9/18/20

 

8900.1 CHG 722

VOLUME 10  SAFETY ASSURANCE SYSTEM POLICY AND PROCEDURES

CHAPTER 7  RISK MANAGEMENT PROCESS AND SYSTEM ANALYSIS TEAM

Section 1  Safety Assurance System: Risk Management Process

10-7-1-1    GENERAL. Principal inspectors (PI) use the risk management process (RMP) to document, track, and evaluate the status of existing hazards and their associated risks. This section describes the process to initiate an RMP. If a new hazard is identified, then see Volume 10, Chapter 7, Section 2, which describes the process to initiate a new hazard.

Indicates new/changed information.

A.    Purpose. This section describes the procedures to manage hazards and the associated risks, including:

    When a certificate holder knowingly or unknowingly accepts or generates an undesirable level of risk;

    If the certificate holder is unwilling or unable to mitigate their risk to an acceptable level; or

    Anytime the PI uses this process for hazard mitigation.

B.    Scope. In the RMP, the PI will:

    Identify a hazard;

    Determine if the hazard requires NSA support;

    Select action details;

    Select hazard details;

    Select RMP classification;

    Determine RMP classification;

    Select RMP mitigation approach;

    Determine if the RMP worked; and

    Close the RMP.

10-7-1-3    RESERVED.

10-7-1-5    BACKGROUND.

A.    Overview. Hazard identification is a key component of the Safety Assurance System (SAS). PIs can identify a safety problem within a certificate holder’s system throughout the SAS process. For example, PIs have the option of selecting an RMP action during the Certificate Holder Assessment Tool (CHAT); Data Collection; or Analysis, Assessment, and Action (AAA) (Action) process. The RMP is an interactive management activity dedicated to assuring that hazards are identified, documented, and eliminated or mitigated.

B.    RMP Participants. The PI is the primary participant of the RMP and will determine when to use this process. When appropriate, the PI may include aviation safety inspectors (ASI), Operations Research Analysts (ORA), and Data Quality Reviewers (DQR) to assist with historical and statistical information.

10-7-1-7    RMP FLOW.

Figure 10-7-1A.  Initiate a Risk Management Process Flowchart

Indicates new/changed information.

Figure 10-7-1A. Initiate a Risk Management Process Flowchart

10-7-1-9    PROCEDURES.

Indicates new/changed information.

A.    A Hazard is Identified (see flowchart process step 10-7-1-9A). A hazard is defined as a condition that could foreseeably cause or contribute to an aircraft accident as defined in Title 49 of the Code of Federal Regulations (49 CFR) part 830, § 830.2. The PI may identify hazards in the CHAT, the Action part of AAA, or Data Collection.

B.    Action Details (see flowchart process step 10-7-1-9B). This step is used to describe the action and why this action is being taken. The default due date of the action is the last day of the next quarter. If the due date is changed from the default due date, then add a reason in the “Due Date Change” comment box. Attach any supporting documentation as required.

Indicates new/changed information.

C.    Hazard Details (see flowchart process step 10-7-1-9C). This section is used to describe the hazard. This assists in risk analysis and provides targets for action plans. Enter the hazard title and description in the appropriate boxes. Complete the other fields, such as “Location” and “Related Make, Model, and Series (M/M/S).” The point of contact (POC) field includes a drop-down list with the office personnel. The PI may request the Frontline Manager (FLM) to assign a POC to assist with the RMP. The POC assumes the PI’s authority for accomplishing the RMP and can be assigned action items associated with the RMP. However, only the PI can open and close the RMP.

NOTE:  Although not required, the “Potential Consequence” field is important. It specifies the possible negative outcome(s) if no action is taken to mitigate the hazard. Select the potential negative consequence(s) from the list. It is helpful to enter additional descriptive information about the potential consequence in the text box.

Indicates new/changed information.

