a simplified process for hazard management ihss...hazard/risk management process scope of activity...

Shell Aircraft InternationalOur GOAL is your SAFETY

A Simplified Process for Hazard Management

Tony Cramp

Shell Aircraft International

Scope

• Not a presentation about or justifying SMS.

• Not an academic review of hazard management.

• It is a distillation of observed best practice.

http://images.google.co.uk/imgres?imgurl=http://www.icubed.us/files/graduation1.jpg&imgrefurl=http://www.mtn18.com/mt/mt-search.cgi%3FIncludeBlogs%3D1%26tag%3Dgraduation%26limit%3D20&usg=__1orL4HsXszX3_I-S559eVsDZYvQ=&h=1024&w=1024&sz=114&hl=en&start=10&itbs=1&tbnid=9kjPjOKw4_45iM:&tbnh=150&tbnw=150&prev=/images%3Fq%3Dgraduation%26hl%3Den%26sa%3DG%26gbv%3D2%26tbs%3Disch:1

Scope

• Identify the interactions of Hazard Management within the SMS.

• Detail the procedural steps of the Hazard Management process.

• Suggest documentation requirements.

• Emphasise how to keep the process live and delivering real benefit to the organisation.

References

“Safety risk management. A formal system of hazard identification and safety risk management is essential in controlling risk to acceptable levels. The safety risk management component of the SMS is based upon the system

safety process model that is used in the system safety training course that is taught at the FAA Academy.”

“Risk management is a proactive activity that looks at the risks associated with identified hazardsand assists in selecting actions to maintain an appropriate level of safety when faced with these

hazards.”

Safety Risk Management“A formal system of hazard identification and management is fundamental in controlling an acceptable level of risk. A well-designed risk management system describes operational processes across department and organizational boundaries, identifies key hazards and measures them, methodically assesses risk, and implements controls to

mitigate risk.”

“Hazard identification and safety risk management are the core processes involved in the management ofsafety. They are neither new, nor have they been developed as a consequence of recent interest in safety

managementand, in particular, safety management systems (SMS). Hazard identification and safety risk management are

dogmaticcomponents that underlie the overarching concept of system safety. This is an all-encompassing, engineering-based

approach that contributes to system design and which was developed more that forty years ago.”

Hazard/Risk Management ProcessSCOPE OF ACTIVITY

IDENTIFY AND RECORD HAZARDS

RISK ANALYSIS

IDENTIFY CONTROLS FOR SPECIFIC HAZARDS

REFERENCE CONTROLS AND RESPONSIBLE

POSTS

REMEDIAL ACTION

PLAN

QA SYSTEM – UPDATE

CHECKLISTS

SAFETY REPORTING &

INVESTIGATION

INTERNAL AUDIT TO CONFIRMIMPLEMENTATION & EFFECTIVENESSOF CONTROLS

MANAGEMENT REVIEW

MANAGEMENT OF CHANGE PROCESS

SAFETY REPOPTING & INVESTIGATION PROCESS LINKED DIRECTLY TO THE SAFETY CASE.

VALIDATE EXISTING CONTROLS OR DEVELOP NEW CONTROLS

PROCESS NEW HAZARDS

CONTROL EXISTS NEW CONTROL REQD

CONTROL DEVELOPED

SMS ELEMENTS & RELATIONSHIPSLEADERSHI

P

POLICY, OBJECTIVES &

KPI’S

PROCEDURES

RESOURCES

SAFETY REPORTING & INVESTIGATIO

N

COMMUNICATION (TO WORKFORCE)

MANAGEMENT OF CHANGE

PROCESS

QUALITY ASSURANCE

HAZARD & RISK MANAGEMENT. (SAFETY CASE)

REGULAR SENIOR

MANAGEMENT REVIEW &

ACTIVE INVOLVEMENT

SMS ELEMENTS & RELATIONSHIPSLEADERSHI

P

POLICY, OBJECTIVES &

KPI’S

PROCEDURES

RESOURCES

SAFETY REPORTING & INVESTIGATIO

N

COMMUNICATION (TO WORKFORCE)

MANAGEMENT OF CHANGE

PROCESS HAZARD & RISK MANAGEMENT. (SAFETY CASE)

QUALITY ASSURANCE

REGULAR SENIOR

MANAGEMENT REVIEW &

ACTIVE INVOLVEMENT

Keep it manageableand if necessary

start small

Wasted effort alert

Step 1 - Define the scope

• Determine what range of activities, locations or aircraft the process will cover.Smaller operators – May cover the whole operation.Larger operators – May split the process by

Location/baseAircraft typeOperational role (e.g. offshore, HEMS, heliski-ing)

• Start where you feel the greatest risk or exposure lies within your operation.Hazard or incident reports may give the indication.Staff and managers normally know what their risk areas are.This may also be influenced by customers and regulators!

