The What, How, and Why of Risk Management

A ship is always safe at the shore — but that is NOT what it is built for. — Albert Einstein

Once upon a time, pretty much everyone involved in aviation took an “accidents happen” view of the world. From time to time in my pre-Internet youth, I would pick up the newspaper or turn on the TV news to learn about a major airline accident. The photos were always grim. The details of each accident differed, but the result was the same. The investigation would reveal some human, mechani­cal, or meteorological flaw. Government and indus­try would come up with a way to address the issue, and off we’d go until the cycle repeated with the next accident.

The “find, fix, and fly” approach resulted in a number of safety enhancements over the years. There was better training (including crew resource management, or CRM) for flight crews, mainte­nance personnel, and air traffic controllers. There were upgrades to airplanes and avionics. There was research on weather phenomena such as wind shear. There were new rules to ensure that everyone com­plied with the changes.

These improvements made major accidents less common, but everyone involved in aviation eventu­ally realized that just waiting for the next accident to put a spotlight on some heretofore undiscovered flaw was not the best way to improve aviation safety.

The community — to include government as well as all segments of the industry — also came to understand that even the most faithful adherence to rules and regulations will not prevent the next acci­dent. There is no question that following regulations is a vital part of aviation safety risk management. The rules provide an essential foundation for avia­tion safety. They are meant to direct the pilot’s path toward practices that contribute to safe operation and away from activities that undermine it.

The problem is that while regulations are neces­sary, they are not sufficient in and of themselves. They offer comprehensive and sometimes exquisitely detailed treatment of individual issues. Still, regulations simply cannot cover the nearly infinite number of possible combinations of situ­ations that can undermine safety. In this respect, regulations alone are like bricks without mortar.

System Safety

Enter the discipline of risk management, and the concepts of system safety. The terms are admit­tedly abstract and they have a formal (and somewhat formidable) official definition. But, as the characters repeatedly assert in the slapstick Airplane! movies, “that’s not important right now.” To make the con­cept more concrete, think of system safety as the mortar needed to bind individual regulatory bricks together and build a sturdy barrier to accidents.

You know about the regulatory “bricks,” so let’s focus on the “mortar.”

A system can be defined as a combination of people, procedures, equipment, facilities, software, tools, and materials that operate in a specific envi­ronment to perform a specific task or achieve a spe­cific purpose. GA flight operations clearly constitute a complex system with many variables:

• Pilots have different levels of knowledge, skill, experience, ability, and discipline.
• Procedures, such as instrument approaches, can be very complex.
• Equipment, airframes and avionics, is changing rapidly.
• Services, such as those provided by airports and air traffic control, vary widely and are already changing as NextGen technologies are deployed in the National Airspace System.
• The flight environment, including weather, is a critical factor in the safety of every flight.
• External factors can have a substantial impact, especially if the pilot doesn’t consciously recognize them.

Risk Management

A key part of the system-safety approach is risk management, a decision-making process designed to methodically identify hazards, assess the degree of risk, and determine the best course of action. To put risk management to work in your personal aviation safety system, you need to be familiar with some of the basic concepts:

• A hazard is a present condition, event, object, or circumstance that could lead or contribute to an unplanned or undesired event. For example, a ¼-inch nick in the propeller is a hazard.
• Risk is the future impact of a hazard that is not controlled or eliminated.

A risk-assessment matrix shows that the level of risk posed by a given hazard is measured in terms of severity (extent of possible loss), and probability (likelihood that a hazard will cause a loss). Exposure (number of people or resources affected) can also be considered in assessing risk.

Here’s a practical illustration of both the “rule gap” and the hazard/risk relationship.

A few years ago, I sent a primary student out to do the preflight inspection. As required by school rules, he carefully checked the Cessna 152’s mainte­nance and airworthiness records before heading out to the airplane. All paperwork was in apple-pie order.

Reaching the plane, my student discovered a sheen of oil on the nosewheel fairing. When he bent down for a closer look, he noticed that it was fresh, and steadily increasing with the steady drip-drip-dripping of oil droplets escaping from somewhere in the engine compartment.

While he had established compliance with the paperwork and maintenance and airworthiness ser­vice requirements, my student correctly concluded that a bleeding airplane was not in a condition for safe flight. In terms of hazards and risks, the Cessna 152 oil leak was a hazard, but it would become a risk only if the airplane had been flown. So we went back inside for coffee, and wound up using the scheduled lesson time to discuss safety rules, safety realities, and the concept of safety risk management.

