Airport Risk Identification and Prioritization Practices (2019)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

18 The survey instrument detailed in Appendix A was sent to 29 airports. Responses (n = 24) yielded a response rate of 82.8%. The surveys included responses from airports that were categorized as large hubs (n = 3), medium hubs (n = 7), small hubs (n = 3), nonhub primary airports (n = 4), nonprimary airports (n = 6), and other (n = 1). Appendix B lists those airports that submitted responses that were included in the analyses in this report. Each of those airports was asked to respond to each question on a Likert-style scale, which consisted of (1) Never, (2) Rarely, (3) Sometimes, (4) Usually, and (5) Always, with distributions of total responses presented on stacked bar graphs. The figures in this chapter present aggregate totals across the Likert-style scale and the distribution of responses from large hub, medium hub, small hub, nonhub primary, and nonprimary airports. The average response of those surveyed is given for each question. Following the quantita- tive results, the themes found in the qualitative (comments) results are provided. Question 1: Does your organization publish specific expectations and procedures for risk identification? The average response of the airports surveyed was 3.4, with “Sometimes” (i.e., 3) as the most common response. The quantitative responses indicate medium and large hubs more consis- tently have published some form of expectations and procedures for risk identification, while smaller hubs’ responses depended on the airport culture (see Figure 7). The first theme within the qualitative responses addressed airports’ focus on the methods used to communicate expectations and procedures to various stakeholders compared with the documentation of expectations and procedures for risk management. Examples of this theme include airports’ responses that they provide annual strategy reports for the stakeholders that include the airport’s vision, mission, and strategies, that the airports use surveys to reflect expectations, and that they publish bulletins about risk, including a monthly newsletter. A second theme identified airports that are in the process of publishing expectations and procedures using SMS or ERM principles. Question 2: Does your organization have prompts or reminders in place that require appli- cation of risk management tools or processes? The average response of the airports surveyed was: 3.2, with “Usually” (i.e., 4) as the most common response; quantitative responses were distributed fairly evenly among airport classifications (see Figure 8). Sparse qualitative feedback was provided by the responses to Question 2. One airport indi- cated that it was in the process of implementing an SMS software program that will aid in prompting the SMS Department when risk management should be used. Another airport C H A P T E R 3 Airport Surveys

Airport Surveys 19 indicated that it uses risk assessments, checklists, and computer software to improve pro- cesses; no indications were made as to what type of software programs help identify these prompts or reminders. Question 3: Are your organization’s risk management processes different by department? Airports responded fairly evenly, with 52% indicating No (see Figure 9). There were no comments that directly addressed this question, and the Yes/No answers varied evenly among airport sizes. Question 4: Does your organization promote a confidential non-punitive reporting system(s) that allows employees to: Report hazards and risks, issues, concerns, occurrences, and incidents; and propose solutions and improvements? The average response of the airports surveyed was 4.5, with Always (i.e., 5) as the most common response (see Figure 10). The quantitative responses indicate confidential non- punitive reporting systems are an acceptable and practiced tenet of airport risk management. The first theme identified within the qualitative airport responses centered on airports using low-cost methods, such as a 24/7 phone hotline, an email address, or a suggestion box to report risks. More complex responses, at larger airports, included an online web portal or other automated system within an airport SMS or ERM system. The second theme, throughout the responses, is that airports focused primarily on tools and methods to report Figure 7. Distribution of responses to Question 1 (1 = Never; 5 = Always). Figure 8. Distribution of responses to Question 2 (1 = Never; 5 = Always).

