06 July 2026
Is the ARMS methodology for operational risk assessment in aviation organisations still relevant?
With guidance by ICAO Annex 19 and the Safety Intelligence Manual (Doc 10159)
Safety Management Systems (SMS) supporting aviation operations have evolved from principally reactive compliance systems, supported by an accident prevention plan, into a proactive and systemic capability that is data-driven and evidence-based, enabling effective risk management decision-making.
The International Civil Aviation Organisation (ICAO) Annex 19 (2nd) outlines that organisations should operate a systematic, proactive, and data-driven approach to managing aviation safety. The SMS focus is on proactive hazard identification in Safety Risk Management (SRM), organisational knowledge through Safety Training and Promotion, and organisational oversight through Safety Assurance functions enabled by a strong organisational safety culture. Operator SMS now reflects a proactive, performance-based monitoring system where the operator is responsible for the organisation's risk signature.
Regulators are focused on a Performance-based oversight (PBO) approach, where regulators focus on operator risk management and SMS measures, supporting performance monitoring as opposed to traditional checking of procedural compliance. By analysing safety data and organisational performance indicators, regulators can adopt a more risk-based approach to concentrate limited resources to maximum benefit (UK Civil Aviation Authority).
Aligned with guidance by ICAO Annex 19 and the new Safety Intelligence Manual (Doc 10159), this approach ensures organisations continuously identify hazards, analyse data, and mitigate risks before accidents occur. The Doc 10159 provides specific guidance on the collection, processing, analysis, and exchange of safety data. Thus, the SMS now encompasses a data-driven approach designed to move safety management from reactive compliance to proactive, predictive foresight (feed-forward loop for safety).
The question is whether the ARMS/SIRA methodology, developed principally for airlines and with a flight operations focus in 2010, is still relevant and aligned with this new guidance from ICAO for the industry.
What is ARMS/SIRA?
Aviation Risk Management Solutions (ARMS) was an industry working group (airlines), that was set up in 2007 to develop an improved methodology for Operational Risk Assessment (ORA). This was to compensate for the perceived subjectivity in the traditional risk assessment process (the simplistic severity x likelihood formula), as it doesn’t consider existing or potential risk controls and effective barrier analysis. The existing process is not systematic and relies heavily on subjective SME judgement and experience and fails to quantify the actual effectiveness of risk control barriers.
Operational Risk Management (ORM) is a continuous, systematic process, integrated with organisational safety assurance, which is applied by operators to identify, assess, mitigate, and monitor threats arising from an organisation's day-to-day business. The main goal of Risk Management is to protect organisational people and assets and ensure strategic goals can be achieved safely. This is enabled by a risk management cycle that proactively identifies safety issues, assesses their associated risks, and implements mitigation measures that are then monitored for effectiveness. The aim is to reduce those risks to an acceptable or tolerable level before they can cause safety events or accidents. Organisational risk tolerance sets the acceptable boundaries of deviation from these goals, ensuring that all risks remain at an acceptable level of risk tolerance in an organisation (ALARP – As Low as Reasonably Practical).
The advent of the ARMS/SIRA methodology provided a data-driven, structured, barrier-based approach to risk management that measures operational risk by evaluating accident outcomes, triggering events, and the evaluation of real-world systemic defences.
Whilst the tool has initially been developed for flight safety risks, the methodology can be effectively applied to all operator organisational areas (Flight, Ground, Engineering) and external support organisations such as ground service providers and maintenance organisations.
ARMS presupposes that Operational Risk Assessment is needed in three different contexts:
- Applying an Event Risk Classification (ERC) to all safety events to prioritise the safety investigation process by evaluating the effectiveness of remaining safety barriers
- The Hazard Identification process may lead to the identification of Safety Issues, which need to be risk assessed to determine what actions, if any, are needed. This step is called Safety Issue Risk Assessment (SIRA). Safety Issues may need to be reassessed regularly to ensure that the risk is maintained at or below the acceptable level.
