Proposal of Risk Identification Methodology Using the Prompt List on the Example of an Air Carrier

Abstract

Risk management and safety are often-mentioned topics that dominate, especially in this period. The Safety Management System (SMS) is based on risk management, the implementation of which is required in air transport as well as in other modes of transportation. The fact is that the safety of passengers and staff is a priority for every airline, and such individuals are exposed to some common groups of risks. Risk identification is vital in successful risk management as only identified risks can be managed. Based on a study of published frameworks and standards, a risk identification methodology was designed using a prompt list of a logically arranged list of risks concerning typical aviation activities and the specific environment in which the methodology operates. The prompt list was compiled based on a context analysis, which focused on internal and external contexts and on which the structure of the prompt list was based so that risks could be moved from the list to a risk register for further processing based on various criteria. The list contains risks from several areas (economic, ecologic, social, individual, business, marketing, etc.). The design of the prompt list itself also includes a proposal for a methodology for its compilation, use, and updating.

1. Introduction

Safety and security are top priorities in many areas, particularly transportation and aviation. Each mode of transport has legislation, rules, and recommendations for safety and security, which must be followed to the greatest possible extent. Since the first aircraft was designed, aviation safety and security have been everlasting topics, and risk assessment is the fundamental method for aviation safety evaluation. Still, it is usually challenging to estimate aviation risks because they are often combined and hard to measure [1]. Air transport is considered a complex system with interlinked systems involving the human operation and connections both of procedural and technical systems. Unlike other transport modes, aircraft accidents involve added complexities because flying takes place over long distances and is global, often involving crossing into/over various countries and continents [2]. Commonly, the priority of research [3,4,5] on aviation safety and security has been investigating accidents, analyzing their causes, and suggesting corrective actions. The complete elimination of accidents and serious incidents in aviation is a desirable goal, though unachievable. In recent years, risk-free systems have developed toward a perspective centered on safety management and risk management, communicated according to different levels (global, state, company, etc.). Aviation organizations are responsible for maintaining an acceptable level of aviation safety and security due to the variety of business organizations covering the entire aviation industry [6].

The International Civil Aviation Organization (ICAO) supports aviation safety and security through the regulatory frameworks by using Annex 19 [7], a related Safety Management System (SMS), which is supplemented by Safety Management Manual Doc. 9859 [8], and Annex 17, which is related to aviation security [9].

Even though there are international and national standards for risk management, many complex approaches to its implementation have been described, whether theoretical or practical [10,11,12]. The most relevant methodology can be considered the ISO 31000, which represents a systematic and logical process during which organizations manage risk by identifying it, analyzing it, and then evaluating whether the risk should be modified by a risk treatment to satisfy their risk criteria [13]. At this point, it is possible to specify the term risk, which describes threats/hazards and expresses, in general, the effects of uncertainty on objectives. It is practicable to use the word “risk” because it covers safety and security issues in one term. Risk management is a set of activities by which an organization manages and controls risks to minimize their impact.

Considering ISO 31000, risk management includes two principal parts: assessment and treatment. Risk assessment can be summarized as three fundamental steps:

• Identification—the process of determining risks that can potentially stop an enterprise, investment, or program from accomplishing its goals;
• Analysis—the purpose of which is understanding the nature and specifics of the identified risks;
• Evaluation—the purpose of which is supporting decisions, including comparing the outcomes of the risk analysis to determine where actions are required.

The initial step is identifying risks, which are then analyzed and evaluated in the further steps of risk assessment. Aviation practice may specify a risk through a data-driven (quantitative) approach or qualitative methods, such as brainstorming, engaging in discussions, and conducting questionnaires and interviews. Risk can be grouped into a few general categories (natural, technological, economic, individual, and social [14]) or other custom categories can be determined. Despite the importance of risk identification (in aviation, one can use the terminology “hazard identification”), significantly few approaches and studies are directly related to identifying problems. This article’s primary goal is to propose a new, effective methodology for identifying risks via a prompt list [15,16,17].