20 Airport Risk Identification and Prioritization Practices risk; there were no responses communicating how personnel could propose solutions or improvements. Question 5: Does your organization’s risk management documentation clearly identify the levels of management with the authority to make decisions regarding risk acceptance for the organization? The average response of the airports surveyed was 3.8, with Always (i.e., 5) as the most com- mon response (see Figure 11). The quantitative responses indicate that documentation is present among a majority of airports. One theme within the qualitative results indicated that either the airport authority, the executive director, or the manager has final authority. A second theme identified that documentation was present for those airports operating with an SMS or ERM program. Question 6: Do your organization’s risk management procedures identify the specific pro- cesses to be used to conduct risk assessment? The average response of the airports surveyed was 3.5, with Always (i.e., 5) as the most common response (see Figure 12); no common theme appears in the responses across airport categories. The qualitative responses varied greatly. The responses expressed that, if used, risk assess- ments were often for a specific job task or an area of need, such as construction, and also varied depending on the topic area, such as financial, operational, reputational, or strategic. Airports that documented risk assessment processes were also part of an airport SMS or ERM. Question 7: Does your organization have a structured process for managing the follow- ing risks? Figure 9. Distribution of responses to Question 3 (0 = No; 1 = Yes). Figure 10. Distribution of responses to Question 4 (1 = Never; 5 = Always).

Airport Surveys 21 The average scores for the 11 risk categories listed in the question, with 1 signifying Never and 5 signifying Always, follow: • Financial 4.3 • Operational 4.4 • Safety 4.3 • Security 4.6 • Info. Tech. 4.0 • Environment 4.1 • Legal/Reputation 4.5 • Sociopolitical 3.7 • Critical Infrastructure 3.9 • Regulatory/Compliance 4.6 • Strategic 4.1 Figure 13 presents the proportion of each response (i.e., 1 = Never to 5 = Always) that airports provided in each topic area. Sectors with the most dark shading overall represent those areas where respondents have the most structured processes for managing risk. The qualitative results of the airport survey are very limited, but the data reflected in Figure 13 provides significant insight to the risk categories that airports are concerned about beyond the “safety” category that is emphasized in SMS. While SMS and ERM principles promote the evaluation of risk in all categories, many of the traditional risk matrix charts provided by the FAA for SMS do not reflect risk categories outside of safety, which primarily considers damage to people or property. Figure 13 shows that more airports have some type of structured process for security, regulation, and financial, legal/reputation, and operational risk than for safety. Figure 11. Distribution of responses to Question 5 (1 = Never; 5 = Always). Figure 12. Distribution of responses to Question 6 (1 = Never; 5 = Always).

22 Airport Risk Identification and Prioritization Practices Question 8: Does your organization require an evaluation of residual risk, prior to risk control implementation? The average response of the airports surveyed was 3.0, with one missing response and “Sometimes” (i.e., 3) as the most common response (see Figure 14). As part of the risk assess- ment process, residual risk is normally identified as the risk that is predicted to remain after the risk mitigation strategies are put into place. The average response reflects one of the lowest positive responses collected—indicating a potential area for improvement. Reviewing the varied qualitative responses revealed no clear themes or indicators regarding what size of airport is consistent in identifying residual risk within its processes. Question 9: Does your organization use a prioritization strategy when mitigating multiple risks? The average response of the airports surveyed was 3.6, with one missing response and “Usually” (i.e., 4) as the most common response (see Figure 15). The quantitative responses validate that not all risk is considered equal and most airports are using some form of prioritization strategy to mitigate multiple risks. Figure 13. Distribution of responses to Question 7 (1 = Never; 5 = Always). Figure 14. Distribution of responses to Question 8 (1 = Never; 5 = Always).