Step 2 – Identify & Record Hazards

• This stage should be a continuous process.

• Definition of a Hazard can cause debate amongst learned safety professionals.

Generic hazards – Wind, IMC, aircraft components.

Specific hazards – Crosswind exceeding limits, inadvertent entry into IMC, incorrectly fitted aircraft components.

Hazardous consequences – loss of control, disorientation, aircraft system failure.

• While you can list each definition/level in your hazard register, recommend focus on specific hazards at this stage.


Where to start?


Networking, blogs

Safety reporting system

QA findings

Flight Data Monitoring

Incident investigations

Safety Observation Process

Trend analysis

Accidents reports for own A/C types

Accident reports for ownregion/country/location

Accident reports for own role

Training feedback

Recordable occurrences

Brainstorming

Information exchange

Industry Bodies/committees/forums

Generic Hazard Lists


External Information sources:

• State Accident Investigation bodies report data basesNTSB

AAIB

Transport Canada

BEA

• Flight safety Foundation “Basic Aviation Risk Standard – Resource sector”Gives both generic and role specific hazards and lists a number of possible controls for each hazard.

Identified hazards should be recorded in a Hazard Register

Various formats.

Web based, excel tables, access data bases, hand written!

Hazard Register

• Minimum ContentHazardRAM ScoreControlsControl references to procedure manuals (Ops, Maintenance, Training etc) Responsible person – control owner

Basic Hazard Register example

Task Description/Location

Reference No. Date last reviewed

Hazard Description: RAM Score

Initial Current

Controls Reference Owner Status



Onshore seismic support Reference No. Date last reviewed

HS - 017 Sept 09

Hazard Description: Inadvertent entry to IMC RAM Score

Initial Current




RISK ANALYSIS

Step 3 – Risk Analysis

• Having identified hazards, assess the level of risk associated with each to:Determine if further action is requiredPrioritise where effort needs to be directed first

• Use a Risk Assessment Matrix (RAM) to give an objective score to a subjective topic

This enables standardisation across the organisation.It reduces dispute and argumentGives a very visual and clear indication of risk for management review.

Red is difficult to ignore and loosens budget strings.

Typical RAM

• Too vague and open to different interpretation.• Detailed definition required for likelihood and severity.

Detailed RAM

• Detailed definition of Likelihood.• More detail can be added to consequences i.e. actual $ values to asset levels.• Consequences should be applied as the actual consequences that happened in

previous cases of the event.

Detailed RAM

Inadvertent Entry to IMC hazard example.• This company had a fatal CFIT following inadvertent IMC entry 3 years ago.• Within the country there were 4 CFIT on VFR aircraft in last 12 months, 2 fatal,

with 8 fatalities.




HS - 017 Sept 09


Initial Current




RISK ANALYSIS


Step 4 – Identify controls for specific hazards

• A number of methods for identifying controlsBrainstormingBow Tie analysisTripod (Investigation tool, but can be reverse engineered)

• Regardless of method, this step requires that appropriate controls are identified to manage each hazard to ALARP

The higher the risk, the more effective the controls have to be and potentially more layers of controls required.

ALARP – As Low As Reasonably Practicable

What does that mean?How far should you go in developing controls?

ALARP is a trade off between:

The cost/effort/ operational impact of implementing the controlVs

The safety benefit realised from the control

While it is proportional, continue.When it gets disproportional, stop.


• A number of methods for identifying controlsBrainstormingBow Tie analysisTripod (Investigation tool, but can be reverse engineered)

• Regardless of method, this step requires that appropriate controls are identified to manage each hazard to ALARP

The higher the risk, the more effective the controls have to be and potentially more layers of controls required.

