# AC 120-92D: Safety Management Systems for Aviation Service Providers - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Current - Approved: May 21, 2024 - Family: AC 120-92 - Pages: 148 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID190440063620240523203202.0001 - Page: https://openairdocs.org/ac/120-92 ## Versions - AC 120-92D (Current), approved May 21, 2024 - AC 120-92B Ed Update (Historical), approved Jun 24, 2015 - AC 120-92B (Historical), approved Jan 8, 2015 - AC 120-92A (Historical), approved Aug 12, 2010 - AC 120-92 (Historical), approved Jun 22, 2006 ## Text ### Page 1 U .S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Safety Management Systems for Aviation Service Providers Date: 5/21/24 AC No: 120-92D Initiated by: AFS-900 Change: This advisory circular (AC) provides information on implementing a Safety Management System (SMS) based on Title 14 of the Code of Federal Regulations (14 CFR) part 5 for aviation service providers operating or applying for a certificate or Letter of Authorization (LOA) to operate under 14 CFR part 91, § 91.147 o r part 121 or 135. This AC may also be used by aviation organizations interested in receiving Federal Aviation Administration (FAA) acknowledgement of their voluntary development and implementation of an SMS that meets part 5 requirements. Additionally, part 5 provides organizations with a method to meet the International Civil Aviation Organization (ICAO) Annex 19, Safety Management, fra mework for an SMS “acceptable to the State.” An SMS is an organization-wide, comprehensive, and preventive approach to ensuring system saf ety. An SMS includes a safety policy, promotion of a positive safety culture, formal methods for identifying hazards and mitigating risk, and assurance of the overall safety performance of aviation organizations. An SMS is intended to be designed and developed so the aviation organization’s employees are able to manage risks as a part of the operations and business decision-making processes. An SMS assists an aviation organization’s leadership, management teams, and employees in making effective and informed safety decisions. Part 5 specifies a basic set of processes integral to an effective SMS but does not specify particular methods for implementing these processes. In other words, it defines what must be accomplished but not how it must be accomplished. This AC provides guidance on how an SMS may be developed to achieve the safety performance objectives outlined by an aviation organization. As is demonstrated by this AC, there is no one-size-fits-all method for complying with the requirements of part 5 or establishing a voluntary SMS. This is intentional because the FAA expects each organization to develop an SMS that works for their unique operation. This AC provides guidance regarding designing, developing, and implementing an SMS and the acceptable methods of compliance with the requirements of part 5 as well as developing a voluntary SMS. However, these methods are not the only means of complying with part 5 or implementing a voluntary SMS. Hugh T homas for Lawrence Fields Executive Director, Flight Standards Service ### Page 2 ii CONTENTS Paragraph Page Chapter 1. Introduction … 1-1 1.1 Purpose of This Advisory Circular (AC) … 1-1 1.2 Audience … 1-1 1.3 Where You Can Find This AC … 1-2 1.4 What This AC Cancels … 1-2 1.5 Effective Date … 1-2 1.6 Implementation Strategies … 1-2 1.7 Contact Information … 1-2 1.8 Terminology … 1-2 1.9 AC Feedback Form … 1-2 Chapter 2. Safety Management System (SMS) Foundations … 2-1 2.1 SMS Fundamentals … 2-1 2.2 Conceptual Overview of Safety Assurance and SRM … 2-2 2.3 Safety Assurance and Interactions With SRM … 2-3 2.4 SRM … 2-4 2.5 Safety Culture and Safety Management … 2-5 2.6 Definitions … 2-6 Chapter 3. Safety Management System (SMS) Components Explained … 3-1 3.1 Overview of This Chapter … 3-1 3.2 Subpart A, General … 3-2 3.3 Subpart B, Safety Policy … 3-11 3.4 Subpart C, Safety Risk Management … 3-26 3.5 Subpart D, Safety Assurance … 3-43 3.6 Subpart E, Safety Promotion … 3-59 3.7 Subpart F, SMS Documentation and Recordkeeping … 3-63 Chapter 4. Implementation: Building A Safety Management System (SMS) … 4-1 4.1 Process Overview … 4-1 4.2 Building an SMS … 4-1 ### Page 3 iii Chapter 5. Integrating Existing Safety Programs Into the Safety Management System (SMS) … 5-1 5.1 Purpose of This Chapter … 5-1 5.2 Discussion of Individual Programs … 5-1 5.3 Use of Third-Party Providers to Assist in SMS Implementation and Maintenance … 5-4 Appendix A. SMS Cross-Reference From Part 5 to the ICAO Framework … A-1 