D.    Initial RMP Classification (see flowchart process step 10-7-1-9D). Use this section to identify the risk factors. Select the risk factor type from the following options: Procedures, Control, Process Measurement, Interfaces, Responsibility, Authority, Safety Ownership, Situation, Other, and Unknown. Enter a description of the risk factor in the description text box. Choose the appropriate severity and likelihood from the drop-down menus. The automation calculates the risk assessment based on values in the risk matrix table (see Table 10‑7‑1B, Risk Matrix Table).

Indicates new/changed information.

E.    RMP Mitigation (see flowchart process step 10-7-1-9E). Select the risk mitigation approach from the drop-down menu. The options are Mitigate, Monitor, and Transfer. Enter a justification in the text box. See Table 10-7-1A, Risk Management Process Mitigation Options, for a description of the mitigation options.

Table 10-7-1A.  Risk Management Process Mitigation Options

Indicates new/changed information.

Mitigation Options

Description

Mitigate

An action plan designed to reduce the level of risk or the likelihood of the occurrence. If the action is within the scope of the Flight Standards (FS) office’s authority, then identify actions the certificate holder must take in order to reduce the level of risk. These actions then become specific targets for risk control to eliminate or reduce the negative effects.

Monitor

An action plan to keep under systematic review. Observe and check the certificate holder/applicant’s progress or quality over a period of time.

Transfer

An action plan that transfers risk from one organization to another. If the action is outside of the FS office’s authority, then determine the appropriate Federal Aviation Administration (FAA) organization that has the authority, responsibility, and accountability to take corrective action for the identified hazard. Use this approach to address risks that may require actions such as rule changes, new or revised Airworthiness Directives (AD), policy changes, and safety recommendations. Once the action plan has been transferred, the RMP can be closed. You may follow up on the status of transferred items.

Indicates new/changed information.

F.    Did the RMP Work? (see flowchart process step 10-7-1-9F). The PI must validate the effectiveness of the RMP by determining if the certificate holder’s action plan eliminated the hazard or mitigated the risk to an acceptable level. If the PI determines that the action plan is effective, then the RMP is closed with justification (see Step 10-7-1-9G, Closure Justification). If the RMP is not effective, then the PI should add additional actions (see Step 10-7-1-9B, Action Details). Use the following information as a guide to evaluate the effectiveness of the action plan:

1)    Evaluate the status of the hazard by verifying that the certificate holder addressed the risk factors that contributed to or caused the hazard to occur.
2)    Verify the certificate holder reduced the level of risk posed by the hazard.
3)    Determine if the action plan addressed each risk factor. Describe changes in the risk factors based on the action taken.
Indicates new/changed information.

G.    Closure Justification (see flowchart process step 10-7-1-9G). After the PI has determined whether the certificate holder has addressed the risk factors and reviewed the hazard and its consequence descriptions, the PI revises the severity and likelihood values. The PI uses the risk matrix to determine if the overall level of risk is affected. Choose the new severity and likelihood values from the drop-down menu. If the overall risk is low (within the green area), the PI may accept it without further action. No additional assessments are required beyond the normal oversight planning. If the level of risk is acceptable, the PI closes the RMP. If the level of risk is not acceptable, then the PI revises the hazard description and associated details to determine what additional actions are necessary.

Table 10-7-1B.  Risk Matrix Table

Indicates new/changed information.

Risk Matrix

Likelihood

The estimated probability or frequency of a hazard’s effect or outcome.

Severity

The consequence or impact of a hazard’s effect or
outcome in terms of degree of loss or harm.

 

High

(One or more fatalities, severe injuries and/or severe damage)

Medium

(Moderate injuries and/or substantial damage)

Low

(Minor injuries and/or light damage)

Frequent

Expected to occur routinely (more than 10 times per year)

12

(Red)

10

(Red)

8

(Yellow)

Probable

Expected to occur often (occurs between 4–9 times per year)

11

(Red)

7

(Yellow)

5

(Yellow)

Occasional

Expected to occur infrequently (occurs 1–3 times per year)

9

(Yellow)

4

(Yellow)

2

(Green)

Remote

Expected to occur infrequently (occurs one time every 1‑3 years)

6

(Yellow)

3

(Green)

1

(Green)

10-7-1-11 through 10-7-1-29 RESERVED.