Decision-Making, Risk Matrix and Operational Worksheets

Human factors become visible in decisions

Human performance is not just a list of personal limitations. It shows up in ordinary decisions: launch now or wait, continue or land, trust the plan or update it, accept a client request or hold the line.

The remote pilot's job is to make those decisions deliberate. That means noticing pressure, naming the risk, choosing a control and leaving a decision trail that another competent person could understand later.

• If the crew is rushing, slow the operation down.
• If the plan no longer matches the site, update the plan before launch.
• If the risk control is vague, the operation is not yet controlled.
• If the decision cannot be explained simply, pause and re-brief.

Read the Stress, errors and teamwork transcript

Pressure creates decision traps

Most poor decisions do not feel careless at the time. They often feel efficient, loyal, confident or helpful. That is why pressure should be treated as a threat in its own right.

Common traps include confirmation bias, plan continuation, risky shift and screen fixation. The practical countermeasure is to give the crew a short pause point where someone asks what has changed and whether the operation still has margin.

A 12 second loop. Three cards sit in a row: pressure, a decision trap, and a pause. A margin bar runs underneath. A blue marker starts at the pressure card, where a clock spins, a dark cloud rolls in and a battery runs low, and the margin starts to shrink. The marker moves to the trap card, which acts out the selected trap. Confirmation bias: a magnifier checks only the good news and skips the bad line. Plan continuation: a route presses on past a turn-back line. Risky shift: three people nod together while a shared risk dial climbs higher than any one of them would go. Screen fixation: the eye stays locked on the screen while the drone drifts off. The margin bar turns red. The marker then speeds toward the pause card, where a gate drops and stops it. WHAT HAS CHANGED? appears, the marker turns green and the margin refills. Schematic and fictional. The still frame shows plan continuation stopped at the pause.

• Confirmation bias: only noticing information that supports the plan you already wanted.
• Plan continuation: pressing on because stopping would be inconvenient.
• Risky shift: a group becoming more comfortable with risk than any one person should be.
• Screen fixation: losing the aircraft, site or airspace picture because the display is absorbing attention.

Use a risk matrix as a conversation starter

A risk matrix is not magic. It will not make a bad operation safe by colouring a square green. Its value is forcing the crew to discuss likelihood, consequence, controls and the residual risk after those controls are applied.

The strongest remote pilot habit is plain wording: this hazard could cause this outcome, so we will apply this control, and our final decision is go, modify, delay or stop.

A 12 second loop. On the left is a schematic five by five risk matrix, with likelihood increasing upward and consequence increasing to the right. The cells shade from green to red; there are no scale words. On the right, four worksheet steps light up in turn: hazard, control, residual and decision. A fictional hazard, people walking into the operating area, drops into a high likelihood, high consequence red cell, with guide lines to both axes. A control (a cordon and observer, shown as a barrier) is added. If the control is in place and reduces likelihood, the marker moves down two rows to a lower cell; if it reduces consequence, it moves left two columns. That cell is the residual risk, and the decision is GO. With 'Only on paper' selected, the marker tries to move but springs back to the red cell, leaving a dashed outline of the cell it hoped for, and the decision is MODIFY OR DELAY: colouring a better square does not make the operation safer. The still frame shows the residual risk and GO.

• Likelihood asks how credible the event is in this operation, not in aviation generally.
• Consequence asks what could happen if the hazard is not controlled.
• Controls should reduce likelihood, consequence or exposure.
• Residual risk is the risk left after the control is actually in place.

Turn TEM into a live worksheet

Threat and error management is easiest to teach as a loop. Identify the threat, choose a countermeasure, trap errors early, recover before the aircraft state becomes unsafe, then learn from the job.

In a remote pilot briefing, this can be a short worksheet rather than a long speech. The crew should know the top threats, the stop words, the recovery action and who has authority to call a hold or landing.

A 12 second loop. Four worksheet nodes sit around a clockwise loop: threat (gusty wind), countermeasure (a shield), error trap (a speech bubble for a stop word) and recovery (a landing pad). The phase is named in the middle. A marker travels round the loop and each node responds as it arrives. In flight (the default, CALLOUT): the gust hits and the threat node pulses red, the countermeasure node lights green, the crew calls HOLD at the error trap, and the drone lands at the recovery node. Brief: each node is filled in with a tick before flight. Review: each node is updated with a pencil mark, and the marker carries the lesson back to the threat node for the next job. Fictional example. The still frame shows the in-flight HOLD callout.

• Threat: what can push the job away from the plan?
• Countermeasure: what will we do before that happens?
• Error trap: how will the crew notice and call it early?
• Recovery: what action returns the operation to a controlled state?

Give every crew member a useful voice

Crew coordination is a control only when the crew knows what to say and when to say it. An observer who is unsure whether they are allowed to interrupt is not an effective observer.

The pre-flight brief should give plain callouts for traffic, people, loss of visual contact, battery concerns, weather change, boundary drift and confusion. Closed-loop communication then confirms the message was heard and acted on.

• Use short calls: stop, hold, land, traffic, people, visual lost, battery, boundary.
• Acknowledge critical calls so the sender knows the message landed.
• Re-brief after any material change instead of relying on assumptions.
• Protect assertive calls from rank, customer pressure or embarrassment.

Use personal minimums before the legal minimums

Legal limits are not always enough for a particular pilot, aircraft, crew or site. Personal and operational minimums help prevent a pilot from negotiating with the limit while under pressure.

Examples include maximum gust spread, minimum battery reserve, maximum distance for reliable VLOS, minimum crew numbers for complex sites, a maximum number of concurrent tasks, or a rule that any lost-visual event triggers an immediate hold or landing.

• Write personal minimums before the job, not during the hard moment.
• Make the minimum measurable where possible.
• Brief the trigger and the action together.
• Tighten the minimum when fatigue, heat, glare, poor visibility or complex airspace increases workload.

Debrief the decision, not just the flight

A short debrief closes the learning loop. It should ask what changed, what was missed, which controls worked, which calls were useful and what the next operation should do differently.

This is study guidance, not legal advice. Use current CASA guidance, operator procedures and aviation reviewer advice when setting risk matrices, operational thresholds and reporting requirements.

• What was the strongest threat today?
• Which control gave us the most safety margin?
• Where did workload rise?
• What should be changed in the JSA, checklist or brief before next time?

Practice Questions