U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Voluntary Safety Management System Date: 08/04/23 AC No: 120-119 for Other Regulated Entities Transporting Initiated by: AXH-1 Dangerous Goods by Air This Advisory Circular (AC) provides information on how entities subject to requirements codified at Title 49 of the Code of Federal Regulations (CFR) parts 171-180 (e.g., entities performing functions such as, but not limited to, handling or shipping of dangerous goods by air and hereinafter referred to as “other regulated entities”) may choose to voluntarily implement a Safety Management System (SMS) as described in Title 14 CFR, part 5 – Safety Management Systems.
This document addresses general SMS principles and explains certain regulatory requirements outlined in 14 CFR part 5. Part 5 describes the general SMS framework and serves as a nonbinding basis for the development and implementation of voluntary SMS programs. This AC also provides guidance to organizations on how to use the SMS principles included in part 5 as a basis to develop and implement a voluntary SMS program and how to submit such a voluntary program to the FAA’s Office of Hazardous Materials Safety (AXH) for acceptance.
For context, an SMS is the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. An SMS is intended to be designed, developed, and integrated into existing operations and business decision-making processes. The SMS framework will assist an organization’s leadership, management teams, and employees in mitigating risks and making smarter, data-informed safety decisions.
This document provides non-binding recommendations on how to use existing requirements as a basis to develop a voluntary SMS program. The FAA encourages organizations to develop and implement SMS into their business processes in a way that is scalable to their unique operations, as there is not a one-size-fits-all SMS.
Daniel B. Supko Executive Director Office of Hazardous Materials Safety
DANIEL B SUPKO Digitally signed by
DANIEL B SUPKO Date: 2023.08.04 12:24:25 -04'00'
AC 08/04/23 1 20-119 Ta ble of Contents CHAPTER 1. INTRODUCTION
1-1. Purpose3
1-2. Background3
1-3. Applicability4
1-4. Related Reading Material4
1-5. A pplicability of the Freedom of Information Act (FOIA)4
1-6. Paperwork Reduction Act (PRA)4
1-7. Contact Information5
CHAPTER 2. FAA SAFETY MANAGEMENT SYSTEM (SMS) PRINCIPLES
2-1. Introduction6
2-2. Subpart A: General6
2-3. Subpart B: Safety Policy8
2-4. Subpart C: Safety Risk Management10
2-5. Subpart D: Safety Assurance13
2-6. Subpart E: Safety Promotion15
2-7. Subpart F: SMS Documentation and Recordkeeping16
CHAPTER 3. SMS IMPLEMENTATION PROCESS
3-1. Introduction17
3-2. Developing an SMS Implementation Plan17
3-3. Organizational SMS Implementation Plan Submissions and FAA Acceptance17
CH APTER 1. INTRODUCTION
1-1. PURPOSE. This Advisory Circular (AC) provides information for other regulated entities
(e.g., entities storing, packaging, handling, shipping, or performing other functions in support of transporting dangerous goods by air in accordance with Title 49 of the Code of Federal Regulations (CFR) parts 171-180) choosing to voluntarily implement a Safety Management System (SMS).
Accordingly, compliance with the recommendations in this document or with the guidance material discussed in this document does not relieve regulated entities from complying with applicable requirements outlined in the Hazardous Materials Regulations.
This guidance is not legally binding in its own right and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statutes and regulations.
This document addresses general SMS precepts and explains some of the regulatory requirements outlined in 14 CFR part 5. While part 5 does not apply to voluntary SMS programs, it describes the general SMS framework and serves as a non-binding basis for the development and implementation of voluntary SMS programs. This AC also provides guidance to organizations on how to use the SMS principles included in part 5 as a basis to develop and implement a voluntary SMS program and how to submit such a voluntary program to the FAA’s Office of Hazardous Materials Safety (AXH) for acceptance.
