the types of risk in each industry they specialize in. While your risk identification process doesn't have to be as refined as an insurance company, you will still have to understand the fundamentals of what is risk analysis and how the analysis of risk is important in not only saving lives, but also protecting assets and property.

Let's assume airline or airport employees have been reporting incidents and accidents. When an incident report comes into your system, the first thing a safety manager will do is to review the report and attempt to understand what happened. Not every reported incident requires a formal risk management process, but it helps if there is a template or example available for safety managers to review as they work through the risk identification process.

OK, the incident has been reported and the safety manager has reviewed the details that arrived with the report. Let's assume the safety manager has all the necessary details to understand the types of risk and knows which risk analysis process works best in this particular instance. For this risk analysis example, we will say the reported incident does not require an in-depth investigation that goes through the formal sequence of events, identification of causal/contributing factors, root cause analysis, etc. Let's keep this risk analysis example simple.

Safety managers should first understand what types of risk center around the reported incident and draft a "risk statement." The risk statement helps the safety manager put his thoughts down on paper so others can also understand the types of risk the airline or airport is facing. The risk statement is also a great instrument to communicate to the safety committee and other managers as they also undertake the process of risk management. A risk statement doesn't have to be a long, formal document on the risk identification process used to understand the types of risk. Again, keep it simple. When you think about the risk statement, think "If this xxx were to occur (or has occurred), what is the likely (reasonable) result.

Without understanding the risk, the safety manager will not be able to do a proper risk assessment and communicate the business risk to management. A risk analysis covers understanding the risk (risk identification process), assessing the risk, communicating the risk, classifying the risk, and treating the risk. Up to this point, we have understood the types of risk that come with our risk analysis example. And we have created our risk statement help communicate the risk. Next, the safety manager will assess the risk according to the probability. and severity of the reported incident. Some risk assessments may also factor exposure, but in most airlines and airport safety programs, exposure tends to complicate the risk management process. We need to keep it simple, else the task of analysis of risk will become too burdensome and not be effected in a timely manner. In some organizations, there may be six to twelve reported incidents daily. So keep it simple.

Up to now, the reported incident has been risk assessed and hopefully a responsible manger assigned to deal with the corrective preventive actions to ensure the risk is mitigated and hopefully prevent recurring events that share these types of risk. The next step in the risk management process may be to classify the risk. Classifying the risk helps categorize risks and allows not only for immediate understanding in the risk identification process, but also for future reports. A risk analysis not only happens immediately after the reported incident, but repeatedly and at regular and irregular intervals when upper level managers are attempting to understand the business risk they face. Understanding business risk is important so management can budget for loss, training, equipment replacement, etc. Therefore, classifying risk properly is very important not only in the immediate sense, but also for future risk management processes.

Managers usually conduct their analysis of risk using charts and tabular reports. Without reports, managers would not have an accurate picture of the business risk they face. SMS Pro™ has many reports to help managers during the process of risk management. For example, there are the "Risk Analysis Charts." These were formerly called "Quick Charts" because they allow managers to easily review reported issues and identify challenges without requiring IT personnel to create these charts.

SMS Pro's complex charting tools allow managers to quickly determine which types of issues are costing them the most time and money to manage business risk. These drill-down charts get one to the heart of a risk analysis and provide incredible amounts of information. Risk Analysis Charts (QuickCharts™) and Financial Risk Analysis Charts (FinancialCharts™) share basically the same functionality as they allow managers to conduct their own ad-hoc analysis of risk.

Charts are broken out by "Number of Occurrences" in Risk Analysis Charts and "Financial Costs" in Financial Risk Analysis Charts. Management easily applies date ranges and/or types of issues to quickly see real-time reports by:

• Types of Issues
• Type of Processes Involved
• Root Causes
• Associated Risks/Hazards
• Human Factors
• Mission Delays (Flight Delays)
• Key Performance Indicators
• Status (open, closed, in progress...)
• Department
• Division

More sophisticated SMS Pro™ implementations can take data from multiple portals to analyze business risk.

Understanding Risk Analysis Chart Numbers

Reported accidents and incidents can have multiple classifications attached to them. Often the identified risks have overlapping classification types.