Appendix B. Sample Safety Risk Management (SRM) Worksheets … B-1 Appendix C. Guidance for Developing a Safety Policy and Code of Ethics Statement … C-1 Appendix D. Guidance for Developing a Compliance Statement … D-1 Appendix E. Identifying the Accountable Executive … E-1 Appendix F. Safety Attributes … F-1 Appendix G. Small Operator Implementation … G-1 Appendix H. References and Additional Information … H-1 Appendix I. Acronyms and Abbreviations … I-1 List of Figures Figure 2-1. Safety Management Decision-Making Processes … 2-3 Figure 3-1 . Hazard Notification Process … 3-41 Figure B-1. Safety Risk Management Triggering Conditions and Summary … B-2 Figure B-2. S ystem Analysis … B-3 Figure B-3. H azard List … B-4 Figure B-4. R isk Analysis … B-5 Figure B-5 . Risk Analysis and Assessment Summary … B-6 Figure B-6. R isk Control … B-7 Figure B-7. Risk Control Documentation … B-8 Figure C-1. Sample Safety Policy and Code of Ethics Statement … C-2 Figure E-1. A ccountable Executive Decision Process … E-2 Figure E-2. V erifying the Accountable Executive … E-3 ### Page 4 iv List of Tables Table 3-1. Sample Risk Matrix … 3-34 Table A-1. Part 5 to ICAO SMS Framework Cross- Reference … A-1 Table D-1 . Sample Compliance Statement for Aviation Organizations That Are Required to Maintain a Manual System … D-2 Table D-2 . Sample Compliance Statement for Aviation Organizations That Are Not Required to Maintain a Manual System … D-3 Table F-1 . Safety Attributes and Part 5 Reference … F-6 Table G-1. Small Aviation Organization Implementation Strategies and Considerations … G-2 ### Page 5 **1-1 CHAPTER 1. INTRODUCTION** 1.1 Purpose of This Advisory Circular (AC). This AC provides information to assist aviation organizations including but not limited to those regulated under Title 14 of the Code of Federal Regulations (14 CFR) parts 91, 121, 125, 133, 135, 137, 141, 142, 145, and 147 in developing a Safety Management System (SMS) that meets the regulatory requirements of 14 CFR part 5 or in developing a voluntary SMS. It describes an acceptable means, but not the only means, to implement and maintain an SMS. Complying with part 5 assists organizations in meeting the SMS standards of the International Civil Aviation Organization (ICAO), as published in ICAO Annex 19, Safety Management.1 The contents of this document do not have the force and effect of law and are not meant to bind the public in any way, and the document is intended only to provide information to the public regarding existing requirements under the law or agency policies. This AC may also be used by aviation organizations interested in developing a voluntary SMS. 1 ICAO safety management standards require service providers of airplanes over 27,000 kilograms (kg) to include a Flight Data Analysis (FDA) program as part of their SMS. Part 5 does not require these programs. However, operators desiring to implement a flight operations quality assurance (FOQA) (the FAA equivalent to FDA) program on a voluntary basis can obtain FAA approval for these programs. For more information, refer to AC 120-82, Flight Operational Quality Assurance. 1.1.1 Int egration. An SMS is not meant to be a separate system built alongside or on top of other business systems. An SMS should be integrated into existing business structures to support system safety. A properly integrated SMS fosters a fundamental and sustainable change in how aviation organizations view and analyze data and information, how informed decisions are made, and how new operational and business methods are developed. An effective SMS can assist aviation organizations in meeting other regulatory requirements. However, aviation organizations that develop an SMS meeting part 5 requirements should remain aware that an SMS is not a substitute for compliance with other Federal regulations. Note: It is not the intent or purpose of an SMS to override any existing regulatory stand ards or alter approval and acceptance processes that already apply to the aviation organization. SMS requirements are in addition to any existing statutory or regulatory obligations. 1.2 Audience. This AC is directed to the following aviation organizations operating under 14 CFR who are designing, developing, and implementing an SMS: 1. Existing and prospective Air Carrier Certificate holders and Letter of Authorization (LOA) holders to whom part 5 is applicable (part 91, § 91.147 and parts 121 and 135). 