1-2. BACKGROUND.
a. About SMS. SMS is a formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. The defining characteristic of an SMS is that it is a decision-making system. An SMS is not a one-size-fits-all solution and does not have to be an extensive, expensive, or sophisticated array of techniques or procedures to be effective.
Rather, an SMS should be designed and implemented to address the operations of a specific organization. It is structured around four components: Safety Policy, Safety Risk Management, Safety Assurance, and Safety Promotion.
• Safety Policy. Documented commitment to safety, which defines an organization’s safety objectives and the accountabilities and responsibilities of its employees in regards to safety.
• Safety Risk Management (SRM). A process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk.
• Safety Assurance (SA). Processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls, and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.
• Safety Promotion. A combination of training and communication of safety information to support the implementation and operation of an SMS in an organization.
b. Shared responsibility. Aviation safety is not the sole or unique responsibility of any one 3
p arty. Instead, it results from the collaboration of all stakeholders, including but not limited to the government, air carriers, operators, airports, repair centers, other FAA certificate holders, other regulated entities, and other parties directly or indirectly participating in activities related to aviation or supported by aviation. Stakeholders’ internal processes, external interfaces, collaboration efforts, and integrated business processes impact the overall safety of the national airspace system.
1-3. A PPLICABILITY.
Large organizations with a national or global aviation focus. No regulation precludes an organization of any size from voluntarily implementing an SMS. This AC, however, provides guidance appropriate for large organizations with a national or global aviation focus that wish to establish a voluntary SMS to enhance safety due to the complexity of their operations or the volume of dangerous goods transported by air. Large organizations that may consider a voluntary SMS include, but are not limited to, those that process or offer dangerous goods cargo for air transportation, regardless of whether they are labeled as such, shippers, e-commerce companies, freight forwarders, ground handlers, and/or distribution centers, and may have a significant impact in national or global aviation. The FAA encourages these organizations to use the principles addressed in this AC to develop an SMS to identify, analyze, mitigate, and control risks. An SMS is particularly useful for those business processes within an organization that interface with and have the potential to introduce risk into the aviation system.
1-4. RELATED READING MATERIAL. For descriptive information of SMS design and international safety management best practices, please refer to the current version of ICAO Doc 9859 – Safety Management Manual, AC 120-92 – Safety Management Systems for Aviation Service Providers, and other available reference material located on the FAA’s SMS website at https://www.faa.gov/about/initiatives/sms/.
1-5. APPLICABILITY OF THE FREEDOM OF INFORMATION ACT (FOIA). Title 49 U.S.C. 44735 offers statutory protection from disclosure under the Freedom of Information Act, pursuant to 5 U.S.C. 552(b)(3), for certain reports, data, or other information that are submitted to the FAA voluntarily and that are not required to be submitted to the Administrator under any other provision of law. Section 44735(b)(4) extends the limitation on disclosure to ‘‘reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator.’’ Section 44735(b)(5) also extends the limitation on disclosure to ‘‘reports, analyses, and directed studies, based in whole or in part on reports, data or other information’’ related to the development and implementation of a safety management system.
1-6. PAPERWORK REDUCTION ACT (PRA). A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the PRA unless that collection of information displays a currently valid Office of Management and Budget (OMB) Control Number. The OMB Control Number for this information collection is 2120-0811. All responses to this collection of information are voluntary.
1-
7. CONTACT INFORMATION. For additional information, suggestions, and for voluntary SMS implementation plan submissions, please contact the FAA Office of Hazardous Materials Safety at 9-ASH-AXH-SMS@faa.gov.
CH APTER 2. F AA SAFETY MANAGEMENT SYSTEM (SMS) PRINCIPLES
2-1. INTRODUCTION. This chapter is structured around the SMS principles outlined in 14 CFR part 5. Part 5 applies to certificate holders under 14 CFR part 119 authorized to conduct operations in accordance with the requirements of part 121. Other regulated entities may choose to adopt voluntarily an SMS. The FAA welcomes such voluntary implementation of SMS.
