The Aviation Risk Matrix Under EASA: Calibrating Likelihood and Severity

Entry 14 in ExampleMRO's hazard log: fan cowl latches left unfastened after maintenance, four times in 12 months. Three were caught at the crew walkround, one after a sector. The quality manager scored it 4B. Two weeks later the safety manager scored the same entry 2B. No control had changed. Under their matrix, 4B was intolerable: stop and fix. 2B was tolerable: accept it and set a review date.

An aviation risk matrix crosses two scores. Likelihood is how often you expect an outcome. Severity is how bad that outcome is. The cell where they meet, 4B or 2B, sits in a tolerability band: acceptable, tolerable or intolerable. EASA does not issue the matrix. The acceptable means of compliance (AMC) to the Part-145 and Part-CAMO management-system rules, and the Air Ops AMC for complex operators, ask you to analyse risk, in terms such as probability or likelihood and severity, assess it for tolerability, control it, and specify which levels of management decide on tolerability. Many organisations start from the ICAO Doc 9859 5×5 and calibrate it. The two scores above came apart in the calibration.

Does EASA require a specific risk matrix?

No. This is the Part-145 text:

AMC1 145.A.200(a)(3) · Easy Access Rules for Continuing Airworthiness · 2 September 2025 revision

(1) A formal safety risk management process should be developed and maintained that ensures reactive, proactive and predictive approach composed by:

(i) analysis (e.g. in terms of the probability and severity of the consequences of hazards and occurrences);

(ii) assessment (in terms of tolerability);

(iii) control (in terms of mitigation) of risks to an acceptable level.

[…]

(2) The levels of management who have the authority to make decisions regarding the tolerability of safety risks, in accordance with (b)(1)(ii), should be specified.

The CAMO version, AMC1 CAMO.A.200(a)(3), uses the same three steps. The Air Ops AMC for complex operators, AMC1 ORO.GEN.200(a)(3), asks for "analysis (in terms of likelihood and severity of occurrence), assessment (in terms of tolerability) and control (in terms of mitigation) of risks to an acceptable level." Probability in one, likelihood in the other: same axis. The Part-145 and CAMO text offers even that only as an example ("e.g.").

None of them contains a matrix. A search of the Avioverse regulation library (EASA Easy Access Rules with AMC and GM) on 25 September 2026 found no risk matrix, level count or band map in the Part-145, Part-CAMO or Air Ops management-system provisions. Other rule books mention a matrix for other purposes, such as authority change reviews (ATM/ANS) or information-security risk (Part-IS). Two address an organisation's safety risk matrix directly:

• Aerodromes. GM1 ADR.OR.D.005(b)(4): "Safety risk decision making and acceptance should be specified through a risk tolerability matrix. The definition and final construction of the matrix should be left to the operator to design, be documented in the aerodrome manual, and be subject to an approval by the Competent Authority."
• Ground handling. GM1 ORGH.MGM.200(b)(2) reprints the ICAO matrices and says the organisation "may use other models to assess and manage the safety risk". The regulation it supports does not apply until 27 March 2028.

EASA's user guides for writing a CAME and a foreign Part-145 exposition put it plainly: "Regardless of the method used (ICAO safety risk matrix, ARMS, BOW-TIE, etc.), it is important to customize the risk assessment matrix so as to reflect the operational profile."

So three decisions are yours, for your SMS manual or exposition: what each likelihood and severity level means, which band each cell falls in, and who may accept each band. The hazard identification and safety risk management guide covers the surrounding rules.

What the two axes measure

Severity belongs to an outcome, not a hazard. "Fan cowl latches can be left open" is the hazard. "The cowl separates on take-off and damages the aircraft" is an outcome you can score. The Part-145 AMC adds that severity "should be evaluated to the best knowledge and engineering judgement of the organisation".

Outcomes range from the usual (the crew spot the latch, the flight leaves late) to the worst imaginable. Pick one point on that range and write it into your manual. A defensible default is the worst credible outcome: the worst that could reasonably happen given what you know.

Likelihood is how often you expect that same outcome, with today's controls. Not how often the hazard exists or a precursor turns up. Precursor counts are evidence for the judgement, not the score.

Calibrating likelihood with rates you already record

"Occasional" means nothing until it is tied to a count. Use a denominator you already record: work orders or task cards in maintenance, flight hours or aircraft-years in continuing airworthiness, cycles or sectors in flight operations. Make each level about ten times the one below. This calibration is illustrative; set yours from your own volume.

The lower levels switch from rates to history on purpose. One MRO cannot count its way to once in fifty years, and pretending otherwise produces more decimals than evidence.

The same denominators feed your safety performance indicators, which tell you next year whether the controls worked. The SPI worked example sets those up.

Calibrating severity with examples from your own work

Generic definitions help only once each department pins them to its own events. ExampleMRO and ExampleAir keep one per level:

Severity describes what happens to the aircraft and the people, not which rule was broken: "AMP task overdue" is a finding, and its severity is whatever the task protects against. Preventive controls change how often an outcome happens, not how bad it is.

Tolerability bands, and who may accept what

This is the ICAO Doc 9859 default, as Avioverse ships it. EASA's ground-handling GM reprints the same banding.

No severity-A cell is acceptable: a catastrophic outcome is either intolerable or needs a named person to accept it, however unlikely. No row-5 cell is acceptable either. And the middle band is the largest, 12 of 25 cells, so a register drifts amber easily.

