13.1 Job Safety Assessment, Risk Assessment and the Hierarchy of Controls

Why Operational Risk Management Matters

Every Remotely Piloted Aircraft Systems (RPAS) flight carries risk — to people on the ground, to property, to other aircraft, and to the drone itself. The Civil Aviation Safety Authority (CASA) does not expect zero risk; it expects that the remote pilot has identified the risks, assessed them, and controlled them down to an acceptable level before takeoff. This is operational risk management, and it is topic 2 of the RKOP knowledge unit — a priority-A topic in Schedule 4 of the Part 101 MOS. The questions are scenario-based: you will be given a site and a task and asked what control to apply, what the JSA should contain, or which level of the hierarchy is most effective.

The Job Safety Assessment (JSA)

A Job Safety Assessment (JSA) is a site- and task-specific risk document completed before each job. It is not a generic template you file once and reuse — it is written (or reviewed and updated) for the specific location, the specific aircraft, the specific task, and the specific crew on the day. Some operators call it a JSA; others call it a Safe Work Method Statement (SWMS) or a pre-task risk assessment; the principle is the same.

What a JSA contains

A standard RPAS JSA captures, at minimum:

• The task — what the flight is, the shots or data captures planned, the expected duration and operating area.
• The site — location, boundaries, terrain, nearby hazards.
• The hazards — each identified hazard on or near the site (powerlines, trees, people, animals, other airspace users, RF interference, weather).
• Who is at risk — the crew, bystanders, property, other aircraft.
• The controls — what you will do to reduce each hazard, selected using the hierarchy of controls below.
• Residual risk — the risk that remains after controls are applied. If residual risk is still unacceptable, you do not fly.
• Emergency provisions — the forced-landing options, emergency contacts, and abort triggers for the job.

The JSA is usually paired with a broader risk assessment — a higher-level document that covers recurring hazards across the operator's whole operation (battery fire risk, LiPo handling, transport of hazardous goods). The JSA handles the day-of, site-specific risks; the broader risk assessment handles the systemic, ongoing risks. For the exam, know that both exist and that the JSA is the one you refresh for each job.

When to review the JSA

A JSA is a living document. Review and refresh it whenever conditions change — the weather turns, the crew changes, the task scope expands, a new hazard appears on site (a tradesperson starts work, a school next door breaks for lunch), or you move to a new location. A JSA written at 8 AM for a calm morning is not valid for a flight at 2 PM when the wind has picked up and the carpark has filled with people. The test is: does the document still describe the risks of the flight I am about to do? If not, update it before takeoff.

The Hierarchy of Controls

The hierarchy of controls is the standard risk-management model used across aviation, work health and safety, and RPAS operations. It ranks risk controls from most effective to least effective. The rule is simple: always try to control the hazard at the highest (most effective) level you reasonably can, and only fall back to lower levels when the higher levels are not practicable.

How to apply the hierarchy

Work from the top. Eliminate is always the first choice: if you can plan the mission so the hazard does not exist (fly a route that never crosses over people), that is strictly better than flying over people and relying on a prop guard. Substitute is next: if elimination is not possible, can you swap to a lower-risk aircraft, a lower-risk time, or a lower-risk manoeuvre? Engineering controls put a physical barrier or system between the hazard and the harm — geofencing, prop guards, a Return-to-Home (RTH) failsafe. Administrative controls change the way people work — SOPs, checklists, briefings, exclusion zones. PPE is the last line of defence and protects only the individual wearer, not anyone else on the ground.

A common exam trap is to reach for PPE or an administrative control first because they are cheap and quick. They are also the least effective. The hierarchy exists because controlling the hazard at the source is more reliable than relying on people to follow rules or wear gear. When a question asks for the most effective control, the answer is almost always the one that removes the hazard.

Residual risk

After you apply controls, some risk remains — this is residual risk. The remote pilot's job is to drive residual risk down to a level that is acceptable for the task. If residual risk is still too high (you cannot eliminate flying over a crowd, the substitute platform is still heavy, and the exclusion zone cannot be enforced), the correct decision is not to fly. No job is worth an injury. Document the residual-risk decision in the JSA so the reasoning is visible to the crew and any later review.