provides additional information about the aviation safety databases available for gathering data. 

• Visualize the Occurrence of the Accident or Incident. Put the hazard in its proper context within the given system state and determine the sequence of events (causes) that could lead to the worst credible outcome. Given that the Air Traffic Organization (ATO) strives to build error-tolerant systems (in accordance with the Defenses in Depth Model), consider how many controls (redundancies, procedures, warning devices, equipment, etc.) would have to fail for an identified hazard to breach every defense to result in a catastrophic event. Is it reasonable (i.e., credible) to expect that the necessary combination of extreme conditions will simultaneously occur within the operational lifetime of the system? 

## 3.5.4 Defining Risk 

## 3.5.4.1 How to Define and Determine Risk 

Risk is the composite of predicted severity and likelihood of the potential effect of a hazard. While the worst credible effect may present the highest severity, the likelihood of this effect is often very low. A less severe effect may occur more frequently and therefore present a higher overall risk than the more severe effect. The ways to reduce the risk for the two effects may be different, and both must be identified. Consider all credible effects and their associated risks in order to identify the highest risk for the safety hazard. 

Attempt to obtain and document objective evidence (e.g., historical evidence of similar NAS changes, testing data, modeling or simulation results) to support the assessed level of risk. If quantitative data are not available, document the research methods—including the data sources reviewed—in addition to qualitative assessments. Because different system states can affect both severity and likelihood in unique ways, determine whether the hazard will exist in several system states and assess the risk accordingly. 

## 3.5.4.2 Determining Severity 

Severity is the consequence or impact of a hazard’s effect or outcome in terms of degree of loss or harm. It is independent of likelihood and must be determined before likelihood is calculated. Assess all effects and consider controls when determining severity, and use the measure yielding the most conservative estimate (i.e., the higher severity). Table 3.3 is the severity table used by the ATO to assess the severity of a hazard when performing Safety Risk Management. Provide a rationale for the chosen severity level in the Hazard Analysis Worksheet (HAW). When a NAS change crosses Federal Aviation Administration (FAA) Lines of Business (LOBs), consult with the affected parties; the provisions of FAA Order 8040.4, Safety Risk Management Policy , apply. 