2. Other aviation organizations such as, but not limited to, parts 91, 125, 133, 137, 141, 142, 145, and 147 who m ay want a Federal Aviation Administration (FAA)-acknowledged voluntary SMS. ### Page 6 1-2 1.3 Where You Can Find This AC. You can find this AC on the FAA’s website at https://www.faa.gov/regulations_policies/advisory_circulars and the Dynamic Regulatory System (DRS) at https://drs.faa.gov. 1.4 What This AC Cancels. AC 120-92B, Safety Management Systems for Aviation Service Providers, dated January 8, 2015, is canceled. 1.5 Effective Date. The effective date of this AC is May 28, 2024. 1.6 Implementation Strategies. As a performance-based rule, part 5 describes a desired end state but does not generally prescribe the means for achieving that end state. Because aviation organizations range widely in complexity, each aviation organization implementing an SMS to comply with part 5 should tailor its SMS policies, methods, and procedures as needed. This concept is widely referred to as scalability. Although an aviation organization is free to adjust its means of achieving compliance with all sections of part 5, this scalability does not allow the aviation organization to set aside any sections of part 5. This AC will provide useful considerations and some examples of how an aviation organization may integrate new practical, economical, and effective SMS methods and procedures that complement their existing operations and processes while leveraging the policies, procedures, or methods already in place that comply with part 5. 1.7 Contact Information. For additional information or suggestions, contact the Safety Analysis and Promotion Division, Flight Standards Safety Management System (SMS) Program Office at 9-NATL-SMS-ProgramOffice@faa.gov. 1.8 Terminology. Throughout this AC, the term “aviation organization” is used. The FAA uses this term to mean the operator, service provider, certificate holder (CH), or other entity subject to or voluntarily complying with part 5 requirements. 1.9 AC Feedback Form. For your convenience, the AC Feedback Form is the last page of this AC. Note any deficiencies found, clarifications needed, or suggested improvements regarding the contents of this AC on the Feedback Form. ### Page 7 **2-1 CHAPTER 2. SAFETY MANAGEMENT SYSTEM (SMS) FOUNDATIONS** 2.1 SMS Fundamentals. 2.1.1 What is an SMS? An SMS is a formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. An SMS does not have to be an extensive, expensive, or sophisticated array of techniques to do what it is supposed to do. Rather, an SMS is built by structuring safety management around four components: safety policy, Safety Risk Management (SRM), safety assurance, and safety promotion. A brief description of these components is provided below. 2.1.2 S afety Policy . Safety policy is where an aviation organization sets objectives, assigns responsibilities, and sets standards for the organization and employees. It is also where management conveys its commitment to the safety performance of the organization to its employees. As SRM and safety assurance processes are developed, the aviation organization revisits the safety policy to ensure that the commitments in the policy are being realized and the standards are being upheld. 2.1.3 S afety Risk Management (SRM) . The SRM component provides a decision-making process for identifying hazards and mitigating risk based on a thorough understanding of the organization’s systems and their operating environment. SRM includes decision making regarding what level of safety risk is acceptable. The SRM component is the organization’s way of fulfilling its commitment to consider risk in their operations and to eliminate risk or reduce it to an acceptable level. In that sense, SRM is a design process and a way to incorporate risk controls into processes, products, and services or to redesign controls where existing ones are not meeting the organization’s expectations. 2.1.4 S afety Assurance. Safety a ssurance provides aviation organizations with the necessary processes to promote confidence that the system is meeting defined safety objectives and that implemented mitigations or existing risk controls are working. In safety assurance, the goal is to monitor what is going on and review what has happened to ensure safety objectives are being met. Thus, safety assurance requires monitoring and measuring safety performance of operational processes and continuously improving the level of safety performance. Strong safety assurance processes will yield information used to maintain the integrity of risk controls. Safety assurance processes are thus a means of assuring the safety performance of the organization, keeping it on track, and identifying needs for rethinking (or correcting) existing processes. 