The center of safety management systems' risk management process is risk control measures. Control measures are meant to mitigate the potential for hazard expression (dangerous conditions) or the likelihood and severity of potential consequences (risks).
Oversight agencies like the FAA comprehend the importance of control measures, which is why they are always asking, “How do you monitor the effectiveness of risk control measures?”
Aviation service providers, such as aviation SMS programs and airline SMS programs, need a solid, demonstrable answer to this question. However, organizations will have different ways of monitoring control measures. It doesn't matter so much what method organization's use, so long as organizations can demonstrate that their monitoring methods work.
Of course, before you can monitor you need to develop your control measures through the use of corrective-preventative actions by:
- Identifying hazards;
- Assessing risk; and
- Reviewing and documenting existing control measures.
Control measures need to actually work in the operational environment, and not simply exist “on paper.” This seems like a rather obvious point, but many programs fail to actually ensure that their risk controls are real. Consider, are any of the control measures in your safety management system only on paper?
Types of Monitoring
We can break monitoring the effectiveness of risk control measures into three categories. Each category is designed to monitor in a different way:
- Periodic performance monitoring: evaluating control measures in a formal review process on an annual or semiannual basis, such as with auditing;
- Scheduled monitoring: monitoring control measures on a regular basis, such as reviewing hazard trends and identifying problem control measures once per month; and
- Ongoing monitoring: monitoring control measures on a daily basis, such as when hazard reports are submitted.
You will impress oversight agencies by demonstrating the various ways that you monitor. It shows that you are "on top of it" as far as your SMS is concerned. Moreover, you will find that your risk controls are consistently relevant, greatly reducing the likelihood of an audit finding or a safety concern because a control measure failed.