The information provided herein serves as a non-binding basis for the development and implementation of such a voluntary SMS program. The following sections provide guidance to organizations on how to use the SMS principles included in part 5 as a basis to develop and implement their voluntary SMS programs. The SMS requirements are organized within a framework of four essential components: Safety Policy, SRM, SA, and Safety Promotion. The components work together to provide a systematic approach to managing the safety risk. This chapter also contains short descriptions of each SMS component, along with the following information to enhance understanding:
a. Regulatory Text Box. An excerpt of 14 CFR part 5 regulatory text is included for reference and ease of understanding, without the need to cross-reference additional documents. For the purposes of this AC, consider the term “certificate holder” as your “organization.”
Organizations base their voluntary SMS on the principles and processes established in part 5.
b. Discussion. This section includes supporting information and best practices as it relates to implementing an SMS.
2-2. SUBPART A: GENERAL.
a. Applicability: Audience.
§ 5.1 Applicability.
(a) A certificate holder under part 119 of this chapter authorized to conduct operations in a ccordance with the requirements of part 121 of this chapter must have a Safety Management S ystem that meets the requirements of this part and is acceptable to the Administrator by March 9, 2
018.
(b) A certificate holder must submit an implementation plan to the FAA Administrator for review n o later than September 9, 2015. The implementation plan must be approved no later than March 9, 201
6.
(c) T he implementation plan may include any of the certificate holder’s existing programs, policies, or p rocedures that it intends to use to meet the requirements of this part, including components of a n e xisting SMS.
Discussion. The SMS required by 14 CFR part 5 was intended to apply to part 121 certificate holders; however, for the purposes of this AC, consider the term “certificate holder” as your “organization”. The deadlines indicated in the excerpt are not applicable to this AC. That said, to initiate the voluntary process of implementing an SMS within your organization, and ultimately gain FAA acceptance of your voluntary SMS, your organization is expected to develop and submit an SMS implementation plan to the FAA Office of Hazardous Materials Safety. (Refer to Chapter 1, paragraph 1-7, for FAA contact information.)
b. General Requirements.
§ 5 .3 General requirements .
(
a)
(1) S afety policy in accordance with the requirements of subpart B of this part;
(2) S afety risk management in accordance with the requirements of subpart C of this part;
(3) S afety assurance in accordance with the requirements of subpart D of this part; and
(4) S afety promotion in accordance with the requirements of subpart E of this part.
An y certificate holder required to have an SMS under this part must submit the Safety Management System to the Administrator for acceptance. The SMS must be appropriate to the size, scope, and complexity of the certificate holder’s operation and include at least the following components:
(b) T he Safety Management System must be maintained in accordance with the recordkeeping r equirements in subpart F of this part.
(c) T he Safety Management System must ensure compliance with the relevant regulatory s tandards in chapter I of Title 14 of the Code of Federal Regulations.
Discussion. The SMS should be scalable to the operation of the organization. The difference between a large, medium, and small organization’s SMS is primarily one of size, scope, and complexity of the operations to be covered, volume of data available, the size of the employee workforce, and the resources needed to manage the organization. The SMS tenets, with respect to the four components, are the same regardless of the size of your organization. The SMS functions within each component do not need to be extensive or complex to be effective. All businesses, regardless of size, may use existing systems, programs, and resources to document and track safety issues to resolution.
c. Definitions: Standardized SMS Terms § 5.5 Definitions.
49 CFR 830.2.
H azard means a condition that could foreseeably cause or contribute to an aircraft accident as defined in Risk means the composite of predicted severity and likelihood of the potential effect of a hazard.
Risk control means a means to reduce or eliminate the effects of hazards.
Safety assurance means processes within the SMS that function systematically to ensure the performance a nd effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives t hrough the collection, analysis, and assessment of information.
