The Nimrod Review - Official Documents

The Nimrod Review
Risk Assessment
9.80
186
As regards risk assessment, the SMP provided that this would be made on the basis of the potential severity of the
accident and the probability of the hazard condition occurring. It was specifically stated that such quantification
“must support, not replace, sound judgment” and that “probabilities must not be ‘tweaked’ to artificially move
hazards or accidents into a more favourable category” 111 . Where the indications were borderline, “the more
stringent criteria should always be applied to ensure appropriate management action is taken”. 112 As explained
above, risk assessment within the IPT was to be undertaken by Nim(ES)Av and the ASR, with endorsement of
risks above Category C by the PE/IPTL and the PSWG. Risk assessment undertaken by contractors and external
agencies was similarly to be subject to review by the PE/IPTL. 113 Ultimately, the overall safety argument was to
be documented in a Safety Case Report and a Safety Statement certificate was to be issued by the PE/IPTL to
the RTSA that the aircraft was tolerably safe. 114
Risk Classification
9.81
Appendix 1 to Annex C of the SMP set out accident, hazard and risk criteria. In terms of risk classification, the
A, B, C & D categories, in terms of broad bands of acceptability, corresponded to the following Def-Stan 00-56
classifications: 115
9.81.1 “Intolerable risk”: Required urgent action, including reporting in accordance with Chief Engineers
Notice 44.
9.81.2 “Undesirable risk”: Required management action and was only to be accepted by the PE/IPTL and PSWG
when risk reduction was impracticable.
9.81.3 “Tolerable risk”: Could be accepted with the endorsement of Nim(ES)AV/ASR.
9.81.4 “Broadly acceptable risk”: Could be accepted with the endorsement of the normal project reviews.
ALARP principle
9.82
9.83
Audit
9.84
The SMP also adopted the ALARP principle, stating that its achievement required an evaluation (qualitative
or quantitative) of the net risk, against a clear view of the cost of any risk reduction measure, in terms of
money, time, physical difficulty, operational imperative and availability. 116 In accordance with the HSE guidance
(see above), the standard was that the expense must be “grossly disproportionate” to the risk for an ALARP
decision to be justified. 117 As part of the SMS, ALARP decisions would be documented to record the basis of
‘reasonableness’ and together with supporting evidence, and would be retained to form an audit trail. 118
As I explain later, it is a matter of concern to me that the ALARP principle appears not to be properly understood
by many, including QinetiQ. It is the ‘R’ in ALARP that is important. The notion of ALARP is founded on the
important principle of proportionality.
As to audit, the SMP provided very clearly that the SMS was to be subject to assurance and audit processes to
provide evidence that equipment safety was being properly managed. Indeed, an audit regime was said to be
“an essential feature of the SMP”. 119 The IPT was to carry out a rolling audit over each 12 month period and
the IPT SMS was itself to be audited once every 12 months, by one of the following organisations in rotation:
111 Ibid, Annex C, paragraph 27.
112 Ibid, Annex C, paragraph 27.
113 Ibid, Appendix 3 to Annex C, paragraph 5.
114 Ibid, paragraph 58.
115 Ibid, Appendix 1 to Annex C, para 13.
116 Ibid, paragraph 19.
117 Ibid, Reference P.
118 Ibid, paragraph 20.
119 Ibid, Annex D, paragraph 1.