Hazard Identification and Safety Risk Management under EASA, with a Worked Risk Register

Report 26-114: the cowls were open

Internal report 26-114, ExampleMRO line station: "Fan cowls on engine 2 of XX-EXA found unlatched at the walk-round. Opening them was on the handover sheet. Closing them was not." Nobody was hurt. The aircraft never left the stand.

The report is not the hazard. The hazard is the condition behind it: a task split across a shift change, with opened panels recorded only on an unsigned sheet. Finding conditions like that, judging how bad they could get, changing something and checking that the change works: that is hazard identification and safety risk management.

Under EASA it is point (a)(3) of the management system in 145.A.200 (maintenance organisations), CAMO.A.200 (CAMOs) and ORO.GEN.200 (air operators). The AMC adds a formal reporting scheme for hazards, a three-step risk process (analysis, assessment of tolerability, control to an acceptable level) and specified management levels who decide tolerability. None of these texts prescribes a bow-tie or a risk matrix.

Key facts

• 145.A.200(a)(3), CAMO.A.200(a)(3) and ORO.GEN.200(a)(3) require hazard identification, evaluation and risk management, "including taking actions to mitigate" and to "verify their effectiveness".
• Regulation (EU) No 376/2014 defines a hazard as "a situation or an object with the potential to cause death or injury to a person, damage to equipment or a structure, loss of material, or a reduction of ability to perform a prescribed function".
• The AMC's risk process is analysis, assessment "(in terms of tolerability)" and control "(in terms of mitigation) of risks to an acceptable level".
• The levels of management who decide tolerability "should be specified". The AMC names no post.
• A risk register is guidance: GM3 ORO.GEN.200(a)(3) says results "may be recorded" in one.
• No rule, AMC or GM quoted here names a bow-tie or a risk matrix.

What the rules require

Three approvals, one duty. The full texts are on the 145.A.200, CAMO.A.200 and ORO.GEN.200 rule pages.

What counts as a hazard

The management-system rules do not define the word. The GM definitions for Part-145 and Part-CAMO do: a hazard "is a condition or an object with the potential to cause or contribute to an aircraft incident or accident" (GM1 to Annex II (Part-145) Definitions). The occurrence reporting regulation's longer definition makes a good test for a register entry.

A condition, situation or object: not an outcome, and not a person. Most weak entries fail that test (Article 2 in full).

What the AMC adds: a reporting scheme and a three-step risk process

The Air Ops (a)(1) above is the version applicable until 31 December 2027, in force on 25 September 2026. Its replacement from 1 January 2028 adds that these schemes should include the flight data monitoring programme where one is required.

The Part-CAMO AMC follows the Part-145 structure. Where the wording differs:

The severity note is the line people skip: before scoring severity, look at what the competent authority, investigation reports and the design approval holder already know. The AMCs are on their rule pages: AMC1 145.A.200(a)(3), AMC1 CAMO.A.200(a)(3) and AMC1 ORO.GEN.200(a)(3).

Where hazards come from: reactive, proactive and predictive

Of the three AMCs, only the Part-145 one uses all three words, and none defines them. In common use, reactive learns from what already happened, proactive looks for hazards before an event, and predictive watches data for a hazard starting to show.

The reactive stream has a rule behind it. Under 145.A.202, internal reports go straight into safety risk management:

Report 26-114 is exactly this: an internal hazard report that never became a reportable occurrence, and still enters the risk process. CAMO.A.202 sets up the same scheme for a CAMO. Occurrence analysis under Regulation (EU) No 376/2014 is quoted in Occurrence Analysis and Follow-up in the SMS.

Sources behind the worked entries below:

For contracted work, the GM sets out what to assess:

Those five elements make a checklist for any new contract; H-02 came from item (2). The same five elements appear in GM1 CAMO.A.200(a)(3) and GM4 ORO.GEN.200(a)(3); the Part-145 GM is on the 145.A.200 page.

