Aviation Risk Matrix Explained: Severity, Probability, Tolerability

Every risk rating in a safety management system rests on two independent judgements, and the matrix exists to combine them. The first axis is severity: if this goes wrong, how bad is the worst credible outcome? Not the worst imaginable outcome (almost anything can be escalated to a fatal accident with enough bad luck) but the worst outcome that could reasonably follow. Assess the consequence, not the hazard: a contaminated runway is a condition, a runway excursion is the outcome you rate. ICAO Doc 9859 sets out five severity levels, most to least serious:

• Catastrophic: multiple fatalities, hull loss, equipment destroyed.
• Hazardous: a large reduction in safety margins, serious injury, major equipment damage, workload so high the crew cannot be relied on to complete tasks.
• Major: a significant reduction in safety margins, a serious incident, injury to occupants.
• Minor: nuisance, operating limitations, use of emergency procedures, a minor incident.
• Negligible: little or no effect on safety.

The second axis is probability: how likely is that outcome, given the controls in place today and the operation's exposure? Five levels again, most to least likely:

• Frequent: likely to occur many times, has occurred frequently.
• Occasional: likely to occur sometimes, has occurred infrequently.
• Remote: unlikely to occur but possible, has occurred rarely.
• Improbable: very unlikely, not known to have occurred.
• Extremely improbable: almost inconceivable that the event will occur.

The scales are deliberately worded, not numeric guesses. “Occasional” has a definition (likely to occur sometimes, has occurred infrequently in the operation), and the assessor is meant to justify the choice against that definition and the evidence, not pick a number that feels right. A common labelling uses letters for severity (A for catastrophic through E for negligible) and digits for probability (5 frequent through 1 extremely improbable), so a rating reads as a compact code such as 4B or 2D, the row and column that locate the cell.

The cell where the chosen severity meets the chosen probability is the risk index. On its own that index means little until you overlay the second half of the framework: the tolerability regions that say what to do about it. ICAO describes three, and most operators colour them:

• Intolerable (red): the risk is unacceptable as it stands. The operation stops, or does not start, until the risk is brought down. You cannot buy your way to acceptance with paperwork, something real has to change the severity or the probability.
• Tolerable (amber): the risk is acceptable only after mitigation, and only once it has been driven as low as reasonably practicable. This is the working zone of most safety management: controls are added, the residual risk is re-assessed, and the reasoning is recorded.
• Acceptable (green): the risk is acceptable as it stands. It is not ignored, it is monitored, because exposure and controls drift over time and a green today can move.

Two points operators miss. First, the exact boundary between the regions is set by the organisation in its own SMS. ICAO gives the shape of the grid, not the cut lines, so a 3C might sit in amber for one operator and in the intolerable region for another with a lower risk appetite. That is a governance decision, made once and applied consistently, not a per-record negotiation. Second, the colours are a convention, not a law of physics. The discipline lives in the definitions behind them, not in the shade of the cell, which is exactly why a matrix built on hand-picked colours is so easy to quietly bend. See the glossary entry for the risk matrix for the compact version.

A risk rating is a claim, and a claim has to be defensible. “It's a 4B” is worthless without the two sentences that justify it: why that is the worst credible severity, and why that is the right probability given the operation's history and exposure. The assessment is where Safety Risk Management, the second component of an SMS, actually lives, and it is what an auditor or an accountable manager will push on.

A defensible severity rating names the worst credible outcome and says why it stops there rather than escalating to the top of the scale. A defensible probability rating points at something real: the occurrence history for this hazard, the exposure (sectors, cycles, movements) that drives frequency, and the barriers already in place that hold the likelihood down. A rating argued by a group, a Safety Action Group looking at the same evidence, is far more defensible than a single manager choosing a colour from a dropdown under deadline pressure.

This is where the tooling either helps or hides the problem. A tool that derives the region from the assessed cell, rather than letting anyone paint a colour by hand, makes the rating reproducible: the same severity and probability always produce the same index and the same region. Keep the reasoning with the record, too, instead of in a meeting nobody minuted.

The most common way a risk matrix stops working is severity inflation: rating almost every hazard at or near the top of the severity scale, on the reasoning that anything could theoretically end in a fatal accident. When everything is catastrophic, the matrix loses the one thing it exists to provide, separation between risks, so the operator can put barriers on the worst first. An inflated register reads as a wall of red that no one can prioritise, and it trains people to ignore the colour entirely.

The opposite failure is quieter and more dangerous:

• Optimistic probability, nudging the likelihood down a level so a rating lands in green and the record can be closed without doing anything.
• Rating the hazard, not the consequence, scoring the severity of the condition (a contaminated runway) instead of the outcome it could produce (a runway excursion), which muddles every downstream decision.
• Re-scoring to close, adjusting the numbers after the fact so a stubborn record clears whatever gate is holding it open, which is exactly the drift a risk matrix is supposed to prevent.
• Colour without reasoning, a green cell with no recorded worst-credible-outcome argument and no probability evidence, which means “a person said so,” not “the evidence shows so.”

Every one of these is a symptom of a matrix that can be edited by hand. When the region is derived from the assessed cell and the argument is written down beside it, an inflated or optimistic rating shows as a mismatch between the argument and the number, not a colour someone chose. And a closure gate should read the derived level, not a status field, so a rating cannot be quietly re-scored to escape it.

The single most useful thing to remember about a risk matrix is that it does not make the decision, it structures it. The cell is an input. The decision is what you do next, and it is one of three things: accept the risk and monitor it, mitigate it and re-assess, or escalate and stop until it is brought down. The matrix makes that conversation honest by forcing severity and probability to be named separately and defended, but a human, and above an intolerable line a governance body, still owns the call.

Used well, the rating then feeds the rest of the system rather than ending on the form. It prioritises which hazards get barriers first. It sets which indicators are worth watching in the safety performance library. And it feeds the computed Safety Risk Profile, which in eAviora fuses seven named components into one banded score per risk theme, shown beside its worst ICAO risk level. In other words, one well-argued cell is not a dead end, it is a node in an operational graph that connects the hazard to its barriers, its indicators and the corrective actions that keep it in check.