9.1 Safety Management & Risk Management: Hazards, Risk Assessment and Mitigation
Key Takeaways
- Regulation (EU) 2023/989 added sub-module 9.9 Safety management to Module 9 at knowledge level 2, starting with risk management.
- ICAO Doc 9859 defines a hazard as a condition or object that could cause or contribute to an incident or accident, and safety risk as the probability and severity of its consequences.
- ICAO's example risk matrix scores probability from 5 (frequent) to 1 (extremely improbable) and severity from A (catastrophic) to E (negligible).
- Risks are judged intolerable, tolerable with mitigation to as low as reasonably practicable, or acceptable, and mitigations must be monitored.
- The hierarchy of controls runs from elimination and substitution through engineering and administrative controls to personal protective equipment as the last resort.
9.1 Safety Management & Risk Management
Regulation (EU) 2023/989 added 9.9 Safety management to Module 9 at knowledge level 2, and its first sub-topic is risk management. The change mirrors Part-145 itself: Regulation (EU) 2021/1963 added a management system requirement (point 145.A.200) that includes identifying aviation safety hazards, evaluating them, managing the associated risks, and checking that mitigations work. A certifying engineer is expected to understand this vocabulary and take part in the process, not just leave it to the safety office.
Hazard, Risk and Consequence
The ICAO Safety Management Manual (Doc 9859) uses three linked terms that exam questions often try to confuse:
- Hazard: a condition or an object with the potential to cause or contribute to an aircraft incident or accident.
- Consequence: the potential outcome if the hazard is not controlled.
- Safety risk: the predicted probability and severity of the consequences or outcomes of a hazard.
| Hazard (what exists) | Possible Consequence (what could happen) | Risk (how likely and how bad) |
|---|---|---|
| Ambiguous task card step for cowl latching | Cowl opens in flight and separates | Remote probability, hazardous severity |
| Hydraulic fluid on the hangar floor | Technician slips and falls from low height | Occasional probability, minor to major severity |
| Night shift scheduled to close up a critical task at 04:00 | Omitted step goes undetected | Probability raised by fatigue; severity depends on the task |
| Uncalibrated torque wrench in circulation | Fasteners under- or over-torqued | Probability depends on tool control; severity depends on the joint |
A hazard is not an event. The hydraulic fluid on the floor is the hazard; the fall is the consequence; the risk is the combination of how likely the fall is and how serious it would be.
The Safety Risk Management Process
- Identify hazards from reports, audits, investigations, changes, and staff knowledge.
- Assess the risk by estimating the probability and severity of the credible consequences.
- Judge tolerability: is the risk acceptable, tolerable with mitigation, or intolerable?
- Mitigate the risk until it is acceptable or as low as reasonably practicable.
- Monitor and review that the mitigation is in place and effective, and repeat when anything changes.
Where Hazards Come From
| Method | Description | Maintenance Examples |
|---|---|---|
| Reactive | Learning from events that have already happened | Occurrence reports, MEDA investigations, audit findings |
| Proactive | Looking for hazards before they cause events | Voluntary hazard reports, safety surveys, task observations, management of change reviews |
| Predictive | Using data to spot emerging trends | Analysis of repeat defects, error trends, and reliability data |
Every technician is part of hazard identification. An internal safety report about a confusing task card or a broken stand is as valuable as a report after an incident, because it lets the organisation act before anyone is hurt.
The Risk Assessment Matrix
ICAO's example matrix scores probability from 5 to 1 and severity from A to E, giving a risk index such as 4B:
| Probability | Value | Severity | Value |
|---|---|---|---|
| Frequent | 5 | Catastrophic | A |
| Occasional | 4 | Hazardous | B |
| Remote | 3 | Major | C |
| Improbable | 2 | Minor | D |
| Extremely improbable | 1 | Negligible | E |
The index is then placed in a tolerability region:
- Intolerable (for example 5A or 4A): stop or do not start the activity until the risk is reduced.
- Tolerable (the middle band): accept only with mitigation and management approval, reducing the risk as low as reasonably practicable (ALARP).
- Acceptable (for example 1E): accept as is, while continuing to monitor.
Organisations tailor the exact matrix and regions in their own procedures, so always use the version in your organisation's manual.
Mitigating Risk
ICAO describes three broad mitigation strategies: avoidance (do not perform the activity), reduction (lower the probability or severity), and segregation of exposure (limit who or what is exposed). Workplace safety adds the familiar hierarchy of controls, from most to least effective:
- Elimination: remove the hazard entirely.
- Substitution: replace it with something less hazardous, such as a less toxic cleaning agent.
- Engineering controls: physical changes, such as keyed connectors, guards, or better lighting.
- Administrative controls: procedures, independent inspections, training, and scheduling.
- Personal protective equipment: the last line of defence.
Worked Maintenance Scenario: Assessing a Close-Up Hazard
An organisation's occurrence reports show three cases in a year of engine cowl latches left unfastened after night-shift work, all caught at the walkaround. The safety team treats this as a hazard: close-up steps being omitted at the end of demanding tasks.
- Assessment: The credible worst consequence, a cowl opening in flight, is hazardous (B). Because three near misses occurred, probability is judged occasional (4), giving 4B, which is intolerable.
- Mitigation: Latch indicators are fitted where available (engineering), a close-up checklist and an independent check of cowl latching are added to the task (administrative), and critical close-up tasks are no longer scheduled at the very end of night shifts (administrative).
- Review: With the controls in place, the probability is reassessed as improbable (2), giving 2B, which falls in the tolerable region. Reports are monitored to confirm the change works, and the results are fed back to all shifts.
Exam Pitfalls / Common Traps
- Trap 1: Confusing hazard and risk. The hazard is the condition or object; the risk is the probability and severity of its consequences.
- Trap 2: Treating PPE as the first choice. In the hierarchy of controls, personal protective equipment is the last resort after elimination, substitution, engineering, and administrative controls.
- Trap 3: Thinking risk management belongs only to managers. Hazard identification depends on front-line reports, and certifying staff apply mitigations every day.
- Trap 4: Stopping after mitigation. A mitigation must be monitored; if it does not work or creates a new hazard, the risk must be reassessed.
Using ICAO safety management terminology, which of the following is a hazard rather than a risk or a consequence?
On ICAO's example risk assessment matrix, what does a risk index of 4B mean?
An organisation wants to reduce technician exposure to a toxic cleaning solvent. According to the hierarchy of controls, which option should be considered before issuing respirators?
A maintenance organisation reviews two years of repeat-defect and error data to spot a rising trend before any incident happens. Which type of hazard identification is this?