What the rules ask for
Every operator and ATO management system includes "the identification of aviation safety hazards entailed by the activities of the operator, their evaluation and the management of associated risks, including taking actions to mitigate the risk and verify their effectiveness" ORO.GEN.200(a)(3), ORA.GEN.200(a)(3), sized to "the size of the operator and the nature and complexity of its activities" ORO.GEN.200(b).
| Who | What the text adds |
|---|---|
| Non-complex operator or ATO | "Safety risk management may be performed using hazard checklists or similar risk management tools or processes, which are integrated into the activities of the operator", and responsibilities for hazard identification, risk assessment and mitigation should be identified AMC1 ORO.GEN.200(a)(1);(2);(3);(5) (a) and (d). ATOs: the same words in AMC1 ORA.GEN.200(a)(1);(2);(3);(5). |
| Complex operator or ATO | A formal process covering "analysis (in terms of likelihood and severity of occurrence), assessment (in terms of tolerability) and control (in terms of mitigation) of risks to an acceptable level", and the management levels allowed to decide on tolerability are specified AMC1 ORO.GEN.200(a)(3)(b). |
| SPO operator | "Before commencing a specialised operation, the operator shall conduct a risk assessment", and the SOPs are based on it SPO.OP.230(a), (b). GM1 SPO.OP.230 gives template forms: a risk assessment, a hazard identification, mitigating measures and a risk register. |
| ATO for LAPL, PPL, SPL or BPL only | Safety risk management and compliance monitoring "may be accomplished by an organisational review, to be performed at least once every calendar year", with the results sent to the authority ORA.GEN.200(c). |
| DTO | The safety policy defines "the means and methods used for: (1) hazard identification; (2) risk assessment; and (3) effectiveness of the mitigation measures" AMC1 DTO.GEN.210(a)(1)(ii), and the annual internal review assesses the effectiveness of the mitigation measures AMC1 DTO.GEN.270(a)(i). For occurrences, the guidance asks for risks analysed "in terms of probability and severity of the outcome" and assessed "in terms of tolerability" GM1 DTO.GEN.210(a)(1)(i). |
Changes go through the same process: management of change "should make use of the operator's existing hazard identification, risk assessment and mitigation processes" AMC1 ORO.GEN.200(a)(1);(2);(3);(5)(b). See management of change at a small operator.
Hazard, outcome, risk
- Hazard: "a situation or an object with the potential to cause death or injury to a person, damage to equipment or a structure, loss of material, or a reduction of ability to perform a prescribed function" Reg 376/2014 Art 2(10). Write it as a condition: "birds on and around runway 27 in autumn", not "bird strike".
- Outcome: what could happen because of it, the "incident sequence" in the EASA example register: "bird strike in the climb, engine failure at low height, forced landing".
- Risk: how likely that outcome is and how bad it would be, judged for tolerability: can you live with it, with or without more mitigation?
Five steps
- Find the hazards. Look in your occurrence reports, audit findings, planned changes, contractor arrangements and seasonal operations, and ask the people who fly and instruct. The AMC for complex operators asks every reporting system to include "an effective feedback process" AMC1 ORO.GEN.200(a)(3)(a)(2); small ones gain just as much from telling people what was done with what they raised.
- Describe the outcome you worry about, and the controls already in place.
- Rate likelihood and severity with today's controls, using one matrix for the whole organisation.
- Decide and mitigate. Intolerable: stop or change the activity. Tolerable: add mitigation, each action with an owner and a date, rate the risk again, and have the named person accept what remains.
- Check it worked. The rule asks you to "verify their effectiveness". Set a review date, and review the hazard whenever an occurrence, audit or change touches it.
An example risk matrix
Our example, laid out in the 5 by 5 likelihood and severity style used in ICAO's Safety Management Manual (Doc 9859). The rules do not prescribe a matrix. Adapt the definitions to your operation, and check what your authority expects.
| Likelihood / Severity | A Catastrophic | B Hazardous | C Major | D Minor | E Negligible |
|---|---|---|---|---|---|
| 5 Frequent | Intolerable | Intolerable | Intolerable | Tolerable | Tolerable |
| 4 Occasional | Intolerable | Intolerable | Tolerable | Tolerable | Tolerable |
| 3 Remote | Intolerable | Tolerable | Tolerable | Tolerable | Acceptable |
| 2 Improbable | Tolerable | Tolerable | Tolerable | Acceptable | Acceptable |
| 1 Extremely improbable | Tolerable | Acceptable | Acceptable | Acceptable | Acceptable |
- Severity. A: aircraft destroyed, deaths. B: serious injury, major damage, a large reduction in safety margins. C: a serious incident, injury, a significant reduction in safety margins. D: an incident, operating limitations, use of emergency procedures. E: little or no effect on safety.
