A hazard is not a risk,
and the difference matters.

The highlighted block above the contents list gives the short version. The sections below make the definition crisp, work through three examples every operator will recognise (a contaminated runway, crew fatigue and NOTAM overload), show why muddling the two produces a useless register, and then trace the chain from a hazard to its risks to the barriers that hold them, ending with the bow-tie that makes the whole thing visible.

Three words do the work here, and they are not interchangeable:

• Hazard: a condition or object with the potential to cause or contribute to harm. It is a state of the world. A contaminated runway is a hazard whether or not anything ever goes wrong on it.
• Consequence: the credible outcome the hazard could produce. A runway excursion, a mid-air conflict, an injury. A hazard can have several.
• Risk: the assessment of a given consequence, expressed as its severity combined with the probability it occurs. It is a judgement, not a fact about the world.

The distinction is not academic. A hazard cannot be rated on its own, because “how bad” and “how likely” only mean something once you name the outcome. And the word “risk” without a named consequence and an assessment is just anxiety with a red dot next to it. The risk is where severity and probability enter, which is exactly the two-axis judgement the risk matrix is built to structure. Hazard identification finds the conditions; risk assessment rates the outcomes; and only the second of those produces a number you can prioritise on.

The split is easiest to feel with cases every operator knows. In each, notice that the hazard is a condition, the risk is an assessed outcome, and the barriers are the controls you actually manage.

1. Contaminated runway.

• Hazard: standing water, slush or ice reducing available friction.
• Consequence: a runway excursion or overrun on landing or take-off.
• Risk: that excursion rated for severity (potentially hazardous or catastrophic) and probability (driven by contamination depth, runway length available and crew workload).
• Barriers: braking-action reports, a recalculated landing performance, a contamination or crosswind limit, and the option to hold or divert.

2. Crew fatigue.

• Hazard: reduced alertness from cumulative duty, disrupted sleep or circadian load.
• Consequence: a missed callout on approach, a slow response to a warning, or an error in a performance calculation. Note that this is one hazard producing several distinct risks, each rated on its own.
• Risk: each of those outcomes assessed separately, because they do not share a severity or a probability.
• Barriers: duty and rest limits, a fatigue risk management scheme, standby cover, and a pre-flight check such as a flight risk assessment tool that scores fatigue alongside the other threats for the sector.

3. NOTAM overload.

• Hazard: a briefing pack so dense with notices that the critical item is buried.
• Consequence: a crew acts on a stale picture, taxis toward a closed taxiway or plans on an unserviceable navaid.
• Risk: that missed-notice outcome rated for severity and probability given the aerodrome and the phase of flight.
• Barriers: a briefing tool that filters and highlights operationally significant notices, a crosscheck between crew members, and a standard callout for closed surfaces.

In all three, rating the hazard would be meaningless. It is the named consequence, assessed for severity and probability, that tells you which barrier to strengthen first.

When hazard and risk are muddled, a hazard register fills with entries like “weather,” “fatigue” or “ramp congestion,” each tagged with a colour and nothing else: no named consequence, no severity, no probability, no barrier, no owner. A register built this way has three fatal problems at once.

• It cannot be prioritised. Every entry looks equally alarming, so the register offers no way to decide what to work on first.
• It cannot be actioned.A barrier attaches to a consequence, not to a mood. “Fatigue” on its own gives you nothing to put a control against.
• It cannot be measured. With no assessed risk, there is no residual level to track, so you can never show whether a mitigation actually moved anything.

The result is a register that satisfies an audit checkbox and changes nothing operationally: a graveyard of vague worries. The fix is the discipline this article keeps returning to. Log the hazard once, enumerate its credible consequences, assess each consequence as its own risk, and assign a barrier wherever the assessed level warrants one. That is also why a single operational graph matters: when the hazard, its risks, its barriers and the occurrences that test them are the same connected records, the register stops being a static list and becomes something you can actually steer.

Once the vocabulary is straight, the whole of Safety Risk Management is one chain, and every link depends on the one before it:

Hazard identified → consequences enumerated → each consequence assessed → barriers assigned → indicators watch barrier health → occurrences test the barriers → corrective actions restore degraded barriers.

Read left to right, it says: find the condition, name the outcomes it could cause, rate each outcome on the risk matrix, and put controls where the rating demands them. Barriers come in two kinds: preventive barriers reduce the probability that the hazard becomes the event, and recovery barriers reduce the severity if it does. Then the chain keeps going past the assessment, which is where most spreadsheets stop. Safety performance indicators watch whether the barriers are actually holding. Real occurrences test them in service. And when an occurrence shows a barrier has degraded, a corrective action restores it, which feeds back into the assessed risk. The rating is not a filing act, it is the hinge the rest of the system turns on.

The clearest way to render that chain is a bow-tie. The hazard and its top event sit at the knot in the centre. On the left are the threats that could release the hazard, each with the preventive barriers meant to stop it becoming the event. On the right are the consequences, each with the recovery barriers meant to limit the harm. In one picture you see the hazard, the risks it generates, and exactly where every control sits, so hazard, risk and barrier stop being three words people confuse and become three visible positions on a diagram.

The catch with bow-ties has always been that drawing a good library from scratch is slow, and a diagram in a static file drifts from the operation the moment it is saved. eAviora ships the library pre-built: 101 bow-tie models, 804 named barriers, 210 scenarios and a 610-indicator SPI library, all inside one operational graph that also holds the occurrences, investigations, corrective actions and audits. You inherit the chain rather than drawing it on a whiteboard, and because the barriers are live records the diagram cannot quietly go stale.

It closes with a gate. eAviora enforces that a record cannot close over open risk: a degraded barrier requires a linked corrective action, proven effective, before the record can reach closed, and that behaviour is verified by a live scenario suite. So the distinction this article started with, hazard versus risk, is not just tidy vocabulary. It is what lets the SMS connect a condition to its outcomes, its outcomes to their controls, and their controls to the actions that keep them effective. To see it on your own operation, talk to us.