Time to abandon the risk matrix? For me the consequence of an activity is not if it will happen, but when it will happen. And the consequences I worry about are death (HSWA S25) or a notifiable injury or illness (HSWA S23). So for me, I look at the activity, identify the hazard(s), determine the consequence(s) and work through the hierarchy of controls. — KeithH
And there I think you're missing the point of risk management.
What if an accident may have a low injury, but result in millions of dollars of damage (think Skycity fire)? Risk management is where all of these factors (financial loss, reputation loss, regulatory implications, etc) should come together. Everyone here is working in a very silo'd manner, without looking at the wider implications.
I don't consider the likelihood. Progress down the HoC automatically takes care of that. Once the controls for each level have been identified, it's up to the officers and workers of the PCBU to choose and find their own balance. There's only so much money in the kitty and so much time to get the job done. — KeithH
HoC work through the likelihood first (isolation), then the consequences (minimisation), so you must be looking at likelihood, even if not acknowledging it.
I'm interested in how you would look at the risk associated with aircraft flying through uncontrolled airspace. Consequences are a death, but likelihood is extremely low.