2.1.5 S afety Promotion . The last component, safety promotion, is designed to ensure that employees have a solid understanding regarding their safety responsibilities and the aviation organization’s safety policies and expectations, reporting procedures, and risk controls. Thus, training and communication are key areas of safety promotion. 2.1.6 S ummary . An SMS does not have to be large, complex, or expensive in order to add value. Active involvement of operational leaders, maintaining open lines of ### Page 8 2-2 communication up and down the aviation organization and among peers, staying vigilant in looking for new hazards and identifying associated risks, and ensuring that employees know that safety is an essential part of their job performance are key elements that can have a positive effect on the aviation organization’s SRM decisions. 2.2 Conceptual Overview of Safety Assurance and SRM. 2.2.1 Graphical Overview of Safety Assurance and SRM Processes. Figure 2-1, Safety Management Decision-Making Processes, provides an expanded view of the principal processes of the SMS: safety assurance and SRM. In the discussion that follows, some key terms and concepts related to SMS processes will be introduced. A more detailed discussion of the SRM and safety assurance processes is presented below each regulatory requirement in Chapter 3, Safety Management System (SMS) Components Explained. Because safety management is a decision-making process, SRM and safety assurance follow a structured set of processes outlined in Figure 2-1. ### Page 9 2-3 Figure 2-1. Safety Management Decision-Making Processes 2.3 Safety Assurance and Interactions With SRM. 2.3.1 Safety assurance processes monitor the day-to-day life cycle of system operations, (System Monitoring) with the designed risk controls in place. A variety of data sources (Data Acquisition), such as audits, investigations, and employee reporting, are utilized. These will be further explained in Chapter 3. The safety assurance process involves ### Page 10 2-4 several steps. Once the data has been obtained, the process owner analyzes the data that will be used in decision making (Analysis of Data). The decision making can result in several possible outcomes (System Assessment). If the data and analysis indicate the processes, procedures, and integrated risk controls are functioning as intended, the result is satisfactory, and management can have confidence that organizational goals and safety objectives are being met. 2.3.2 If a negative result is identified, the organization should continue the analysis to determine if the shortfall is due to the controls not being used as intended (e.g., required training not accomplished, procedures not followed, or improper tools or equipment provided). If a negative result is identified and the system is being used as intended, the system is not producing the expected results. In the former case, action should be taken to correct the problem (Corrective Action). In the latter case, system design should be reconsidered using the path back to the SRM process. 2.3.3 The identification of a new hazard or ineffective risk control during the safety assurance process requires an organization to initiate the SRM process. For organizations transitioning into an SMS, the SRM process may initially be challenging if their operational systems have not been built using a risk management process because they may lack formal or well-understood risk controls. 2.3.4 Managers or process owners who are responsible for operational processes are also responsible for assuring that their process areas are performing as intended from an aviation safety standpoint. **2.4 SRM.** 2.4.1 In SRM, the first step, System Analysis, is used to understand the processes and procedures being developed or revised or where new hazards or changes of the operational environment have been identified. The system analysis needs to consider the operating environment, the personnel involved in the operation, the equipment being used, any training needed, operational procedures, and interfaces with other processes or procedures. In most cases, hazard identification flows from this system analysis. Hazard identification requires process owners to ask questions such as: 1. What hazards exist in the operational environment? 2. What are the human factors (HF) issues of the operation (e.g., workload, distraction, fatigue, or system complexity)? 