Practical (Easy) Risk Management

To make system safety and risk management practical for real-world GA operations, the FAA Safety Team (FAASTeam) promotes a simple three-step process:

Perceive, or identify, the possible hazards associated with each category in the well-known PAVE checklist:

• Pilot — e.g., experience, recency, currency, physical and emotional condition
• Aircraft — e.g., fuel reserves, experience in type, aircraft performance, aircraft equipment
• enVironment — e.g., airport conditions, weather (VFR and IFR requirements), runways, lighting, terrain
• External factors — e.g., impact of delays and diversions

Process, or analyze, by evaluating the severity, probability, and/or exposure of the risk posed by the hazard(s) you identified in step one.

Perform by finding ways to eliminate or mitigate the severity, probability, and/or exposure of each of the identified hazards.

With consistent use, cycling continuously through the three-P cycle can become a habit that is as smooth and automatic as a well-honed cross-check, interpret, and control scan taught in instru­ment flying.

Risk Management in the Airman Certification Standards (ACS)

The FAA Risk Management Handbook (FAA-H- 8083-2) observes that:

Learning how to identify problems, analyze the information, and make informed and timely decisions is not as straightforward as the train­ing involved in learning specific maneuvers. Learning how to judge a situation and “how to think” in the endless variety of situations encountered while flying out in the “real world” is more difficult. There is no one right answer in Aeronautical Decision Making (ADM); rather each pilot is expected to analyze each situation in light of experience level, personal minimums, and current physical and mental readiness level, and make his or her own decision.

That’s why the new FAA Airman Certification Standards (ACS), which began replacing the Practi­cal Test Standards (PTS) in June 2016, explicitly incorporate risk management into the certification standards for an airman certificate or rating.

While the PTS has long required the evaluation of knowledge and risk management elements in both the ground and flight portions of the practi­cal test, it offers little more than a statement of the requirement and, in the case of “Special Emphasis” items, a list of subjects the Designated Pilot Examin­ers (DPEs) must evaluate. The ACS provides better guidance to applicants, instructors, and evaluators because it provides specific risk management and ADM procedures and behaviors associated with each Task, and it incorporates Special Emphasis items in the risk management section of the appro­priate Area of Operation/Task. This presentation helps instructors make stick and rudder skills more meaningful by teaching them in the context of what the applicant must know and consider while demon­strating flight skills. On the practical test, it allows the evaluator to see and assess an applicant’s judgment and decision making in the context of actual flight operations. The ACS thus discourages the use of abstract and potentially subjective methods of test­ing these important skills.

Consistent with the 3-P risk management model, the ACS is also intended to communicate and demonstrate that risk management is a continu­ous process that includes identification, assessment, and mitigation of task-specific hazards that create risk. The risk management element identifies the circumstantial issues that aviators must consider in association with a particular task.

Because the level of risk that is acceptable to one pilot may not be the same for another, some have expressed concern that testing of risk management elements in the ACS will be too subjective. It is true that risk management is unique to each and every individual, but the ACS defines the circumstances, conditions, or risks applicable to each Task, not to the specific individual. Applicants will thus be tested on their awareness and mitigation of the risks associated with the Task at hand, which includes the applicant’s consideration of these elements in the context of the maneuver but taking account of the pilot’s experience and ability, the aircraft used, and the operating environment.

Why Bother with Risk Management?

Aviators love to argue, and social media is full of lively debate about the “real” cause of GA accidents. Some threads focus on deficiencies in so-called stick-and-rudder skills, and suggest — incorrectly — that the addition of risk management diverts atten­tion from airplane handling skills.

In fact, most accidents have multiple causes. Some of the most persistent factors in fatal GA acci­dents are maneuvering flight, continued VFR into IMC, and loss of control on takeoff. All imply some degree of deficiency in the pilot’s knowledge, skill, and risk management abilities. Even the world’s best stick-and-rudder pilot is at risk for loss of control if he or she has an inadvertent flight into IMC because of deficiencies in weather knowledge or risk man­agement ability. Safety is not served by emphasizing just one of these three abilities; on the contrary, each supports the others. To paraphrase the familiar “all available information” regulation (14 CFR section 91.103), we need to use “all available means,” includ­ing risk management, to fly safely. (FAA Safety Briefing – JanFeb 2017)