Airport Surveys 23 The first theme identified within the qualitative responses identified airports using team reviews or committees within the airport to prioritize risk. A second theme reflects that airports are in development or are transitioning to an SMS and ERM model, which will require risk prioritization. Question 10: Does your organization require the regular review and report on the system’s safety performance to the airport manager? The average response of the airports surveyed was 4.2, with one missing response and “Always” (i.e., 5) as the most common response (see Figure 16). The average response of “Usually” (4.0) reflects one of the highest level of positive responses, along with the responses for airports reporting risk in Question 4 and a related Question 13. The qualitative results indicate that larger airports use safety performance indicators (SPIs), a procedure which is consistent with ERM and SMS principles. Smaller airports tend to be more organic in that the primary safety risk concerns are handled by the airport manager, or the safety manager briefs the airport manager or an executive committee at the airport. Question 11: Does your organization require the regular review and report on the performance of other non-safety–related risks to the airport manager? The average response of the airports surveyed was 3.5, with one missing response and “Sometimes” (i.e., 3) or “Usually” (i.e., 4) as the most common responses (see Figure 17). In Figure 15. Distribution of responses to Question 9 (1 = Never; 5 = Always). Figure 16. Distribution of responses to Question 10 (1 = Never; 5 = Always).

24 Airport Risk Identification and Prioritization Practices comparison with Question 11, the most common response for safety-related risk was higher than non-safety-related risks. The qualitative results also indicate that larger airports use key performance indicators (KPIs), a process which is consistent with ERM and SMS principles as well. The smaller air- ports tend to have non-safety-related risk concerns that are handled by the airport manager, or the safety manager briefs the airport manager or an executive committee at the airport. Question 12: Does your organization require a process that includes maintaining records of your risk management outcomes for as long as the control(s) remain relevant to the operation? The average response of the airports surveyed was 4.0, with one missing response and “Always” (i.e., 5) as the most common response (see Figure 18). While results indicate records are being maintained by airports, a theme identified in the qualitative responses indicates that airports are still developing their record-keeping processes in relation to risk management. Question 13: Does your organization require a process to develop and maintain a means for communicating risk information to relevant stakeholders? The average response of the airports surveyed was 4.1, with one missing response and “Always” (i.e., 5) as the most common response (see Figure 19). Figure 17. Distribution of responses to Question 11 (1 = Never; 5 = Always). Figure 18. Distribution of responses to Question 12 (1 = Never; 5 = Always).

Airport Surveys 25 The themes within the qualitative responses indicated the importance of communicating to stakeholders and executive personnel. Organizations that have established SMS or ERM have developed processes for communication, such as stakeholder meetings, project meetings, or employee meetings. Other airports gave various responses indicating that they are still develop- ing methods for communicating with stakeholders. Question 14: When your organization has identified hazards or ineffective risk controls, is the risk management process documented and traceable? The average response among the airports surveyed was 3.9, with two missing responses and “Always” (i.e., 5) or “Usually” (i.e., 4) as the most common responses (see Figure 20). One theme within the qualitative responses indicated that airports with ERM and SMS required review of mitigations to ensure completion and to identify whether there were any unintended consequences. The general responses focused more on documenting the hazards or risk than on documenting whether the risk management process was completed through the risk assurance processes. Total responses indicated that the highest mean scores were found in response to “Does your organization promote a confidential non-punitive reporting system(s) that allows employees to: report hazards and risks, issues, concerns, occurrences, and incidents; and propose solu- tions and improvements?”; “Does your organization require a regular review and report on the Figure 19. Distribution of responses to Question 13 (1 = Never; 5 = Always). Figure 20. Distribution of responses to Question 14 (1 = Never; 5 = Always).

26 Airport Risk Identification and Prioritization Practices system’s safety performance to the airport manager?”; and “Does your organization require a process to develop and maintain a means for communicating risk information to relevant stakeholders? Mean total scores from survey respondents for these statements were 4.5, 4.2, and 4.1, respectively. These areas seem to reflect areas of risk management in which respondents are excelling. Airport responses validate the importance of safety reporting and communicating risk to supervisors. Survey responses with the lowest mean scores were found in response to “Does your orga- nization publish specific expectations and procedures for risk identification?”; “Does your organization have prompts or reminders in place that require application of risk management tools or processes?”; and, “Does your organization require an evaluation of residual risk, prior to risk control implementation?” Mean total scores from survey respondents for these statements were 3.4, 3.2, and 3.0, respectively. These areas may indicate potential areas for improvement in the management of risk among respondents.