Safety Management System (SMS) means the formal, top-down, organization-wide approach to m anaging safety risk and assuring the effectiveness of safety risk controls. It includes systematic p rocedures, practices, and policies for the management of safety risk.
Safety objective means a measurable goal or desirable outcome related to safety.
Safety performance means realized or actual safety accomplishment relative to the organization's safety o bjectives.
Safety policy means the certificate holder's documented commitment to safety, which defines its safety o bjectives and the accountabilities and responsibilities of its employees in regards to safety.
Safety promotion means a combination of training and communication of safety information to support t he implementation and operation of an SMS in an organization.
Safety Risk Management means a process within the SMS composed of describing the system, i dentifying the hazards, and analyzing, assessing and controlling risk.
Discussion. This section contains standardized terms and definitions used in an SMS.
Organizations use these terms within their SMS to facilitate a common safety language and support communication and collaboration.
2-3. SUBPART B: SAFETY POLICY.
a. Safety Policy § 5.21 Safety policy.
(a) Th e certificate holder must have a safety policy that includes at least the following:
1) T he safety objectives of the certificate holder.
2) A c ommitment of the certificate holder to fulfill the organization's safety objectives.
3) A clear statement about the provision of the necessary resources for the implementation o f the SMS.
4) A safety reporting policy that defines requirements for employee reporting of safety h azards or issues.
5) A p olicy that defines unacceptable behavior and conditions for disciplinary action.
6) A n emergency response plan that provides for the safe transition from normal to e mergency operations in accordance with the requirements of §5.27.
(b) Th e safety policy must be signed by the accountable executive described in § 5.25.
(c) T he safety policy must be documented and communicated throughout the certificate hol der organization.
(d) T he safety policy must be regularly reviewed by the accountable executive to ensure it r emains relevant and appropriate to the certificate holder.
Discussion. Safety Policy is the documented commitment to safety, which defines an organization’s safety objectives and the accountabilities and responsibilities of its employees in regards to safety. Essentially, safety policy is a concise document from the accountable executive that conveys the organization’s basic commitments to safety management. It provides a basis for more detailed setting of objectives for planning and performance measurement, assignment of responsibility, and reporting, including clear statements regarding behavioral and performance expectations. The safety policy may be supported by additional documents that expand in specific areas, and, where applicable, it may also set out procedures.
b. Safety Accountability and Authority.
§ 5.23 Safety accountability and authority.
(a) T he certificate holder must define accountability for safety within the organization’s safety policy f or the following individuals:
(1) A ccountable executive, as described in § 5.25.
(2) A ll members of management in regard to developing, implementing, and maintaining S MS processes within their area of responsibility, including, but not limited to:
(
i) H azard identification and safety risk assessment.
( ii) A ssuring the effectiveness of safety risk controls.
( iii) P romoting safety as required in subpart E of this part.
( iv) A dvising the accountable executive on the performance of the SMS and on any need f or improvement.
(3) E mployees relative to the certificate holder’s safetyperformance.
(b) T he certificate holder must identify the levels of management with the authority to make de cisions regarding safety risk acceptance.
Discussion. This SMS process requires defined accountability for achieving safety performance 8
o bjectives within the organization’s safety policy for all levels of the organization’s staff.
“Accountability” as used here, refers to active management and line employee involvement and action in managing and maintaining safety performance. An organization defines accountability by ensu ring each of its management and line employees is aware of his or her specific role within SMS and actively participates in carrying out his or her SMS-related duties.
c. Designation and Responsibilities of Required Safety Management Personnel.
§ 5 .25 Designation and responsibilities of required safety management personnel .
(a) D esignation of the accountable executive. The certificate holder must identify an accountable e xecutive who, irrespective of other functions, satisfies thefollowing:
(1) I s the final authority over operations authorized to be conducted under the certificate hol der’s certificate(s).
(2) C ontrols the financial resources required for the operations to be conducted under the cer tificate holder’s certificate(s).