2. Literature Review

This literature review is dedicated to establishing the terminology (Figure 1) and methods used in the article, focusing on risk identification and identifying the linked context according to ISO 31000.

In common practice, the terms “threat,” “hazard,” and “risk” are often mistaken. A threat can be characterized as an event or situation that can have an adverse effect on security. A hazard is a thing, such as an environmental variable, physical object, or a state of being, that is a reason for or leads to problems. Threats or hazards are undesirable potential circumstances that impair a system’s security and safety features. Several authors have focused on the inter-relationship between threats and hazards [18,19,20] in safety management and aviation. Still, there is a disagreement in the understanding of terminology. At this point, it is possible to conclude that threats and hazards are harmful or non-desirable events that may lead to damages or losses. However, a risk is a dangerous situation that occurs from threats or hazards and needs an immediate reaction or one may face consequences. A threat/hazard is anything with the ability to cause harm. A risk assesses the likelihood that harm will come to pass. All these terms are crucial elements of safety risk management [21,22]. Since the terminology is neither unified nor unambiguous and could be mistaken by a reader, the term “risk” will be used in this article to define both threats and hazards because in the proposed prompt list, attention is paid simultaneously to safety (hazards) and security (threats). Moreover, the term “risk” is used in the ISO 31000 standard to express negative effects on an object, which can represent any danger.

Risk identification can be defined as the process of analytically and constantly identifying threats/hazards that could potentially stop a program, system, business, or investment from achieving its goals and its categorizing. Identification should be made part of a well-defined process and should never be left as a simple activity, even when a system under assessment has a lower complexness and is familiar. This ensures not only that as many threats/hazards as possible are identified but also that they are correctly recorded [23]. Even though the term “hazard identification” is more commonly used in aviation, it represents the same process as risk identification, which aims to identify potential threats, hazards, conditions, and circumstances that could negatively affect operations. Since this article focuses on and proposes a prompt list of general threats/hazards that can be used in other fields or modes of transportation, with an emphasis on applications in aviation, the term “risk identification” will be used based on international standards (ISO 31000).

Sources of risk are essential drivers that cause problems in a system or organization. There are numerous sources, both external and internal. Sources determine where threats/hazards may arise. The early identification of sources can lead to the early identification of risks [24]. Risk domains are categories, classifications, or areas of risks. The term “risk domains” also describes a method used to separate relative risks into manageable groups. It is possible to differentiate several general domains: operational, strategic, financial, legal/regulatory, technological, economic, ecologic, business, management, etc. [25]. Risk causes are actual circumstances or events that exist in a project, organization, or environment that give rise to uncertainty. A risk consequence is the impact of a threat/hazard on an organization. It impacts not just the organization’s finances but also the organization’s operations and reputation and, in some instances, its license to operate. A risk impact analysis assesses the potential or probable losses and failures associated with an identified risk. It is a common risk analysis approach to estimate probability and impact. The following are typical types of impacts: health and safety, financial, quality of life, time, sustainability, reputation, and market position [26]. Context identification is related to knowledge about intended activities and how the activities fit into an organization, market, or society. It includes processes, environments, stakeholders, and many more aspects depending on the organization’s strategy or nature. The inputs must contain adequate information to comprehend the activities’ scope, objectives, budget, timeframe, and participants. The results of the context identification form the inputs into the following step—risk identification. The contribution of the context to informing the process is directly linked to the completeness with which the context identification step is undertaken. A risk manager’s ability during the risk identification is primarily influenced by their knowledge of a planned activity that is gained during a context identification [27,28].

Through diverse tools and methods, the risk identification process can be achieved. The proper choice depends on the nature of the activities being assessed, the types of risk, and employees’ ability and experience in identifying and using methods. In general, these methods can be divided into the following categories:

• Universal methods, which are mainly used to obtain information (e.g., brainstorming, interviews, the Delphi method, and questionnaires);
• Other methods, some of which have other uses (e.g., the SWOT analysis, checklists and prompt lists, presumption analyses, and the HAZOP analysis);
• Methods in a separate group that use diagramming techniques (e.g., cause and effect analyses, system and process diagrams, and impact diagrams);
• Methods used to identify the source of risk (e.g., safety audits, the what if analysis, human reliability analyses, and relative classifications) [29,30,31,32,33,34].