Quote from ICAO SMS Manual

“The most effective mitigations are hard mitigations. Because hard mitigations are often expensive, organizations frequently resort to soft mitigations (such as training). In such cases, the organization is more often than not relinquishing to subordinates responsibility for safety risk management.”


• Don’t just use this as an exercise to justify existing procedures and controls.You will have added no benefit from the process.

• Try and look at the hazard isolated from financial and resource constraints in the first place.

“Blue sky thinking”Impractical controls can be discounted later in the process

• Use a range of personnel from within the company at this stage.Line pilots and mechanics as well as supervisors and safety staff.

• Look outside your own organisation at how others in the broader aviation industry have managed this hazard.

Especially those areas with better safety records e.g. airlines, offshore.Can those controls be replicated at a local level?

Wasted effort alert


• Each control needs to meet the following criteria:EffectiveCost/benefitPracticalAcceptableEnforceableDurableDoesn’t create new hazards




HS - 017 Sept 09


Initial Current





HS - 017 Sept 09


Initial Current


Minimum company weather limits for VFR operations

Accurate daily forecasts available for operation

Weather limits agreed with client

Enhanced Operational Controls in place to respond to changes in weather.




HS - 017 Sept 09


Initial Current






Aircraft equipped for IFR flight (Designate minimum avionic equipment)

Pilots instrument rated

Annual inadvertant IFR flight check to ensure currency and competence. Min 30 min

Inadvertant IFR procedures trained and checked during annual simulator training.

All aircraft equipped with TAWS




HS - 017 Sept 09


Initial Current











All aircraft equipped with satellite flight tracking

Emergency response plan in place & exercised annually with client



RISK ANALYSIS



POSTS

CONTROL EXISTS




HS - 017 Sept 09


Initial Current











All aircraft equipped with satellite flight tracking

Emergency response plan in place & exercised annually with client




HS - 017 Sept 09


Initial Current


Minimum company weather limits for VFR operations Ops Man 4.2.3 Chief Pilot In force

Accurate daily forecasts available for operation Ops Man 4.2.4 Chief Pilot In force

Weather limits agreed with client Standard contract clause 9.2

Director Operations In force


Aircraft equipped for IFR flight (Designate minimum avionic equipment) Ops Man 8.3.1 Director of Maintenance

In force

Pilots instrument rated Ops Man 3.4 Chief Pilot In force

Annual inadvertent IFR flight check to ensure currency and competence. Min 30 min

Training Man 6.4 Chief Pilot In force

Inadvertent IFR procedures trained and checked during annual simulator training.


All aircraft equipped with satellite flight tracking Ops Man 8.3.4 Director of Maintenance

In force

Emergency response plan in place & exercised annually with client ERP 5.6 and Standard contract clause 10.1

Head of Safety & QA

In force



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


Step 6 – Remedial Action Plan

• Ideally an organisation should have just one remedial action plan, containing all the actions arising from the hazard management process, safety reporting, QA audits etc.

• This presents senior management with one complete overview and allows departmental requirements to be compared and addressed on a priority basis using the RAM score.

For larger global organisations, local plans may be required.

• Remedial action plans can be recorded on simple excel sheets or in complex integrated databases such as Qpulse or Impact Safety.

• The Hazard Register should reflect the status of the remedial action plan.




HS - 017 Sept 09


Initial Current








In force







In force


Head of Safety & QA

In force

Basic Hazard Register exampleTask Description/Location


HS - 017 Sept 09


Initial Current






Enhanced Operational Controls in place to respond to changes in weather. RAP Item 16 Director Operations Due 31 Jun 10


In force





RAP Item 23 Chief Pilot Awaiting availability of sim for type

All aircraft equipped with TAWS RAP Item 15 Director of Maintenance

Due complete Apr 2011


In force


Head of Safety & QA

In force

Step 6 – Remedial Action Plan

• Having completed and referenced the RAP, the current risk score for that hazard can be re-assessed, taking into account the mitigations and controls that the company has in place.



HS - 017 Sept 09


Initial Current








In force









In force


Head of Safety & QA

In force



HS - 017 Sept 09


Initial Current








In force









In force


Head of Safety & QA

In force

Operator assessed that untilSim training, TAWS and theEOC were in place, risk remained medium



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CONTROL DEVELOPED

Step 7 – Interface with QA system

Your QA system needs to know what your Hazard Management Process has developed.