(3) C ontrols the human resources required for the operations authorized to be conducted under t he certificate holder’s certificate(s).
(4) Re tains ultimate responsibility for the safety performance of the operations conducted under t he certificate holder’s certificate.
(b) R esponsibilities of the accountable executive. The accountable executive must accomplish the f ollowing:
(1) E nsure that the SMS is properly implemented and performing in all areas of the certificate hol der’s organization.
(2) D evelop and sign the safety policy of the certificateholder.
(3) Co mmunicate the safety policy throughout the certificate holder’sorganization.
(4) R egularly review the certificate holder's safety policy to ensure it remains relevant and a ppropriate to the certificate holder.
(5) R egularly review the safety performance of the certificate holder’s organization and direct a ctions necessary to address substandard safety performance in accordance with § 5.75.
(c) D esignation of management personnel. The accountable executive must designate sufficient m anagement personnel who, on behalf of the accountable executive, must be responsible for the f ollowing:
(1) C oordinate implementation, maintenance, and integration of the SMS throughout the c ertificate holder’s organization.
(2) F acilitate hazard identification and safety risk analysis.
(3) M onitor the effectiveness of safety risk controls.
(4) E nsure safety promotion throughout your organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
Discussion. The success of the SMS is reliant on the appropriate designation of safety personnel within an organization. It is important to consider identifying a person in the organization who holds the ultimate decision-making authority over the organization’s operations. This person is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. In smaller organizations, the accountable executive may personally participate in, or directly supervise, operational processes.
This individual may serve in multiple positions within the company. In larger organizations, the accountable executive is responsible for ensuring that management personnel are clearly designated for ensuring the safety of operational and safety management processes.
In addition to designating the accountable executive, organizations should ensure that sufficient personnel are available to provide support for essential SMS functions, such as analysis, assistance 9
to operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive. These responsibilities may be carried out as collateral duties by managers, or the organization could assign the tasks of supporting SMS functions to other personnel. For example, some organizations may choose to use their existing required management personnel to fulfill these responsibilities. Other organizations may organize a Safety Department with a number of persons, or use existing personnel within each operational division. Personnel designated to perform this function should have direct access to the accountable executive to report on the safety performance of the operation and recommend any necessary improvements.
d. Coordination of Emergency Response Planning.
Discussion. The plan should provide procedures for management decision-making and action in an emergency. This should include a line of succession of management authority sufficient to respond to emergencies. Coordination of your emergency response plans with the emergency response plans of other organizations might include first responders to accidents or incidents, and dangerous goods authorities. The plan might also address how your organization returns or transitions to normal operations after the emergency condition subsides. Many organizations already have emergency response plans that may be used to fulfill this requirement.
2-4. SUBPART C: SAFETY RISK MANAGEMENT.
a. Applicability: Requirements to Apply SRM.
§ 5.27 Coordination of emergency response planning.
W here emergency response procedures are necessary, the certificate holder must develop and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) D elegation of emergency authority throughout the certificate holder’s organization;
(b) As signment of employee responsibilities during the emergency;and
(c) C oordination of the certificate holder’s emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.
§ 5.51 Applicability.
A certificate holder must apply safety risk management to the following:
(a) I mplementation of new systems.
(b) Re vision of existing systems.
(c) D evelopment of operational procedures.
(d) I dentification of hazards or ineffective risk controls through the safety assurance processes in subpart D o f this part.
Discussion. SRM is a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk. To know when the SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets that are directly related to the organization’s safety activities. Examples of such systems could include:
• Relationships with vendors and customers to control risk in air transportation;
• Classification of Dangerous Goods;
• Prevention of undeclared or misdeclared shipments;
• C argo acceptance and rejection procedures;
• Controls to prevent unintended risk entering the aviation system;
• Internal Interfaces;
• Safety risk introduced by external interfacing entities;
• Ground handling and servicing;
• Distribution center operations;
• Cargo handling;
• Training;
• Analysis of unintended events;
• Robotics;
• Software to detect properties of materials;
• Software to detect known suspicious shippers;
• Procedures for new vendors;
• Inspection and verification processes for new business relationships;
• Weight and Balance;
• UAS Delivery; or
• Automation.