In the following section, basic hazard identification techniques are described, and some of them were used in the proposed methodology.

2.1. SWOT Analysis

The Strengths, Weaknesses, Opportunities and Threats (SWOT) analysis is typically used for organizations’ strategic planning and new tasks. Moreover, it can be a helpful tool for identifying risks from a unique perspective. The strengths and weaknesses are specified in an internal environment, and the opportunities and threats are recognized in an external environment. The SWOT analysis helps one identify the optimistic points of a process or business and what can be harmful to achieving goals [29].

2.2. Brainstorming

Brainstorming is a standard method used in risk identification. It varies from traditional brainstorming in that it is structured, using risk categories or a risk breakdown structure. The practical application of this approach needs the participation of appropriate organization stakeholders, the proper facilitation to handle group dynamics, and a dedication to the non-biased open expression of ideas [30].

2.3. Interviews

Risk identification interviews and discussions need the participation of key stakeholders. They should be performed by an autonomous, experienced interviewer or by using a structured plan in an atmosphere of trust, honesty, and confidentiality. Other techniques, such as checklists and prompt lists, can function as frameworks for risk interviews. An Interview can be held as a questionnaire that helps identify risks by setting out a list of questions about suggested risk categories [30].

2.4. Delphi Method

The Delphi method consists of collecting information in a structured and anonymous form, usually via questionnaires, managed by a facilitator accountable for gathering the ideas and opinions (risks) identified by experts. In rounds, the experts formulate a list of risks and submit it to the facilitator. The outcomes of the first round, once summarized, provide the basis for the second round and so on. The experts can change their thoughts, opinions, and ideas and present new arguments based on the facts collected in each round. This process continues until all the participants reach an agreement. This technique is a helpful way to reach a consensus, mainly when many people are involved. Moreover, anonymity ensures that the experts can express their thoughts freely and bypass errors, reviewing earlier opinions in each round [31].

2.5. HAZOP Analysis

The HAZard and Operability (HAZOP) analysis is a technique for determining and analyzing hazards and operational threats in a system. The technique’s popularity can be demonstrated through its ability to be adjusted to many types of systems and consider different parts, such as hardware equipment, software, procedures, and humans [32].

2.6. Checklist

A checklist is commonly used to determine or find risks and handle them. A checklist is created by listing items, steps, or tasks and is then additionally examined against criteria to determine whether the procedure was completed correctly or not. A risk checklist can be used as a step of identification to ensure that expected risks are not forgotten. A risk checklist is a chronological list of risks identified or recognized in the past. Checklists are suggested to be shared between employees and throughout an organization [33].

2.7. Prompt List

A prompt list provides a group of risk categories, classifications, and sources of risk from an external organizational environment and within an organization. It is a simple tool with broad risk categories, such as economic, environmental, legal, and market. This list aims to create initial thoughts and stimulate risk identification using different approaches and techniques. For illustration, prompt lists can be used as frameworks for other risk identification methods, such as brainstorming and interviews [33].

2.8. STAMP

The System-Theoretic Accident Model and Processes (STAMP) describes systems as a hierarchy of control based on adaptive feedback mechanisms. It explains how a lack of system safety control produces accidents at both the design and operational stages. The approach’s elements of system hierarchy, component interactions, and regulations are visually integrated into a STAMP diagram [34].

2.9. FRAM

The Functional Resonance Accident Model (FRAM) graphically illustrates systems as a network of companion sub-systems and functions which, although designed otherwise, exhibit varying degrees of performance variation. The performance variability of any given system part can resonate with that of the remaining components, produce an emergent variation that is too high to control, and result in an accident [34].

3. Methodology

Multiple methodologies [35,36,37,38,39,40] allow for quality and effective risk identification, but the choice can often be complex and inappropriate. To work with risks competently and effectively, it is fundamental to use an approach or technique that allows for transparent, explicit, and proactive risk identification.