- The need to carry out operations Safety Assessments, typically related to a new or revised operational activity (e.g. new destination, new operating system, new aircraft type) linked to management of change.
Figure 1. Simplified Risk Assessment process.
Once risk is assessed, all events are stored in a safety event database to support trending analysis. Safety Data in the database is analysed (Data Analysis) with the main focus on identifying any Safety Issues that affect the current operation.
Figure 2. The Risk Assessment process flowchart.
Figure 3. The model behind the Safety Issue Risk Assessment.
The SIRA framework has four principal factors that enable an improved and quantifiable risk assessment process:
- Frequency/probability of the Triggering Event (likelihood of event occurrence in the operation)
- Effectiveness of the Avoidance Barriers (the effectiveness of current safety controls to prevent triggering event escalation to a higher risk issue)
- Effectiveness of the Recovery Barriers (how robust is the recovery barrier if the avoidance barrier fails to avoid an adverse outcome)
- Severity of the accident outcome (based on internal operation and industry, what is the most credible accident outcome)
The SIRA process aligns with the Bow Tie method, which is used to visually analyse and communicate how potential high-risk scenarios can occur in the operation from system threats and map and evaluate the effectiveness of risk controls (barriers mapped out on the Bow-Tie diagram) before and after the triggering of a risk event.
The SIRA process can be applied utilising industry-established tools such as Human Factors Analysis Classification System (HFACS) and Maintenance Error Decision Aid (MEDA), which allow the identification of active and latent failures of the operational processes and managerial oversight, to support development of evidence-based risk interventions.
Further, a comprehensive safety performance measurement system with Key Performance Indicators (KPIs) and Safety Performance Indicators (SPIs) will support predictive hazard identification of ARMS. Predictive methods can combine statistical modelling, trend analysis, and real-time system monitoring to anticipate hazards. Suggested predictive tools include:
- Causal and Contributory Factor Trends Analysis
- Safety Performance Trend Analysis
- Aircraft Performance Trend Analysis
The key benefit of a structured and quantifiable risk assessment process is that it enables organisations to produce systematic, repeatable, and defensible risk assessments to present to management to support risk-based decision-making.
Thus, the ARMS methodology aligns with the following elements of the ICAO SMS framework:
- Risk Assessment (and mitigation) (ERC/SIRA allows operators to understand their risk exposure)
- Safety Performance Monitoring and Measurement (safety data trending and analysis linked to Doc 10159 provisions)
- Management of Change and Safety Assessments (SIRA- new safety case/assessments)
In conclusion, the ARMS/SIRA methodology is a systematic, quantifiable/data driven and structured approach to the risk management process that enables effective risk-based decision making of operator management teams. Further, the tool has equal application across multiple transport industry modes.
In conclusion, the ARMS/SIRA methodology is a systematic, quantifiable/data driven and structured approach to the risk management process that enables effective risk-based decision making of operator management teams. Further, the tool has equal application across multiple transport industry modes.
The ARMS/SIRA methodology still remains highly relevant; it’s aligned with Annex 19 and ICAO Safety Intelligence Manual provisions and is still in wide industry use by operators in 2026, more than 15 years after development.
Let's talk
Article References
ICAO Annex 19 – Safety Management (2nd)
ICAO Safety Management Manual (Doc 9859)(2018)
ICAO Safety Intelligence Manual (Doc 10159)(2025)
The ARMS Methodology for Operational Risk Assessment in Aviation Organisations. Developed by the ARMS Working Group, 2007-2010
Preparing for the Unpredictable: Strengthening Emergency Response in Uncrewed Operations
When drones fail, response is everything. John Foulds, Blake Emergency Services, explains how to build effective, real-world incident readiness.
Back to Basics: Accountabilities and Responsibilities
Confusion creates risk. This is a clear look at accountabilities vs responsibilities and why defining both is essential to safe, effective operations.
The Walbrook Building 25 Walbrook London, EC4N 8AW
Privacy Policy - Do Not Sell or Share My Personal Information (U.S. Residents Only)
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.