The method is yours: no bow-tie or matrix in the rules

Nothing in 145.A.200, CAMO.A.200, ORO.GEN.200 or the AMC and GM quoted here names a bow-tie, a risk matrix or a scoring scale; the tool is the organisation's choice. For non-complex air operators, AMC1 ORO.GEN.200(a)(1);(2);(3);(5) says so outright: "Safety risk management may be performed using hazard checklists or similar risk management tools or processes, which are integrated into the activities of the operator." EASA's user guides for the Part-145 and Part-CAMO approvals it issues mention methods by name ("ICAO safety risk matrix, ARMS, BOW-TIE, etc."), but a user guide is not rule text.

Two tools are common. A bow-tie maps threats, barriers and consequences around one top event; Bow-tie risk assessment in aviation builds one for a maintenance hazard. A matrix turns probability and severity into a band; the aviation risk matrix covers the definitions. The public SMS hazard library groups bow-tie starting points by SMS domain.

Who decides that a risk is acceptable

Both quoted AMCs end their risk paragraph the same way: the levels of management who decide on tolerability "should be specified". Neither names a post or committee. 145.A.200(a)(1) gives the accountable manager "a direct safety accountability", and a common arrangement routes the highest band to that post. The allocation is yours to write.

This is ExampleMRO's allocation, not EASA's:

Record the decision on the row, with a name and a date. A register of scores without decisions shows analysis without assessment.

A hazard log and risk register template you can use

Many organisations call this list a hazard log; the Air Ops guidance calls it a risk register. It is the same working list: each hazard, its assessment, its mitigation and who owns it. Only the Air Ops guidance quoted here gives an example register.

The example is a blank table (GM3 on the ORO.GEN.200 page); approved training organisations get the same one in GM4 ORA.GEN.200(a)(3). The Part-145 and Part-CAMO AMC and GM have no register example, so a maintenance organisation or CAMO can borrow this one:

Worth adding: the source (report, finding or change), the date identified, and the tolerability decision.

Six worked entries

Scores use probability 1 (extremely improbable) to 5 (frequent) and severity A (catastrophic) to E (negligible), banded with the ICAO default. They are the fictional organisations' judgements, not reference values.

In every entry the mitigation lowers likelihood; severity does not move. Most rows stay tolerable, so most need a decision from the level your procedure names. The intolerable row, H-05, does not wait for a review meeting.

From mitigation to monitoring

The clause a register most easily leaves undone is "verify their effectiveness". The Part-145 AMC places that check in safety performance monitoring and continuous improvement:

Every row whose post-mitigation score depends on a new control gets one indicator that would move if the control failed: the last column above. When it moves the wrong way, the row goes back to assessment; either the forecast was wrong or the control is not in place. Put the same controls into the audit programme so someone checks them on purpose.

Choosing indicators like these, and reviewing them, is covered in part 1 of this series, EASA Safety Performance Indicators: What the Rules Say. Setting targets and alert levels has its own worked example.

Keeping the register in Avioverse

In Avioverse the register lives in Risks: My assessments, a read-only Hazard library to start from, and the workspace Matrix. From New assessment, choose Create manually or Draft with Metis.

One assessment can hold several bow-ties (Add bow-tie), one per top event. Each shows a Current risk, which credits only controls that exist or are in place, and a Residual risk forecast, which adds the planned ones. That is the GM3 pre- and post-mitigation split, with the second figure labelled as a forecast.

Scores come from the workspace risk matrix: a fixed 5×5 with ICAO default bands. Workspace owners and admins can re-band cells and change colours, or use Reset to ICAO default. The default is a preset, not an authority-approved matrix, and editing it later changes the band shown on saved assessments.

Saving keeps a Draft. Finalise records who finalised it and when, with an optional next-review date. It is not a second person's approval and not organisational risk acceptance; that stays with the level your procedure names.

Create task turns a recommendation into a task. A finished task does not lower the risk: the assessment asks you to confirm the barrier (In place & effective or Not effective — reopen task), then offers Adopt residual risk once every planned barrier on a bow-tie is in place.

An audit finding's risk decision is Create new, Link existing or No risk assessment with a written rationale; the finding cannot close without a finalised linked assessment or that rationale. Draft with Metis drafts bow-ties and saves a draft when you ask. It cannot finalise.

The PDF export includes the change history. Avioverse is your working register, not your organisation's SMS record.