The purpose of this document is to provide detailed procedures for the Risk Management Process (RMP). This process is part of the Enhanced Repair Station and Air Carrier Outsourcing Oversight System.
The RMP is to provide certificate-holding district offices (CHDO) with an effective means to oversee the certificate holder’s management of identified hazards and the risk posed by those hazards. This process has six major steps, as illustrated in Figure 1, and is briefly described below:
The Risk Management Process may be used to address any hazard that the principal inspector (PI) decides is significant enough to justify intensive analysis and tracking. Systemic hazards are often good candidates for this process. The PI determines when it is appropriate to use the RMP to address an identified hazard.
The paragraphs below briefly describe each of the six steps and how those steps support the RMP. The remainder of this document describes in detail how to carry out each step.
Step 1: Hazard Identification
The purpose of hazard identification is to describe, “What’s wrong?” with the certificate holder’s operation. To complete the hazard identification step, the PI describes the conditions or circumstances in the certificate holder’s operating environment or in its operating systems that could lead to an unplanned or undesired event.
Step 2: Risk Analysis
The purpose of risk analysis is to determine, “What could happen and why?” To complete the risk analysis step, the PI identifies the potential consequences that could result if the hazard was not addressed. The PI also identifies the factors that are causing or contributing to the hazard’s occurrence. The risk factors identify what must be fixed or controlled in order to reduce the level of risk.
Step 3: Risk Assessment
Risk assessment answers the question, “How likely is it to happen and how bad would it be if it did happen?” That is, what is the level of risk? To complete the risk assessment step, the PI uses the information from the risk analysis to determine the severity of the potential consequence, the likelihood of that consequence occurring if the hazard is left alone, and the overall level of risk. The overall level of risk is one consideration in determining what priority should be placed on ensuring the certificate holder addresses the hazard and its risk factors.
Step 4: Decisionmaking
Decisionmaking answers the question, “What’s to be done about it?” To complete the decision-making step, the PI decides: if action needs to be taken to eliminate the hazard, to reduce the level of risk; if the certificate just needs to be monitored, or, if the responsibility for getting the hazard mitigated needs to be transferred to some other Flight Standards or FAA organization.