Within these systems are subsystems. Some examples of subsystems include training curricula and programs, self or third-party auditing, process controls, software system designs, process auditing, and reporting follow-up processes.
The SRM process is triggered when proposed new systems or changes to existing systems are being considered. For example, changes to your operation could include the addition of locations of operations; opening or closing of facilities; adding or changing contractual arrangements for services, new vendors or customers; additions or modification of products; addition of different types of operations (such as cargo consolidation); acceptance of dangerous goods; delivery by UAS; or other types of changes. Major changes to a system are not all that will trigger the SRM process. That process is also triggered by any revision of an existing system, development of new operational procedures, or identification of hazards or ineffective risk controls. However, the level of SRM scrutiny appropriate for smaller changes to a system may be significantly less than what is required for major changes. This AC does not address SRM processes and procedures not related to aviation operations.
b. System Analysis and Hazard Identification.
§ 5.53 System analysis and hazard identification.
(a) When applying safety risk management, the certificate holder must analyze the systems identified in §
5.51. Those safety analyses must be used to identify hazards under paragraph (c) of this section, an d developing and implementing risk controls related to the system under § 5.55(c).
(b) I n conducting the system analysis, the following information mustbe considered:
(1) F unction and purpose of the system.
(2) T he system’s operating environment.
(3) A n outline of the system’s processes and procedures.
(4) Th e personnel, equipment, and facilities necessary for operation of the system.
(c) T he certificate holder must develop and maintain processes to identify hazards within the context of t he system analysis.
Di scussion. System analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by describing the system. (This can be accomplished through flowcharting the system or providing some other written description.) Th e hazard identification process flows from the system analysis. In hazard identification, you would ask: What could go wrong with your organization’s processes, under typical or abnormal operational conditions, that could cause or contribute to an unintended incident or accident?
c. Safety Risk Assessment and Control.
§ 5.55 Safety risk assessment and control.
(a) T he certificate holder must develop and maintain processes to analyze safety risk associated with t he hazards identified in § 5.53(c).
(
b) The certificate holder must define a process for conducting risk assessment that allows for the d etermination of acceptable safety risk.
(c) T he certificate holder must develop and maintain processes to develop safety risk controls that are n ecessary as a result of the safety risk assessment process under paragraph (b) of this section.
(
d) The certificate holder must evaluate whether the risk will be acceptable with the proposed safety r isk control applied, before the safety risk control is implemented.
Discussion. The safety risk analysis consists of determining the severity and likelihood associated with identified hazards using an appropriate quantitative or qualitative method. For each identified hazard, define the potential for injury and damage that may result from an incident related to operating while exposed to the hazard. In order to determine potential for injury and damage, you need to define the likelihood of occurrence of an incident or accident, and severity of the injury or damage that may result. It is important to remember that the likelihood and severity do not refer to the hazard, but to a potential occurrence (accident or incident) related to the hazard.
Once the risk is analyzed, you should assess whether the risk is acceptable. Remember this includes an assessment of the risk once interfaced into the aviation system. The aviation supply chain relies on and trusts each entity in the chain to prevent the introduction of a hazard.
After hazards and associated risk are fully understood, risk controls should be designed to mitigate the risk to an acceptable level. Examples of risk controls include new processes, equipment, completed training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any of a number of other system changes. In short, risk controls can include anything that would lessen the likelihood or severity of a potential incident/accident. Next, look at the system with the proposed control in place to determine if the level of risk is now acceptable, and the proposed control does not introduce unintended consequences or new hazards.
The risk remaining is commonly referred to as residual risk.