The methodology in this article was chosen concerning the objective, which was to suggest a practical approach to risk identification using a prompt list regarding context analysis.

The research method encompasses three main steps, as shown in Figure 2.

3.1. Context Analysis

Risk identification requires a comprehensive study of the contexts and backgrounds related to processes that can cause potential risks. Its fundamental purpose is to obtain as much information as possible that will be helpful for a risk identification and subsequent risk analysis. The risk should be managed from an organization’s aims, perspective, and environment because uncertainty most often comes from an internal or external background, which is formed by stakeholders [41,42]. Miller (1992) presented three significant categories of uncertainty:

• General environment;
• Industry;
• Firm.

General environmental uncertainties, such as political, social, natural, and macroeconomic uncertainties, influence the business context across sectors. The industry uncertainties group includes input market uncertainty, product-market uncertainty, and competitive uncertainty. The last group consists of firm uncertainties, which include operating, liability, research and development, credit, and behavioral uncertainties. Given the listed uncertainties, it is essential to know the environments and the inter-relationships in the internal and external environments where a company operates. To cover all the named categories of uncertainties, it is necessary to examine the internal and external environments and the company’s activities. A correct analysis of the environments provides information related to the source of a threat/hazard, which is essential for the stakeholder analysis and subsequent adoption of measures in connection with the elimination of the risk. Environmental analysis is primarily focused on PESTE analysis, SWOT analysis, and horizon scanning. For best results, a combination of all methods is recommended.

A source of uncertainty is also stakeholders who directly affect an organization or are directly or indirectly affected by the organization [43]. Numerous studies have focused on the impacts of stakeholders on companies’ operations, some studies of which have applied stakeholder analysis to the risk analysis process. Research by Yang et al. (2016) pointed out that the classical framework may not be practical for analyzing stakeholders’ risks, and therefore, stakeholders need to be considered during the risk analysis [44]. Generally, stakeholders are divided into internal and external, and a stakeholder analysis shows the relationships between and the importance of their requirements or conditions concerning an organization’s operation.

Internal uncertainties can be effectively described by identifying key activities through process mapping or cross-functional process mapping. Process mapping provides a clear picture of what actions are carried out as part of each process, where such activities are taken out, and how they are performed [45,46]. A map’s structure typically includes management, primary, and support processes that form an operation, thus providing an overview suitable for the context analysis.

The context analysis (Figure 3) aims to obtain the necessary information connected to a process, stakeholders, and an organization’s environment. In aviation, a context is determined by considering:

• Inputs: items relating to legislation, recommendations, and requirements (ICAO, IATA, EASA, etc.), an incident reporting system, a safety management system, and active documents and lessons learned, emphasizing the essential experience needed for each operation.
• Techniques: Process mapping to describe processes in more detail and characterize the primary sources of risks. Other methods include stakeholder and environmental analyses through PESTLE and SWOT analyses.
• Outputs: a process map, stakeholder analysis outputs, environment analysis outputs, and lessons learned.

3.2. Development of the Prompt List

The second step of the proposed methodology consists of an initial analysis (Figure 4) of the available threat/hazard lists, catalogues, and risk registers that will be used to process a uniform general prompt list. The structure consists mainly of the primary classifications and sources of risks, which are used for an easier orientation in the prompt list. It is possible to use several characteristics to describe a risk, e.g., the source of the risk, the risk’s category, the risk’s elements, activities, factors, and the risk’s drivers. Sources of risk and risk categories are most often used for descriptions. In both cases, there are many possibilities, and the choices depend on the experience of the creators, the purpose of the analysis, and, of course, the industry in which the analysis is being performed. For example, [42] divided the sources of risks based on uncertainty into three mentioned categories, or risks are divided into internal operations, external stakeholders, marketplaces, environments, and others. There is a considerable number of risk categories. It is common practice to adapt a risk classification to suit one’s needs. An example is another classification, which classified risk for piles construction into external, design, management, construction, sub-contractor, equipment, political, governmental, economic, and owner-generated risk [47].