Wasted effort alert



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS



CONTROL DEVELOPED

Having documented controls to manage hazards, some existing and some new, QA checklists must be updated to ensure that auditors assess those controls for compliance and effectiveness.Ineffective controls need to be reassessed at Step 4.



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS



CONTROL DEVELOPED

Steps 3 – 7 should now be repeated for each hazard identified in step 2.

How to keep it a live process and prevent the hazard register from being a dusty book on the shelf, only

brought out when auditors arrive.This process should also be saving money and

attracting clients

Wasted effort alert

Keeping it alive – Part I



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION


SAFETY REPOPTING & INVESTIGATION PROCESS LINKED DIRECTLY TO THE HAZARD MANAGEMENT PROCESS.


CONTROL DEVELOPED

Step 8 – Interface with Safety Reporting and Investigation

• All company accident/incident/hazard/near miss report forms should have a step that requires the safety manager or investigator to refer to the hazard register as part of the investigation process.

Suggest this be for all Medium and High RAM assessed events.

• If a new hazard is identified this should lead to Step 2 (Haz ID).• If the hazard has already been analysed and documented, the process should

result in the existing controls being reviewed for effectiveness.They may all have worked, thus preventing an accident.Some may have proved ineffective though and the incident may have been too close, requiring additional controls.

Example

Hazard report received that a pilot inadvertently entered IMC during seismic support tasking. After some maneuvering he was able to recover and regain VMC, but had some worried passengers.

After interview with the pilot it appears he pressed on with the task, in deteriorating weather conditions, under client pressure to complete the last flight of the day.

The client’s on site supervisor claims that he was unaware of the operators more restrictive weather limits.



HS - 017 Sept 09


Initial Current







Aircraft equipped for basic IFR flight (Designate minimum avionic equipment)

Ops Man 8.3.1 Director of Maintenance

In force









In force


Head of Safety & QA

In force



HS - 017 Sept 09


Initial Current




Weather limits agreed with client and communicated to site supervisor Standard contract clause 9.2





In force









In force


Head of Safety & QA

In force

Amend contractrequirements

Accelerateintroduction



HS - 017 Sept 09


Initial Current




Weather limits agreed with client and communicated to site supervisor Standard contract clause 9.2





In force




Wx limits and EOC requirements included in Pilot annual ground training syllabus

Training Man 6.12 Chief Pilot






In force

Emergency response plan in place & exercised annually with client ERP 5.6 and Standard contract

Head of Safety & QA

In force

Add and record a further control



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION


SAFETY REPOPTING & INVESTIGATION PROCESS LINKED DIRECTLY TO THE HAZARD MANAGEMENT PROCESS.


PROCESS NEW HAZARDS


CONTROL DEVELOPED

Keeping it alive – Part II



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION



SAFETY REPOPTING & INVESTIGATION PROCESS LINKED DIRECTLY TO THE HAZARD MANAGEMENT PROCESS


PROCESS NEW HAZARDS


CONTROL DEVELOPED

Step 9 – Management of Change

• Required element of the SMS

• Process to include:

Review the relevant sections of the hazard register.

How does the change effect existing controls

What new hazards may be introduced.

• New hazards should be run through the whole process.

• What should prompt the MOC process…?


• The MOC process should be triggered and the hazard register should be formally reviewed ahead of the following occasions:

Introduction of new aircraft type

New contract/operation

Opening a new base

Major change in key personnel or organisation change

If none of the above occur, then every 2 years.

• This wording can form the basis of the Change Management section in the SMS manual.

• The TC SMS Guidelines call for a Safety Case to be developed as a minimum on the occasions listed above.


• However – if you have a live, active and comprehensive Hazard Management Process in place, this “Safety Case” could be limited to a 2-3 page document.

• It would summarise:

What has changed

Which areas/departments have been affected

Which hazards have been reviewed or new hazards identified.

What actions have been taken to manage risk.

