Knowledge / Risk and reliability

Formal Safety Assessment in shipping: from risk to regulatory options

Apply IMO FSA reasoning to a hypothetical fleet, including exposure, risk-control options, gross and net cost-effectiveness and uncertainty.

On this page

Formal Safety Assessment, or FSA, connects the description of maritime hazards with an evaluation of possible risk-control measures and recommendations for decision-makers. Its value is not a single benefit-cost ratio. It is an explicit argument about the problem, evidence, alternatives, uncertainty and distribution of effects. This educational guide develops a wholly hypothetical fleet example rather than reproducing an actual IMO submission. No example value is a current regulatory threshold, and no recommendation here constitutes an IMO decision.

Understand the purpose and current reference

IMO’s FSA overview identifies five steps: hazard identification, risk assessment, risk-control options, cost-benefit assessment and recommendations for decision-making. The page currently points to MSC-MEPC.2/Circ.12/Rev.2. Checked on 6 October 2026, that reference is dated 9 April 2018. FSA supports rule-making and comparison of possible changes; completing an FSA does not itself create a binding rule or approve a particular ship’s arrangement.

An analyst should therefore separate three things: the study’s findings, the policy recommendation and the authority’s eventual decision. A technically attractive option may raise questions about implementation, enforcement, transition or distribution of costs. Those questions are not defects to be hidden from the calculation. They are part of making the result useful. A study that starts with the preferred regulation and works backward toward supportive numbers has lost the discipline the framework is meant to provide.

Define the fleet, exposure and baseline

For an original teaching example, assume a fleet of 1,000 comparable ships observed over a ten-year evaluation horizon, giving 10,000 ship-years of modelled exposure if the fleet remains constant. Define the vessel types, operating conditions and existing controls before estimating risk. A result derived from one ship category should not silently be extended to another with different cargo, machinery, crew tasks or trading patterns. The fleet boundary determines what the numbers mean.

The baseline should represent the specified existing situation and applicable requirements, with explicit assumptions about compliance and future change. A proposal cannot claim the benefits of controls already included in the baseline. If new ships and existing ships face different retrofit constraints, separate them. Record exclusions such as shore-side effects or particular operating modes, and explain whether another assessment covers them. Unstated exclusions can make an apparently favourable option incomplete.

Identify scenarios before selecting controls

Begin with how harm can occur, using operational knowledge, incident evidence and structured analysis. In the hypothetical fleet, suppose the study focuses on one generic machinery-related accident family. Identify its initiating events, escalation pathways, affected people and environmental or property consequences. Avoid defining the problem solely as “absence of device X,” because that framing assumes the solution before comparing alternatives.

A hazard workshop should preserve minority concerns and unresolved evidence questions. Its output needs enough detail to distinguish materially different paths, such as loss of a support service versus a failed protective action. FMEA, fault trees, event trees, HAZOP and human-task analysis can answer different parts of the problem. FSA provides a decision framework within which these methods may contribute; it does not make their assumptions disappear or require every study to use the same analytical tool.

Turn incident information into an exposure-based estimate

Incident counts require denominators and consistent definitions. Ten events mean different things across 100 ship-years and 100,000 ship-years. Reporting coverage, changes in classification and the inclusion of near misses can also affect apparent trends. Distinguish the accident frequency from expected fatalities per unit exposure: the latter includes the consequence distribution, not just whether an accident occurred.

IMO’s casualty information page describes the GISIS Marine Casualties and Incidents module and investigation reports. These are potential evidence sources, not a guarantee that a downloaded sample is complete or directly representative. No GISIS dataset was downloaded for this article. A real study should document its search, inclusion rules, exposure source, missing information and coding checks so that another analyst can reproduce the evidence base.

Build risk measures that match the decision

Assume, solely for the worked example, that the baseline expected fatality rate for the selected accident family is 0.0001 fatalities per ship-year. Across 10,000 ship-years, the model gives one expected fatality. This is a statistical expectation over exposure, not a prediction that exactly one named person or one ship will suffer a fatal event. The same expected value can arise from different accident-severity distributions, which may matter to the decision.

Keep measures for fatalities, injuries, pollution and property effects distinguishable. Combining them into money requires explicit choices and must not hide non-monetized concerns. A fleet-wide average can also conceal unequal exposure: some crew groups, ship types or coastal communities may carry more risk. Report the relevant distribution rather than assuming that a lower average answers every safety question. State which pathways the model includes and where uncertainty remains substantial.

