SAFETY MANAGEMENT SYSTEMS RISK VERSUS SAFETY Almaty, 5 to 9 September 2005

SUMMARY WHY THE SCIENCE OF SAFETY MANAGEMENT? TERMINOLOGY COSTS (ACCIDENTS, INCIDENTS, SAFETY) RISK CLASSIFICATION & ANALYSIS RISK MANAGEMENT QUESTIONS Almaty, 5 – 9 September 2005

WHY USE THE SCIENCE OF SAFETY MANAGEMENT? People often overreact to perceived risk: Train crash in the UK – 5 die Within one month, more death on car accidents then in trains for 30 years! In risk management one must not transfer risk from one area to another! Almaty, 5 – 9 September 2005

TERMINOLOGY HAZARD RISK MITIGATION RISK MANAGEMENT Almaty, 5 – 9 September 2005

TERMINOLOGY - HAZARD Hazard - a scenario which, if it occurs, can have negative consequences to personnel, material (or the environment) Hazard - an event that has the potential to result in damage or injury. Almaty, 5 – 9 September 2005

TERMINOLOGY - RISK Risk: a hazard, chance of or of bad consequences, loss or injury, exposure to mischance … (source: the Oxford dictionary) Risk is two-dimensional: Likelihood of an occurrence (probability) Severity of consequences “The degree of risk is based on the likelihood that damage or harm will result from the hazard and the severity of the consequences.” RISK = probability consequences Almaty, 5 – 9 September 2005

TERMINOLOGY - MITIGATION Mitigation is the action taken to lessen the severity, violence or effect of a change. Almaty, 5 – 9 September 2005

TERMINOLOGY – RISK MANAGEMENT Risk management: the identification, analysis and elimination (and/or mitigation to an acceptable level) of those hazards, as well as the subsequent risks that threaten the viability of an organisation Risk management serves to focus safety efforts on those hazards posing the greatest risks. Almaty, 5 – 9 September 2005

(ALARP as low as reasonably practicable) BALANCING RISK Risks can be balanced using cost-benefit methodology Risk Unacceptable region Risk cannot be justified except in extraordinary circumstances risk “limit” Tolerable only if risk reduction is impracticable or if its cost is grossly disproportionate to the improvement gained Tolerable region (ALARP as low as reasonably practicable) Acceptable region Tolerable if cost of risk reduction would exceed the improvement gained necessary to maintain assurance that risk remains at this level While the elimination of accidents (and serious incidents) would be desirable, it must be recognized that such “perfect safety” is an unachievable goal; failures and errors can still occur, in spite of the best efforts to avoid them. No human activity or man-made system can be guaranteed to be absolutely safe, i.e. free from risk. Safety is a relative notion, whereby inherent risks are acceptable in a “safe” system. As long as everyone – from politicians to the travelling public – understands and accepts this, there is a coherent foundation for aviation safety. ALARP – as low as reasonably practicable risk “target” Negligible Risk Costs Almaty, 5 – 9 September 2005

COST OF ACCIDENTS Industry and social costs Direct costs (related to physical damage) Indirect costs: Loss of business; Loss of use of equipment Loss of staff productivity; Investigation and clean-up; Insurance deductibles; Legal actions and damage claims; Industry and social costs Comments Almaty, 5 – 9 September 2005

COST OF INCIDENTS Flight delays and cancellations; Alternate passenger transportation, accommodation, complains; Crew change and positioning; Loss of revenue and reputation; Aircraft recovery, repair etc. and Incident investigation. Comments Almaty, 5 – 9 September 2005

COST OF ACCIDENT PREVENTION Difficult to quantify; SMS implementation cost-benefit analysis – complicated but should be done; Requires senior management involvement. If you think safety is expensive, try an accident! Comments Almaty, 5 – 9 September 2005

COST OF SAFETY Costs Total Costs Losses Risk Reduction Protection Safety and profit are not mutually exclusive. Quality organisations realize that expenditures on the correction of unsafe conditions are an investment toward long-term profitability. Losses cost money. As money is spent on risk reduction measures, costly losses are reduced (see figure). However, by spending more and more money on risk reduction, the gains made through reduced losses may not be in proportion to the expenditure. Companies must balance the costs of losses and expenditures on risk reduction measures. In other words, some level of loss is acceptable from straight profit and loss point of view. However, few organisations can survive the economic consequences of a major accident. Hence, there is a strong economic case case for an effective safety management system. They may require energy and persistence, but not always a large budget. Protection Almaty, 5 – 9 September 2005

TERMINOLOGY – RISK MANAGEMENT Risk management: the identification, analysis and elimination (and/or mitigation to an acceptable level) of those hazards, as well as the subsequent risks that threaten the viability of an organisation REMINDER! Risk management serves to focus safety efforts on those hazards posing the greatest risks. Almaty, 5 – 9 September 2005

