The Computed Safety Risk Profile: A Seven-Component Answer to “Are We Getting Safer?”

Every board meeting reaches the same moment. The accountable manager is asked, in plain words, “are we getting safer?” The honest answer lives in dozens of indicators, hundreds of occurrences, a register of hazards and a backlog of corrective actions. Nobody at the table reads all of that. They need one read per risk theme that they can trust and then interrogate.

That is the job of a Safety Risk Profile (SRP): a single score per theme that compresses the operation’s real state into one number the board can act on. The danger with any single number is that it hides more than it reveals, a green tile can sit comfortably over a worsening trend, a degraded barrier or a stalled corrective action. So the score is only useful if two things are true: it is computed from the records, and you can open it to see why it reads the way it does.

A coloured tile that someone updates by hand each quarter fails both tests. It is an opinion frozen in time, with no math underneath and nothing to drill into. A computed Safety Risk Profile is the opposite: it fuses seven components read from the records, sits beside the worst ICAO risk level in scope, shows the math, and lets the board walk from the number down to the evidence. One number on the surface; a connected operation underneath.

The Safety Risk Profile score is not a single measurement. It is a fusion of seven components, each answering a different question about the same risk theme. Read together, they describe not just how risky a theme is, but how much you can trust that reading.

• Base risk. The underlying assessed risk of the theme, the starting point before recent movement, controls or evidence are weighed in.
• Trend. Whether the theme is improving or worsening over time. A tolerable theme moving the wrong way is not the same as a tolerable theme holding steady.
• Barrier health. How the theme's barriers were rated in the period. Effective ratings pull a score down; partially effective, ineffective and missing ones push it up.
• Active signals. The share of the theme's indicators in breach in the period, the evidence that something is happening, not a historical average.
• Corrective-action exposure. How much of the open corrective work behind the theme has run past its deadline. A theme propped up by overdue actions is more exposed than one that is genuinely controlled.
• Data confidence. How much real evidence the score rests on. A reading built from rich reporting deserves more weight than one inferred from thin data, and the profile says so.
• Surveillance coverage. How well the operation is actually watched for this theme. A blind spot is itself a risk, and the profile accounts for it rather than assuming silence means safety.

Fusing these seven is the difference between a number and an opinion. Two themes can share the same base risk yet read very differently once trend, barrier health and data confidence are weighed in. The fusion is computed from the underlying records, so the same inputs always produce the same score. It is rolled up for each month, an authorised user can recompute a period on demand, and an analyst reviews a snapshot before it is published.

A fused score says how a theme is moving; a board also needs to know how bad its worst case is, in words everyone already understands. So beside the score eAviora shows the worst of the four risk levels from ICAO Doc 9859, the Safety Management Manual every operator works to, among the records in scope, rendered as full words, never abbreviations, and the worst residual level once corrective actions land.

• Acceptable. The theme is genuinely under control. Routine monitoring is enough; no special action is owed.
• Tolerable. The theme is held, but only because active controls are doing their job. It stays on the radar and the controls stay watched.
• Undesirable. The theme demands attention. Corrective work is expected, and the board is right to ask what is being done and by when.
• Intolerable. The theme cannot be allowed to stand as is. It needs immediate action, or, if it must be accepted for a defined period, a recorded, co-signed acceptance that names who owns the decision.

The level follows the worst-case rule of Doc 9859, so a single intolerable record sets it however calm the average looks, and it is never blended into the score. The band says how the theme is moving; the level says how bad its worst case is, in the same words the regulator audits against.

A computed score earns trust only if you can take it apart. The Safety Risk Profile is not a sealed tile, it is the top of a stack you can walk down. Open a theme’s score and you reach the evidence behind the number.

• The contributing indicators. The Safety Performance Indicators (SPIs) that move the score, which ones are firing, which are near threshold, which are improving. The number is built from them, so it points back at them.
• The linked barriers. The controls whose health the score reflects. You see which barriers are effective, which have degraded, and how that pushed the score one way or the other.
• The open corrective actions. The work sitting behind the theme, what is open, who owns it, and whether it has been proven effective. The corrective-action exposure component is not a mystery weight; it is this list.

This is what “the math is shown” means in practice. Every part of the score traces to a record someone can read. When the board asks why a theme reads amber rather than green, the answer is not “the analyst felt it was”, it is a degraded barrier, two indicators in breach and an overdue corrective action, each one clickable. The drill-down is the audit.

A Safety Risk Profile that only gets read is half a system. The point of computing it from the records is that it can drive the governance that acts on it, without anyone re-keying the picture into a meeting pack.

The Safety Action Group. The Safety Action Group (SAG) is where the working-level safety conversation happens. In eAviora its agenda builds itself from live signals, repeated patterns across the operation, indicators that have degraded, and corrective actions that have proven ineffective. The group does not spend its first hour assembling the agenda; the agenda arrives already pointing at the themes the computed profile says need attention.

The Safety Review Board. The Safety Review Board (SRB) is where accountable oversight is exercised and decisions are recorded. Votes are recorded against the record, so who decided what is never in doubt. And where a theme must be accepted rather than driven to zero, an Intolerable or Undesirable risk held for a defined reason, the acceptance is a two-person co-signed risk-acceptance waiver, not a verbal nod that vanishes from the minutes.

This is the loop the score completes. The computed Safety Risk Profile reads the operation; the Safety Action Group works the themes it surfaces; the Safety Review Board decides and records; the corrective actions and barrier changes that follow flow straight back into the next computed profile. One connected operation, records in, board answer out, recorded governance closing the loop.

The relevant surfaces: the SMS module and Safety analytics.