TUI GROUP | RSC | Martin Ring | November 2015 Compliance vs Performance based risk management Martin Ring Head of Risk, Safety and Compliance

TUI GROUP | RSC | Martin Ring | November 2015 SMS – what are we trying to produce? Principles agreed but how to effectively deliver Policy and Promotion – relatively easy to achieve Assurance and Risk management – harder to achieve “The overriding purpose of the Safety Management System is to ensure the airline conducts safe and secure operations on behalf of the TUI Group and the airline’s non-group clients” Stop accidents happening Reduce incidents to practically zero Enforce a Safety Culture Develop a proactive risk identification and safety management culture

TUI GROUP | RSC | Martin Ring | November 2015 Risk Management – What does it need to deliver? ‘A hazard is generically defined by safety practitioners as a condition or an object with the potential to cause death, injuries to personnel, damage to equipment or structures, loss of material, or reduction of the ability to perform a prescribed function.’ ICAO Doc9859 para ‘Safety risk is the projected likelihood and severity of the consequence or outcome from an existing hazard or situation.’ ICAO Doc9859 para Identification of all known risks to the operation from all data sources Assessment of all risks within Company risk management approach Mitigation action plan for all identified risks Termination, Reduction, Acceptance or Pass-on all of the identified risks

TUI GROUP | RSC | Martin Ring | November 2015 What does real risk management look like? Two types of risk management Hazard or occurrence event risk assessment Detailed risk identification Resource intensive risk identification through workshops, meetings and discussions at all levels of the organisation Usually a manual process managed locally through Excel or specialist software (Magique, XP Bowtie etc) Multi-directorate approach but generally reactive, occasionally proactive, in nature

TUI GROUP | RSC | Martin Ring | November 2015 Performance vs Safety? Identified risks usually as a result of reactive analysis Events continue to occur despite mitigation actions Difficult to risk identify one- off incidents or events Time spent proving risks don’t apply to operation or identified risks are low to very low severity

TUI GROUP | RSC | Martin Ring | November 2015 How to measure effective risk management? Current compliant-based approach only ever measures identified reactive risks Some risks can be applied to the whole industry yet…. Little sharing or benchmarking of risks across industry or shared by Regulator Company/Operator specific risks exist Data mining/risk workshops not the whole answer How to move to more proactive or predictive risk management?

TUI GROUP | RSC | Martin Ring | November 2015 Tips and Lessons Identified K.I.S.S – Do not overcomplicate the process Keep it relative to the audience Keep open-minded and allow the ‘team’ to identify their own risks Continually look to develop a proactive or predictive approach Be wary of single events becoming major risks or not!

TUI GROUP | RSC | Martin Ring | November 2015 Questions?