Develop genuinely different risk-control options

Suppose option A targets a particular escalation mechanism and is assumed to reduce the selected expected fatality measure by 40%. Option B targets another mechanism and is assumed to reduce it by 20%. Both percentages are invented and require evidence in a real study. Define what each option changes physically or operationally, how it would be implemented and what new failure modes or workload it might introduce.

Include a clearly defined baseline and meaningful alternatives rather than comparing only variants of a favoured device. Consider whether the same objective could be achieved through design, operation, maintenance or a combination. Check technical feasibility and enforcement before assigning a benefit. A control that works only in a demonstration but cannot be maintained across the fleet may have much lower realized effect. Implementation assumptions belong in the risk model, not only in an appendix about logistics.

Explain gross and net cost-effectiveness

The revised IMO FSA guidelines discuss Gross Cost of Averting a Fatality, GCAF, and Net Cost of Averting a Fatality, NCAF. Using additional cost ΔC, monetized economic benefit ΔB and expected fatalities averted ΔR, the indices are ΔC/ΔR and (ΔC − ΔB)/ΔR. The guideline’s illustrative criteria are not timeless universal limits; a study must state its selected basis.

For the original example, assume A has €2.0 million in additional lifecycle cost and €0.5 million in economic benefit, both already expressed on the same present-value and currency-year basis. Its expected fatalities averted are 0.4. GCAF is therefore €5.0 million per expected fatality averted and NCAF €3.75 million. For B, assume cost €1.2 million, benefit €0.2 million and fatalities averted 0.2: the respective values are €6.0 million and €5.0 million. These are arithmetic illustrations, not acceptance findings.

Avoid adding overlapping benefits

If A and B act independently on successive parts of the same modelled risk, their combined residual fraction might be 0.6 × 0.8 = 0.48. The reduction is then 52%, not 40% + 20% = 60%. This is one explicitly assumed model, not a general rule for combining controls. Shared causes or overlapping mechanisms could produce another result. The combined option must be assessed rather than assembled by adding favourable percentages.

Under that hypothetical model, B added after A averts another 0.12 expected fatalities. If B’s incremental net cost remains €1.0 million, its incremental NCAF is about €8.33 million, rather than the standalone €5.0 million. Cost interactions might also change this result. The example shows why the order and baseline of comparison matter. Report both standalone options and relevant combinations, and avoid presenting an average ratio as though it were the incremental value of the next investment.

Keep monetary assumptions and distribution visible

Specify the price base, currency conversion, evaluation horizon, discounting method, retrofit timing, maintenance cost and residual value assumptions. Do not mix nominal future costs with real present-value benefits. If a measure creates downtime during installation, include the relevant economic consequence under the stated perspective. If costs fall on owners while benefits accrue mainly to crews or coastal communities, show that distribution rather than hide it in a fleet total.

A negative NCAF can occur when estimated economic benefits exceed costs while risk reduction is positive. That does not mean risk is negative, nor does it make an option automatically the best safety measure. A very small denominator can produce a large-magnitude ratio. Inspect the absolute risk reduction, cost and benefit separately. Also distinguish real resource savings from financial transfers so that the same benefit is not counted twice from different stakeholders’ perspectives.

Test the recommendation against uncertainty

Suppose A’s actual reduction could be 20–50% rather than exactly 40%, with the same invented €2.0 million cost. Its gross ratio ranges from €10 million to €4 million per expected fatality averted, before considering uncertainty in baseline risk or cost. These are scenario bounds, not confidence limits. The recommendation should explain whether it remains favourable under credible combinations and which assumptions could reverse the ranking.

Examine uncertainty in reporting, future exposure, causal models, control effectiveness, compliance and human performance. A new technology may lack enough service history to support a precise failure estimate. Separate evidence from judgment and identify a possible staged implementation or monitoring need where appropriate. Do not let a narrow sensitivity study around the preferred central case conceal plausible structural alternatives. The decision-maker needs to know where confidence comes from and where it does not.

Deliver a reviewable recommendation, not a slogan

A useful conclusion identifies the preferred option or conditional shortlist, its expected effect, major uncertainties, implementation requirements and remaining concerns. Provide enough model and data documentation for technical review. Explain discrepancies with other studies rather than selecting only the study with the most attractive ratio. Independent review should challenge scenario coverage, calculations, transfer assumptions and the correspondence between the proposed measure and its claimed effect.

The study remains evidence for a decision. It does not replace the IMO process, applicable instruments or vessel-specific approval. For the hypothetical fleet, the most valuable result is an auditable comparison showing why benefits cannot simply be added and why uncertainty affects the recommendation. A credible FSA makes disagreement inspectable: readers can locate the assumption, compare an alternative and see what changes. That transparency is more useful than an apparently definitive number unsupported by a reproducible argument.

Sources