Several research papers, theses, and references were studied to recognize appropriate risk registers, lists of threats/hazards, and prompt lists (from the fields of transport, project management, supply chains, trade, etc.) that may be applicable to air carriers. A prompt list was developed based on a review and guided interviews with senior managers and engineers with experience in aviation. Identifying risks utilizing a prompt list reflects a determined context, as mentioned earlier, while a prompt list helps as an effective tool for identifying risks that affect the operation of an air carrier.

4. Results

The following chapter will clarify the research results characterizing the context analysis and, subsequently, the design of the prompt list for risk identification regarding the requirements of an air carrier.

4.1. Environment Analysis

An air carrier operates in a complex internal and external environment that fulfils the demands of various interested parties (customers, airports, suppliers, etc.). In particular, the external environment may adversely affect operations and pose risks that may negatively impact the carrier company’s economy. Environmental analyses are most often carried out through PESTE and SWOT analyses.

A PESTE analysis allows for a broad examination of the context and actual or potential factors that may affect the objectives or activities of an operation [48]. The following table (

Table 1. Definition of selected factors within a PESTE analysis that significantly impact an airline’s operations and complete its context through the identified factors.

Political	Economic	Sociological	Technological	Environmental
Legislation	Employment rate	Level of education	Research focus	Value of environment
Property rights	Availability of loans	Generational attitudes	Automation	Relationship between factors
Military invasions and conflicts	Economic health	Social mobility and community health	Innovation	Direct/indirect impacts
Corruption	Other macroeconomic factors	Sociocultural aspects	Infrastructure changes	International environments

) lists the significant factors that considerably impact an airline’s operations. The political situation in the airline’s country, the impact of the economy, high unemployment, and the degree of automation or innovation can significantly affect the decisions of the air carrier and its future direction, with an emphasis on potential risks.

A SWOT analysis aims to evaluate a company’s internal assumptions that affect the implementation of its business plan and to analyze the external opportunities and constraints (threats) determined by its market. The analysis’s use is beneficial because strengths and weaknesses can cause potential risks and opportunities. A SWOT analysis (

Table 2. Schematic illustration of a SWOT analysis with examples of some strengths and weaknesses from the internal environment and opportunities and threats from the external environment of an air carrier.

Strengths	Weakness	Opportunities	Threats
Interesting destination	Higher debt ration	Increase in demand	Rising costs (fuel)
Popularity among travelers	Older IT	Building of cooperation	Market competition
Strong creditworthiness	Outsourced office spaces	Development of new technologies	Ongoing pandemic
Stable market positions	Bad reputation	Innovations	Changing situation of market

) is therefore used not only to identify the company’s context but also in the risk identification process [49].

As part of the context analysis, the environmental analysis results and details were further used and implemented as the inputs in the initiation step of processing the prompt list.

4.2. Process Mapping

The standard air carrier processes can be categorized into three primary groups (Figure 5) [50]:

• Management—an area of management and administration, planning, resource management (humans, finances, resources, etc.), quality management systems, risk management, marketing, documentation, etc. These processes can be fully or partially outsourced.
• Primary (main)—the main process, which is provided by the air carrier and is directly related to flights; there is usually no outsourcing (the exception is an ACMI lease). The inputs are the customer’s requirements and contracting, based on which it is possible to plan a flight, carry out the flight, evaluate the flight, and process the relevant documentation. The output measures are customer satisfaction through feedback, reports, complaints, and other relevant information obtained by the airline.
• Support—used to support operations in terms of safety, monitoring, maintenance, purchasing, auditing, and IS/ICT.

Management and support processes can be continuous, concurrent, or separate. It depends on what an air carrier chooses considering the complexity and size of an operation. A process map can be further modified depending on the services that the air carrier provides and is responsible for. Furthermore, the process map can significantly change its formation according to the company’s business model and outsourcing possibilities.