- Likelihood. 5: has happened often in our operation. 4: has happened in our operation. 3: has happened at least once here or at similar operators. 2: not known at operators like us. 1: almost inconceivable.
- Who accepts. Intolerable: nobody, change the activity. Tolerable: the accountable manager, with mitigation in place. Acceptable: the safety manager records it. For complex organisations the AMC asks you to specify these levels AMC1 ORO.GEN.200(a)(3)(b)(2); writing them down helps a small one too.
Matrix layout: SKYbrary, Risk Assessment, which describes the ICAO Doc 9859 approach. The cell values and definitions above are ours.
A worked example
Illustrative only: a small ATO flying single-engine trainers from a grass airfield.
| Column | Example |
|---|---|
| Hazard | Large flocks of birds on and around the field in autumn, most at dawn and dusk. |
| Outcome | Bird strike in the climb after take-off, engine failure at low height, forced landing off the field with a student on board. |
| Existing controls | Pre-flight look at the field; instructors know the season. |
| Risk before | 4B: occasional (two near misses reported last autumn), hazardous. Intolerable. |
| Additional mitigation | No solo flights in the first and last hour of daylight from September to November; a runway inspection before the first flight of the day; bird activity added to the daily briefing; a new item on the hazard report form. Owner: head of training, by 1 September. |
| Risk after | 2B: improbable, hazardous. Tolerable, accepted by the accountable manager. |
| Monitoring and review | Count bird reports each month in autumn; review in December and after any strike or near miss. |
Free hazard log and risk register
The template follows the columns of the EASA example risk register GM3 ORO.GEN.200(a)(3): hazard, incident sequence, existing controls, likelihood, severity and risk before and after mitigation, actions and owners, monitoring and review. The Excel version works out the risk and its tolerability from the matrix sheet, which you can change, and marks review dates that have passed. The Word version prints ten hazards per page with the matrix on page two. SPO operators can use it as the risk register in GM1 SPO.OP.230.
Hazard log (Excel) Hazard log (Word)
What the inspector looks for
- A list of hazards that matches what you actually do: your aircraft, your aerodromes, your season, your contractors. A generic list copied from elsewhere stands out.
- Hazards that come from your own reports and findings, not only from mandatory occurrences. For complex operators the AMC says internal safety investigations "should extend beyond the scope of occurrences required to be reported" AMC1 ORO.GEN.200(a)(3)(c).
- Every mitigation with an owner and a date, and evidence it was done.
- A named person who accepted each remaining risk, and a date when it was last reviewed.
- Your management system documentation describing the process you actually use ORO.GEN.200(a)(5).
Sources: EASA Easy Access Rules for Air Operations (March 2026: ORO.GEN.200, AMC1 ORO.GEN.200(a)(1);(2);(3);(5), AMC1 and GM3 ORO.GEN.200(a)(3), SPO.OP.230 and GM1), Easy Access Rules for Aircrew (October 2026: ORA.GEN.200, AMC1 ORA.GEN.200(a)(1);(2);(3);(5), AMC1 and GM1 DTO.GEN.210(a)(1), AMC1 DTO.GEN.270(a)), Regulation (EU) 376/2014 (Art 2(10)), SKYbrary, Risk Assessment. Rule text checked 31 October 2026; where this guide and the Official Journal differ, the Official Journal text prevails.
Questions we hear
Does a small operator need a risk matrix?
The rule asks you to identify hazards, evaluate and manage the risks, mitigate and verify ORO.GEN.200(a)(3). For non-complex organisations the AMC allows "hazard checklists or similar risk management tools". A matrix is the most common tool, not a requirement.
How many hazards should a small operator have?
No number is set. A two-aircraft operator or a small school often starts with ten to twenty real ones, and adds more from reports, audits and changes. Fewer, specific hazards that are reviewed beat a long generic list.
Is the occurrence risk class the same as the hazard log?
No. Classifying an occurrence looks back at one event. The hazard log looks forward at what could happen again, and an occurrence is one of the best ways to find a hazard you had not listed. Folvan keeps the first; the template above keeps the second.
How often should the log be reviewed?
The rules set no interval. Review a hazard when an occurrence, audit or change touches it, and the whole log at least once a year. A DTO's annual internal review already has to assess the effectiveness of its mitigation measures AMC1 DTO.GEN.270(a)(i).