For another risk analysis example:
A bird strike is reported through the issue reporter. A manager working through the risk identification process for this issue may add several "Type of Issue" classifications, such as:

1. Injury >> Employee
2. Injury >> Customer
3. Damage >> Aircraft (not NTSB Reportable)

In the charts it will show that there have been two "Injury" classifications, but when you hover over the drill-down links it will only show one issue. Please keep this in mind while doing a risk analysis.

Risk Analysis Charts and Risk Analysis Financial Charts share similar functionality. What applies to Risk Analysis Charts also applies to Risk Analysis Financial Charts; however, the context changes from "number of occurrences," to "cost of occurrences."

Using Risk Analysis Charts

By default, a divisional report is loaded when users come to the module. The current user's default division is active, hence, it is loaded. If users have permissions to view other divisional data, other divisions will appear in the dropdown list at the upper left.

Choose whether to narrow your investigation to one division or the entire company by selecting an item from the dropdown list for "Show Issues for:"

Next, decide whether to change the date parameters. By default, the start date is filled with the date of the first reported issue in the system. The end date contains today's date.

One is able to filter the types of reported issues (safety, security, quality or compliance) by selecting an option from the "Type of Concern" dropdown list. "Type of Concern" should not be confused with "Type of Issue." Types of Issue are customizable by the SMS Admin and may be unique to each division.

Drilldown and KPIs are similar report types. By selecting a classification type, such as Type of Issue, Process or Root Cause, one can drill down and understand the analysis of risk associated to the classification scheme. It is possible to drill down into three charts, which is the number of classification dropdown lists in the Issue Manager. All classifications originate from the classification process in the Issue Manager.

Hovering over the links, one can learn more about the types of issues providing the data, such as the Issue Title and the Total Cost associated with the reported issue.

Risk Management Process Definitions

Types of Issues are the first classification system that all organization should use when classifying issues. This classification is performed in Issue Manager under the "Classify" tab.

Type of Business Process is an optional classification scheme companies can use to determine whether business processes are faulty and may need modifications. Type of Business process is classified in the Issue Manager under the "Classify" tab. Business processes are documented in the Process Description Library. The Process Description Library affords management an opportunity to document processes requiring change.

Root Cause originates from the Investigation in Issue Manager. Root cause analysis typically covers Management responsibility, Procedures, Controls, Process Management and Interfaces. After determining the contributing factors of an event, a root cause analysis is performed and corrective actions established.

Key Performance Indicators (KPIs) measure critical success factors of an organization. Based on carefully selected measures, aviation-related KPIs reveal a high-level snapshot of a dynamic, functioning organization. KPIs vary depending on the kind of organization they characterize. For example, an airport may have a KPI as the total runway overruns, while KPIs of a helicopter operator may have to do more with the number of emergency landings. Since there are so many ways to classify an issue, such as type of issue, root cause or type of business process, not every classification is highly important to the organization. KPIs allow companies to focus on what matters most to them.

Associated Hazards come from the Proactive Hazard Analysis Tool. This list is generated automatically and may be appended in the Investigation portion of the Issue Manager. After discovering the root cause of an issue, managers may have discovered a new hazard. The ability to easily add identified hazards to the Hazard Registry is important functionality of SMS Pro. Associated hazards should also have identified risks and control measures to mitigate the risk and recovery measures should the hazard occur.

Status/Type allows managers to see how many issues are open, closed, in progress, etc. Choosing the "By Type" option displays the reported issues according to safety, security, quality or compliance.

Department reports show the number of issues reported that have been classified as belonging to particular departments. Higher number of reported issues for a particular department may not necessarily indicate a lack of quality or substandard performance. The department may merely have an exceptional reporting culture, or the department may be highly represented within the company.

Division reports allow management to quickly see how many reports originate from each division. Similar to departments, higher number of reported issues for a particular division may not necessarily indicate a lack of quality or substandard performance. The division may merely have an exceptional reporting culture, or the division may be more highly represented within the company.

More Aviation Risk Analysis & Management Information

FAA Risk Management Handbook (PDF)
Safety Management System (SMS) by FAA
Operational Risk Management Training by SCSI
Skybrary Aviation Risk Management Overview