4.3. Stakeholder Analysis

A process map and an environment map can be further extended with a stakeholder map, which can be processed separately or in summary within the process map. Stakeholder identification (Figure 6) helps one capture and describe stakeholders, their roles in activities, their importance, and their participation. In general, a difference is made between internal and external stakeholders. Employees and suppliers are included among the internal stakeholders (in the case of an air carrier, these are most often suppliers of catering, handling, and IT services). The external stakeholders include customers (individuals, travel agents, businesses, post offices, etc.), states, countries, the ICAO, the IATA, the EASA, airports, leasing companies, insurance companies, aircraft manufacturers, public procurements, shareholders, and suppliers of gas, water, electricity, fuel, and other services.

A stakeholder analysis output (Figure 6) briefly illustrates the stakeholders and their interests. Some stakeholders may generate risk if their requirements are not fulfilled. The following labeling structure was used to process the map, which defines which processes are affected by stakeholders:

• ALL—all processes;
• M—management processes;
• P—primary processes;
• S—support processes.

4.4. Prompt List—Structure

For the needs of the prompt list processing (Figure 7) and the development of its extended version, a function in MS Excel was used. A contingency table allowed a summarization of all risks from a previous overview of existing catalogues and interviews. The table enabled the following study of data, a summary, an assessment, and illustrations and representations via graphs.

The following parameters were established in the contingency table:

Number of columns: 10

• Source 1—internal or external;
• Source 2—political and economic environment, social environment, natural environment, business environment, and processes;
• Category—A, B, C, D, E, F, G, H, LD, M, O, and P;
• Classification—environmental, economic, individual, social, technical, information, political/legal, business, operational, marketing, outsourcing, and insurance;
• Marking—according to a predefined labeling and color-coding system;
• Risk—a brief definition of the risk;
• Stakeholder—banking system, supplier, communities, competition, airport, state, transport authority, international organizations and international trade, customers, employees, and force majeure;
• Impact—disruption of operations, disruption of economic stability, disruption of the company, poor business environment, poor service provision, negative audit findings, flight threats, control body intervention, poor working conditions, increased company costs, and loss of market position;
• Process—influence on the management, main, or supporting process or on all processes;
• Sub-activity—to expand the risk that the air carrier expects in the phase of the flight or in the preparatory phase and in some specific cases, e.g., flight delays, handling problems, de-icing problems, landing on water, diversions of aircraft to other airports, and others.

Number of lines: 314

The contingency table (Figure 8) identified 313 risks by line, further classified into the following categories:

• Ecological (17);
• Economic (37) and economics—… related to leasing (4);
• Individual (20);
• Social (20);
• Technical (21);
• Informational (42);
• Political/legal (17);
• Business (46);
• Operational (67);
• Marketing (9);
• Outsourcing (12)
• Insurance (1).

Ecological risks are related to the environment and can cause unusual situations because they cannot be predicted in advance. It is so-called force majeure and affects the primary process, slowing down or completely stopping air traffic. Economic risks are most often related to a company’s assets and capital. These risks cause financial losses and mainly affect its management process but can also adversely affect its primary and supporting processes. Individual risks concern individuals and approaches to work. Combined with other factors, the human element is the most common cause of accidents or aviation incidents. Statistics [51,52,53] confirm that the human factor causes up to 80% of accidents. Social risks are related to the internal and external environments in which an airline operates and most often affect all processes. A current example of social risks is the COVID-19 pandemic, which is in decline after two years but has had a significant impact on air transport and has had a considerable effect on the financial health of the sector. Technical risks regard legislation governing the use of technology, particularly in the case of air transport and aircraft technology. Technical failure is the second-most common cause of accidents or other aviation incidents. Information risks concern IS/ICT technologies and usage. Business risks are linked to all processes and can significantly impact a company’s operation, economic stability, and market position. Operational risks impact flight, including risks such as radar control errors, bird strikes, and the incorrect configuration of systems in aircraft or engines in planes. Marketing risks are related to an airline’s marketing activities, particularly market research, trends in aviation that are changing relatively quickly, and marketing strategies. Outsourcing risks are specific and concern only those air carriers that use them. Although outsourcing has several benefits, it also manifests itself in the risks associated with it. It is possible to outsource, for instance, catering supplies, handling, and ICT. The insurance risks that an air carrier may face can impact economic stability. The following parameters were established in the contingency table; an example from the prompt list can be found in

Table 3. Simplified preview from the prompt list of selected risks in all categories showing classifications, categories, risks, stakeholders, and possible consequences.