ORGANISATIONAL ACCIDENT STAGES REMINDER! Defences Losses DANGER Hazards Event Causes Latent condition pathway Unsafe acts Investigation Stages in the development and investigation of an organisational accident The rectangular block at the top represents the main elements of an event while the triangular shape below represents the system producing it. This has three levels: the person (unsafe acts), the workplace (error-provoking conditions) and the organisation. The red upward arrows indicate the direction of causality and the yellow downward arrow indicate the investigative steps Local workplace factors System Organisational factors Stages in the development and investigation of an organisational accident Almaty, 5 – 9 September 2005

RISK MANAGEMENT PROCESS Identify the hazards to equipment, property, personnel or the organisation HAZARD IDENTIFICATION Evaluate the seriousness of the consequences of the hazard occurring RISK ASSESSMENT Severity/Criticality RISK ASSESSMENT Probability of occurrence What are the chances of it happening? Is the consequent risk acceptable and within the organisation’s safety performance criteria? RISK ASSESSMENT Acceptability YES Accept the risk NO Take action to reduce the risk to acceptable level RISK MITIGATION Almaty, 5 – 9 September 2005

HAZARD IDENTIFICATION Design factors; Procedures and operating practices; Communications; Personnel factors; Organisational factors; Work environment factors; Regulatory oversight factors; Defences. Almaty, 5 – 9 September 2005

FUNCTIONAL HAZARD ASSESSMENT Functional Hazard Assessment (FHA): determine how safe the system shall be! Reminder! … a system consists of: People (humans, liveware: L); Equipment (hardware: H); Procedures (software: S) and Environment (E). Almaty, 5 – 9 September 2005

THE FHA PROCESS Almaty, 5 – 9 September 2005

RISK ASSESSMENT THREE CONSIDERATIONS INVOLVED: Risk is the assessed potential for adverse consequences resulting from a hazard! THREE CONSIDERATIONS INVOLVED: Probability Severity Rate of exposure Almaty, 5 – 9 September 2005

RISK CLASSIFICATIONS & ANALYSIS The assessment of severity of the consequences always involves: some degree of subjective judgment; the use of structured grouped discussions: guided by a standard risk classification scheme, and using participants with extensive experience in their respective fields. and …. should ensure that the outcome will be an informed judgment. Almaty, 5 – 9 September 2005

STANDARD RISK CLASSIFICATION Likelihood of event per operational hour per sector/unit Severity Category Qualitative Quantitative Cat 1 Cat 2 Cat 3 Cat 4 Frequent Ps> 10-3 Low Serious Probable 10-3 > Ps > 10-4 Medium High Occasional 10-4 > Ps > 10-5 Remote 10-5 > Ps > 10-6 Improbable 10-6 > Ps > 10-7 Extremely improbable Ps > 10-7 Almaty, 5 – 9 September 2005

There is no such thing as absolute safety! RISK MITIGATION There is no such thing as absolute safety! Risk has to be managed to a level “as low as reasonably practicable” (ALARP) Almaty, 5 – 9 September 2005

“AS LOW AS REASONABLY PRACTICABLE” REMINDER! Risk Unacceptable region Risk cannot be justified except in extraordinary circumstances risk “limit” Tolerable only if risk reduction is impracticable or if its cost is grossly disproportionate to the improvement gained Tolerable region (ALARP as low as reasonably practicable) Acceptable region Tolerable if cost of risk reduction would exceed the improvement gained necessary to maintain assurance that risk remains at this level While the elimination of accidents (and serious incidents) would be desirable, it must be recognized that such “perfect safety” is an unachievable goal; failures and errors can still occur, in spite of the best efforts to avoid them. No human activity or man-made system can be guaranteed to be absolutely safe, i.e. free from risk. Safety is a relative notion, whereby inherent risks are acceptable in a “safe” system. As long as everyone – from politicians to the travelling public – understands and accepts this, there is a coherent foundation for aviation safety. ALARP – as low as reasonably practicable risk “target” Negligible Risk Costs Almaty, 5 – 9 September 2005

RISK MITIGATION STRATEGIES Exposure avoidance (if risk exceeds benefits); Loss reduction (reduce frequency of unsafe events); Segregation of exposure (separation or duplication): Isolate the effects of the risk; Build in redundancy. Almaty, 5 – 9 September 2005

RISK MANAGEMENT – STATE LEVEL Policy; Regulatory change; Priority Setting; Operational Management; Operational Inspections. Almaty, 5 – 9 September 2005

RISK MANAGEMENT – BENEFITS Avoiding costly mistakes; Ensuring all aspects of the risk are identified; Ensuring the legitimate interests of affected stakeholders are considered; Providing decision-makers with solid defence; Making decisions easier to explain; Providing significant savings (time and money). Almaty, 5 – 9 September 2005

? QUESTIONS, COMMENTS Do you have any questions or comments? Almaty, 5 – 9 September 2005

SAFETY MANAGEMENT SYSTEMS Almaty, 5 to 9 September 2005 - END -