Airport Risk Identification and Prioritization Practices (2019)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

32 The overall objective of this synthesis is to provide information about the existing tools for identifying common hazards currently found on airports and the processes used for mea­ suring, monitoring, and prioritizing the associated risks at those airports. The report con­ cludes by presenting a summary of the overall conclusions identified throughout this report and presents current gaps and needs identified through the synthesis to help focus further research efforts. The synthesis used interviews and a survey of airports of all sizes to identify the diversity of risk management tools and processes used. The synthesis began with a literature review of current tools and processes used in risk management that includes a historical perspective outlining the development of risk management, examples of existing tools for identifying common hazards, other risk manage­ ment tools available through the FAA and other regulatory agencies, and a brief explanation of SMSs and ERM, which are used by many airports throughout the United States. The aviation industry worldwide has grown in its development of risk management tools and processes. The literature review carried out for this study ascertained that risk manage­ ment tools are available in many forms, are used by many organizations, and can be adjusted and tailored to meet the various needs and complexities of each airport or other risk­ conscious organization. The review also established that both SMS and ERM promote the key tenets of risk management. The survey found that many of the airports surveyed had initially shown interest or taken leadership in risk management by participating in the voluntary SMS pilot programs sponsored by the FAA. The survey instrument, detailed in Appendix A and expanded upon in Chapter 3, was sent to 29 airports. Of those airports that received the survey instrument, 24 submitted responses, for a response rate of 82.8%. The survey results show agreement regarding the practice of risk management through use of risk reporting tools, conveying safety­ and non­safety­related risk concerns to upper manage­ ment and ensuring communication of risk to all stakeholders. Large and medium airports often responded with references to SMS or ERM, suggesting that these airports were in the process of implementing one or the other of these programs. Smaller airports used existing risk management tools or methods to identify or reduce risk. Risk reporting was accomplished by email, answering machines, or a simple suggestion box. Responses also clearly indicated that airports identified risk in areas that extended beyond safety to such risk areas as security, regulation, financial or legal/reputation concerns, and operations. Lastly, regardless of size, most airports had an organizational structure and expectations that fostered the reporting of safety and non­safety performance to supervisors and key stakeholders. C H A P T E R 5 Conclusions and Suggestions for Further Research

Conclusions and Suggestions for Further Research 33 Conversely, survey results indicated several potential areas for improvement. Specifically, • A lack of processes regarding specific expectations and procedures for risk identification, • Not having prompts or reminders in place that require application of risk management tools or processes, and • Not having processes regarding how an organization evaluates residual risk. Further investigation into these areas was conducted during interviews, which further validated the survey findings but also illustrated that various airports have partially addressed these areas to varying degrees. Airports’ responses are inconsistent in areas of risk manage­ ment that require system­wide expectations and processes. Some airports referenced SMS or ERM, which would require these processes to be in place to be properly administered. Interviews were conducted with selected airport personnel, SMS managers, and ERM managers. During these interviews, airport personnel were able to highlight and share specific existing risk management tools and process used (see Appendix C). The interviews also allowed for follow­on questions for deeper exploration into the questions asked on the survey. In total, five airport managers where interviewed for 30 to 45 minutes each. These interviews further complemented the survey results. Large hubs were more mature in their use and implementation of risk management tools. Regardless of whether it was called ERM or SMS, large airports took a more systems approach to risk to include all aspects of their operation on and off field. Large airports not only look at safety in regard to risk manage­ ment, but also consider risk when addressing critical infrastructure, environment, financial, information technology, legal, operational, regulatory, security, sociopolitical, and strategic concerns. As the size and resources of the airport diminished, there was also a decrease in the tools and processes used to accomplish risk management. Smaller airports indicated they relied more heavily on existing low­cost tools, including insurance audits, regulatory audits, and existing FAA guidance such as airport construction advisory circulars. When an airport focused on these conventional tools, the airport was typically using them independent of a larger SMS­ or ERM­type system. The areas for improvement identified within the survey results were also supported by all the interviews. Throughout the interviews, the importance of communication among the various stakeholders was emphasized. Risk management steering or technical committees were often used to keep risk management practical, and committees were used to accept or reject risk for the organization. While risk management tools and processes are available, effectiveness is not determined by a tool or process but instead by how a tool or process “fits” or “works” within the system it is being used in. An expensive software package at one airport may be exceptionally effective for that airport but completely impractical at a small nonprimary airport. The FAA recognizes that risk management is scalable to the operation; as outlined in Advisory Circular 120­92B, one size does not fit all. Use of risk reporting systems is beneficial in identifying risk as well as creating a culture that is comfortable for expressing risk concerns. Risk matrix charts are needed, but airport executives must decide what is considered high risk for their system or airport operations, as reflected in various ERM tools as well as MITRE’s risk matrix tool (Figure 5). Severity and likelihood of risk will differ among organizations; factors that make a risk high will depend on the scope of the system, organizational leadership, and strategic goals. For example, under ERM or an SMS that includes all operations in the system, a failure of a single piece of equipment of $20,000 in value may be a higher risk than a losing an $80,000 vehicle if the

34 Airport Risk Identification and Prioritization Practices airport has only one $20,000 vehicle and it stops operations; therefore, it represents higher risk because of its effect on the organization’s strategic or business goals. Each airport needs tools and processes tailored for its operations. Tailored tools and pro­ cesses create a large gap in providing “standardized” tools and processes for airports. The FAA further encourages tailored tools and processes by focusing on what is needed for SMS, not how to meet the requirements of SMS. An extensive library of tools and processes is developed and readily available for use, but airports are unsure what they are required to do, what they have time to do, and how to keep it practical and beneficial for their operations. While SMS or ERM are not yet required for airports, guidance and risk management training is needed in the areas discovered through the synthesis survey and interviews. Key areas could include, but are not limited to: • Helping airports identify why tools and processes are needed. • Determining how to develop a risk matrix tool for their airport. • Helping identify triggers or prompts for risk management. • Identifying how risk can be both a consequence and an opportunity. • Creating a process that will not create a culture of fear in regard to risk reporting. • Creating risk management objectives that align with strategic business objectives of the organization. • Understanding when a three­ring binder is a better way to track risk reports, reoccurring training, or trends than an expensive software system. • Understanding why an organization must have an accountable executive within the organization. • Determining how to get buy­in from stakeholders independent of the size of the airport. • How to take existing risk management tools and integrate them into a practical SMS or ERM. Airports of similar size and resources can often use many tools and processes developed by other airport personnel to help them get started. The AAAE and ACI­NA have developed a member hub digest that allows members to send messages to other airports to ask questions, share risk management tools and processes, and create a continuous dialogue on best prac­ tices and lessons learned. Outside entities that provide audits, such as insurance companies and OSHA, or Part 139 FAA inspections, already exist and must be brought to bear as risk management tools to help airports. With greater guidance, airports can better understand how these existing tools fit into an SMS or ERM. This guidance will allow airports to explore, learn, and be trained in the practice of risk management implementation within an environ­ ment where similarly sized airports can learn from one another.