Classification	Category	Risk	Stakeholders	Consequence
Ecologic	A	Noise	Employees	Disruption of operation
Economic	B	Problems with credit operations	Banking systems	Disruption of economic stability
Individual	C	Violation of human rights	Management, employees	Poor working conditions
Social	D	Pandemic	Communities, states	Low-quality business environment
Technical	E	Energy supply failure	Suppliers	Disruption of organization
Informational	F	Spam	Employees	Disruption of organization
Political/legal	G	Increase in fees	States	Increase in company costs
Business	H	Incorrect flight planning	Employees	Disruption of operation
Operational	LD	Loss of luggage	Employees	Disruption of operation
Marketing	M	Insufficient marketing activities	Management	Loss of market position
Outsourcing	O	Poor service delivery	Suppliers, management	Poor quality provision of services
Insurance	P	Insurance risks	Suppliers, management	Disruption of economic stability

.

A brief list of identified threats is demonstrated in Appendix A and Appendix B (passages from the prompt list).

4.5. Prompt List—Flowchart

The following figure (Figure 9) illustrates a flowchart, which summarizes the proposed methodology and highlights the creation, implementation, use, and updating of the prompt list. The prompt list includes general (ecologic, individual, social, political/legal, etc.) and specific (business, operational, outsourcing, technical, etc.) risks. It is more structured to pursue a more functional, efficient, and transparent selection of risks involving requirements in specific aviation fields. For this unique purpose, a set of questions was drawn up via questionnaire, focusing on the specificities of an air carrier. Because its environment and conditions change over time, risks also increase, as demonstrated by the current COVID-19 pandemic. Therefore, it is necessary to add risks not only to the risk register but also to the prompt list. This should be a frequent and regular operation activity to ensure proactive risk management.

The flowchart graphically shows the methodical procedure of using the proposed prompt list in practice. Initially, it is necessary to identify a critical context that has already been identified and described above:

• Processes;
• Stakeholders;
• Environments.

The context analysis results are necessary to identify risks and enable the correct inclusion of risks in the prompt list.

In addition, collecting inputs from the following is required:

• Incident reports;
• Audits;
• Other necessary documentation.

After the initial step, it is then possible to continue with the prompt list.

If the prompt list does not exist, it is needed to identify risks using the standard procedure and to select appropriate identification methods (brainstorming, interviews, the Delhi method, the what if analysis, etc.). After choosing the proper and suitable identification methods, it is possible to identify the sources of risks (internal and external) and proceed to a risk identification. At this point, it is possible to create risk domains and categorize risks as needed (economic, technical, social, ecological, business, operational, market, etc.).

If a prompt list exists, it is advisable to use a questionnaire that refers to essential questions from practice. The questionnaire is most often formed of simple questions related to, for instance, outsourcing, safety, maintenance, etc. The advantage of the questionnaire is that it enables a quick selection of specific risks. If the questionnaire is unavailable, it is necessary to study the prompt list and select relevant risks carefully.

In all three identification options (the standard identification procedure, with or without a questionnaire via the prompt list), it is necessary to export the risk register. The risk register represents a list of identified risks that will be further assessed and evaluated in the next steps of the risk management process (assessment and mitigation). If no relevant risks are identified after the first identification, a re-selection of risks is required. After this step, all risks are re-checked; if not all are identified, an additional identification is necessary. Subsequently, the risks are re-selected and exported to the risk register. This step is repeated until all risks are determined.

Afterward, it is possible to create or update a prompt list. The prompt list is created if it was unavailable at the beginning of the identification (standard identification procedure). The prompt list is updated if it was available at the beginning of the identification and was actively used during the entire identification process (with or without a questionnaire via the prompt list).

This process should be repeated regularly and continuously.