Suggested MOC Summary Doc/(”Safety Case”)

Scope of Change Introduction of B 429 from Aug 2010 Ref # MOC 02/2010

Accountable Manager

Director of Operations J. C. Van Damm



Accountable Manager


Type of change Permanent Temporary: From ________ to __________



Accountable Manager



Department/location Responsible Hazard Register Reviewed/Updated

Signature

Maintenance Department

Training Department

Flight Operations Department

Safety & Quality Department

Edmonton Base

Calgary Base

Other departments could be added dependant on thetype of change



Accountable Manager




Signature

Maintenance Department Dir Maintenance 13 Apr 2010

Training Department Training Manager 1 Apr 2010


Dir Operations 22 Mar 2010

Safety & Quality Department Dir Safety & Quality 10 Apr 2010

Edmonton Base Base Manager 5 Mar 2010

Calgary Base Base Manger 15 Mar 2010

Once a department has completed its Review of the hazard Register, the HOD will sign for completion



Accountable Manager




Signature








Summary of Actions Arising Responsible Due Date & Signature

Pilot and mechanic training syllabus developed and documented

Training Manager 1 May 2010

Factory training completed for Pilots and Maintenance Supervisors

Training Manager 1 Aug 2010

Maintenance work stands designed and manufactured Dir Maintenance 1 Jul 2010

Additional Hangar space at Edmonton to be acquired or built Edm Base Manager 1 Jul 2010

Maintenance documentation developed for B429. Maintenance QA Lead 1 Jul 2010

Each department will havedeveloped a detailed actionlist, for its own internal use.



Accountable Manager




Signature








Summary of Actions Arising Responsible Due Date & Signature

Pilot and mechanic training syllabus developed and documented

Training Manager 1 May 2010

Factory training completed for Pilots and Maintenance Supervisors

Training Manager 1 Aug 2010

Maintenance work stands designed and manufactured Dir Maintenance 1 Jul 2010

Additional Hangar space at Edm acquired or built Edm Base Manager 1 Jul 2010

Maintenance documentation developed for B429. Maintenance QA Lead 1 Jul 2010

Statement of Completion/Fitness Accountable Manager Date & SignatureMOC process for introduction of B429 completed . All appropriate sections of the hazard register reviewed and updated. Risk considered managed to ALARP

Director of Operations J.C. Van Damm 15 Jun 2010


The same process could be applied to a new contract or operation and the MOC Summary could be presented to the

client prior to the start of operations as part of their assurance that all hazards have been assessed and that

risk is being managed to ALARP.



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION



SAFETY REPOPTING & INVESTIGATION PROCESS LINKED DIRECTLY TO THE HAZARD MANAGEMENT PROCESS


PROCESS NEW HAZARDS


CONTROL DEVELOPED

Keeping it alive – Part III



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION


MANAGEMENT REVIEW




PROCESS NEW HAZARDS


CONTROL DEVELOPED

Step 10 – Management Review

Unless your senior management supports, is actively involved in the process and uses the process as a management tool,

it will be an academic exercise with limited impact on the business.

Applied effectively the Hazard Management process can be a key factor in influencing the financial decisions within the

company.

Wasted effort alert



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION


MANAGEMENT REVIEW




PROCESS NEW HAZARDS


CONTROL DEVELOPED

Each of these steps in the processcan be a separate agenda itemat the regular Senior ManagementReview meetings



RISK ANALYSIS



POSTS

REMEDIAL ACTION

PLAN


CHECKLISTS

SAFETY REPORTING &

INVESTIGATION


MANAGEMENT REVIEW




PROCESS NEW HAZARDS


CONTROL DEVELOPED

Legal Footnote

Does having this process documented open me to legal or regulatory action in the event of an accident?

• Not having a Hazard Management Process and not having assessed the risks that others in the industry have, may well give you exposure.

• A comprehensive, well documented Hazard Management Process, even one that lists controls that have not yet reasonably been put in place for financial or other reasons, represents “Best Endeavour”, which is legally defensible.

• Your hazard register and remedial action plan are not State “approved” documents, but internal management tools.

Summary

• Keep it manageable and focus first on your known areas of risk.

• Look outside your company for global industry best practice.

• Assess the risks honestly and openly within your company.

• Consider all reasonable controls.

• Keep the process live and adding value.

Scope

• Identify the interactions of Hazard Management within the SMS.

• Detail the procedural steps of the Hazard Management process.

• Suggest documentation requirements.

• Emphasise how to keep the process live and delivering real benefit to the organisation.

Shell Aircraft InternationalOur GOAL is your SAFETY

QUESTIONS

a simplified process for hazard management ihss...hazard/risk management process scope of activity...

Documents