The band says what must happen, not who decides. The AMC asks for those levels of management to be specified and leaves the choice to you. ExampleAir's SMS manual sets it out like this:

ExampleMRO uses the same scheme.

Worked example: three hazards, before and after mitigation

1. ExampleAir flight operations: cabin service in forecast turbulence

• Outcome scored: a cabin crew member seriously injured during the service. Severity B.
• Evidence: two serious cabin crew injuries on one route in 12 months, both during the service, plus nine minor injury reports. Twice a year is 4, Occasional.
• Before: 4B, intolerable. Nobody may accept it. That week, ExampleAir suspended the service on the route whenever turbulence was forecast.
• Controls: turbulence forecast in every cabin briefing; service only when the flight crew confirm; crew seated with the seat-belt sign; cabin injuries per 1,000 sectors reviewed monthly.
• After: 3B, tolerable (forecast). Severity stays B. The accountable manager accepts it, with a six-month review.

2. ExampleAir continuing airworthiness: LLP data keyed in by hand

• Hazard: life-limited part (LLP) status for two leased aircraft is typed into the planning system from back-to-birth records.
• Outcome scored: a part flown past its life limit fails in service; uncontained engine failure. Severity A.
• Evidence: at the last induction, a check of 400 LLP lines found three keying errors, all caught at the records audit. A part flown past its limit has never happened at ExampleAir; industry experience says it can. 2, Improbable.
• Before: 2A, tolerable.
• Controls: a second person checks every LLP line against the source records and the type certificate holder's current limits before entry into service.
• After: 1A, still tolerable (forecast). The index moved; the band did not, because no A cell is acceptable. The accountable manager still accepts it.

3. ExampleMRO line stores: expired consumables

• Outcome scored: an expired sealant is applied and the work redone, or at worst a seep is found at the next check. Severity D.
• Evidence: expired items on the shelf at three of four quarterly stores checks; twice in 12 months an expired sealant was applied and caught at the task card review. 4, Occasional.
• Before: 4D, tolerable.
• Controls: shelf-life date mandatory at goods-in; the stores system blocks issue of an expired batch; monthly quarantine sweep.
• After: 2D, acceptable (forecast). The line maintenance manager records it as hazard owner.

Every "after" score stays a forecast until the controls are in place and the numbers confirm it. The Air Ops guidance GM3 ORO.GEN.200(a)(3) shows an example risk register with severity, likelihood and risk before and after mitigation. For the controls themselves, see the bow-tie worked example.

Five scoring mistakes to design out

Pairing numbers from different outcomes. Back to entry 14. The quality manager took likelihood from the latch count, four a year, and severity from a cowl separating. The safety manager took it from cowl separations at ExampleMRO, none, and set aside the aircraft that flew a sector unlatched. ExampleMRO's manual now fixes the convention: worst credible outcome, likelihood of that outcome, precursor counts as evidence. No cowl has separated at ExampleMRO, but an aircraft has flown a sector unlatched: a precursor that reached service, which is level 3 in its table. Entry 14 was re-scored 3B, tolerable, for the accountable manager to accept.

False precision. Likelihood and severity are ranks, not quantities. A 4 is not twice a 2, and 3 × 4 = 12 ranks nothing; letters for severity help, since nobody multiplies 3 by C. Do not average two assessors' scores either. If they disagree, fix the definitions.

A matrix that makes everything amber. If most of your register is tolerable, each entry needs a manager's acceptance and acceptance becomes routine. Before moving a band, check the likelihood definitions: assessors without a rate to anchor them drift to 3.

Re-banding without recording why. Moving one cell re-bands every assessment scored in it. Treat it as a change to your management system: record the date, the reason, who decided, and which open assessments need re-acceptance.

Crediting controls you have only planned. The "before" score counts controls that exist today. One on order, in draft or still being trained belongs in the forecast.

Keeping the matrix in Avioverse

In Avioverse the matrix is the Matrix tab of Risks, headed Workspace risk matrix: a fixed 5×5 of probability 1 to 5 (Extremely improbable to Frequent) against severity A to E (Catastrophic to Negligible). It starts from the ICAO Doc 9859 bands, acceptable, tolerable and intolerable, in green, yellow and red.

• Re-band and recolour. Click a cell to cycle its tolerability, choose each band's colour from six presets, then Save matrix. Reset to ICAO default restores the preset.
• Who can edit. In a team workspace: "Only workspace owners and admins can edit."
• One matrix per workspace. Every bow-tie assessment in the workspace takes its bands from it, for Current risk and the Residual risk forecast. Current risk credits only existing and in-place controls; planned controls count only toward the forecast.
• The band is looked up, not typed. Tolerability always comes from the workspace matrix, including on a first draft from Draft with Metis.
• Re-banding reaches saved work. "Scores update from this matrix without rewriting saved assessments." Record the reason for any change in your manual.

The limits, in one place. You cannot resize the matrix or rename its axes. The ICAO default is a preset, not an authority-approved matrix, and the severity table on the same tab says to "use your organisation’s approved criteria", so your calibrated definitions stay in your manual. Finalise records who finalised an assessment and when. It is not a second person's approval or risk acceptance, which stays with the level of management your manual names. For bow-tie starting points by hazard, open the SMS hazard library.