5. Discussion

In several areas, particularly in aviation, introducing a safety management system based on risk management is mandatory to ensure a high level of safety. Although sectors face similar troubles, it is difficult to find a list of risks to help identify them correctly and effectively. The development of a prompt list based on knowledge of a company’s context provides a precondition for its compilation according to the needs of a given area.

The prompt list presented in this study has its limits as it was created based on other studies, prompt lists from other areas, as well as lists of risks from incident reports and several guided interviews. By asking simple questions about the primary activities of an air carrier, it is possible to reduce the number of risks, especially by using questions focused on the type of carrier and the use of outsourcing. To make it entirely usable in practice, further expanding it by consulting experts from several airlines would be necessary. Nevertheless, the prompt list points at least to groups of risks that should not be left out when compiling the risk register. The article and the proposed methodology thus create space for further research and applications in practice.

Another limitation is focusing on only risks related to air carriers without considering the risks associated with an airport’s activities, and which also directly impact air carriers. Despite the above points, integrating a prompt list with a suitable structure can be beneficial as it will speed up and streamline the work of managers. By supplementing it and not just supplementing the risk register, it is possible to obtain a comprehensive database. It is also possible to constantly modify the prompt list and adapt it to the practice requirements.

This article focuses on the original concept of risk identification and a suggestion of a methodology and a prompt list with an emphasis on the context of an air carrier. The article thoroughly describes a systematic procedure that will enable a more effective risk identification and creates space for further research and modifications in practice. As a result of a simple context analysis, an air carrier can supplement the prompt list with risks that relate exclusively to its operation and safety issues. In addition, there is currently no specific guideline establishing a unique procedure—an aid in the identification process. Therefore, the prompt list should be understood as an effective tool for risk identification. Creating prompt lists for a given sector, e.g., air carriers, which would be shared and supplemented by air carriers, would improve the work of safety managers to maintain a safety management system in an organization as one is mandatory for air carriers and is intended to guarantee a high level of safety. Moreover, the proposed method and prompt list also support the safety management system with its proactivity, transparency, and explicitness.

At this point, it is necessary to underline that due to the unclear and confusing terms “threat”, “hazard”, “risk/hazard identification”, etc., this article used a methodology following ISO 31000—risk management, which uses the terms “risk” and “risk identification.” Although the terms “hazard” and “hazard identification” are used in air transport, the proposed methodology is general and can be used in other areas as well. The article only points to the use of the method in the instance of an air carrier.

6. Conclusions

This study aimed to develop a methodology for risk identification with an emphasis on implementing a prompt list. The prompt list should be structured to help identify risks more efficiently, transparently, and proactively.

The article presents a proposal for the list’s creation, structure, implementation, and updating through the methodology illustrated in the flowchart. In the individual steps of the proposed methodology, a prompt list is compiled that contains 313 risks from different areas and categorizes them into different groups and classifications (ecologic, economic, individual, social, technical, informational, political/legal, business, operational, marketing, outsourcing, and insurance).

Context is likened to processes, the environments where a company operates, and stakeholders who place demands and requirements on products and services. Thus, the prompt list and identified risks result from a previous detailed analysis of a context for which attention was paid mainly to the environments (internal and external), processes (management, primary, and support) and stakeholders (state, airport, customers, suppliers, etc.). The advantage is that an airline creates this context on its own and therefore knows best what risks to it are and what risks to it are not. In addition, it can modify the prompt list and make it even more efficient.

It is possible to conclude that this approach is unique in processing the list of risks, an approach that has not been used in practice so far. Subsequently, the prompt list structure allows for the selection of risks based on specific categories, such as the sources of risk and types of risk, or on the typical activities/processes of an air carrier. Moreover, the proposed methodology allows for a simple updating of the prompt list, which ensures repeated and regular identifications.

Although the proposed methodology has certain limitations, it is a new approach that uses a simple prompt list technique and can significantly make the identification process more efficient in practice. The methodology can also be used in other areas as it is designed to be general. In addition, the methodology creates space for further research concerning its use in practice.