3. What are the limitations of the hardware, software, procedures, etc.? 2.4.2 Although Figure 2-1 above depicts these processes as distinctly defined components, they flow from one to the other in practice. For example, in a careful discussion of how a system currently works (System Analysis), hazards will often become evident. Thus, the Hazard Identification step has also been at least partially accomplished. 2.4.3 The process owner then conducts an analysis of the potential consequences of operation in the presence of the identified hazards (Risk Analysis). This culminates in an ### Page 11 2-5 assessment of the acceptability of operating with these hazards (Risk Assessment) or whether or not the risk of such operations can be eliminated or mitigated to an acceptable level (Risk Control). Operational managers or process owners2 must be the ones who are accountable for risk acceptance and mitigation decisions. 2 An organization may need to identify those personnel who “manage processes” but are not necessarily managers with a place on the organizational chart. Field experience has proven that the process owner terminology is necessary to allow aviation organizations to develop protocols that keep simple design change decisions at the level appropriate to the acceptance of risk. 2.4.4 After a system has been designed or revised using the SRM process, special attention should be given to the new or revised system using the safety assurance process. It should not be surprising to find at this time that there are still things that might not have been considered or that there are changes over time in the operational environment that require a return to SRM. Thus, the SRM and safety assurance processes operate in a continuous exchange. 2.5 Safety Culture and Safety Management. The culture of an organization is demonstrated through the organization’s values, traits, and behaviors. The term “safety culture” is used to describe those aspects of the organization’s culture relating to its safety performance. An organization that has a positive safety culture embraces open communication and continuous improvement. Management’s consistent attention, commitment, involvement, and visible leadership are essential in guiding an organization toward a positive safety culture. A positive safety culture matures as safety management skills are learned, practiced, and become second nature across the entire organization. The following are practices and characteristics of organizations that foster a positive safety culture. 2.5.1 Open Reporting. Organizations should have policies and processes that foster open reporting while stressing the need for continuous diligence and professionalism. Organizations should encourage disclosure of error without fear of reprisal (as long as the issue being reported was not caused through intentional misconduct or gross negligence) and should demand accountability on the part of employees and management alike. Part 5 requirements include provisions for aviation organizations to discuss hazard reporting in their safety policy (part 5, § 5.21(a)(4)) and in their safety assurance processes (§ 5.71(a)(7)). 2.5.2 Just Culture. The organization should engage in identification of systemic errors, implement preventative corrective action, and exhibit intolerance of undesirable behaviors, such as intentional misconduct or willful disregard for established procedures. This is often referred to as a “just culture.” A just culture can be defined as a values-centered model of shared accountability, which will result in higher levels of confidence in safety outcomes at all levels of an organization. Organizations with a just culture encourage open communication that is nonretributive and encourages employees to admit mistakes so corrective actions can be implemented and potential hazards reduced. The following characteristics have an effect on an organization’s just culture. ### Page 12 2-6 2.5.2.1 Personnel Involvement. Involvement of personnel at all levels of an organization is critical to effective safety management. All employees who are directly involved with aviation safety play a key role in hazard identification and open communication. 2.5.2.2 Use of Information. Effective use of relevant information ensures informed management decision making. 2.5.2.3 Commitment to Risk Reduction. Management directly involves itself in identifying hazards and managing risk. 2.5.2.4 Vigilance. Processes that monitor ongoing operations and the environment increase effectiveness of risk controls and awareness of emerging hazards. 2.5.2.5 Flexibility. The organization uses information effectively to adjust and change to reduce risk and is willing to commit resources to making changes necessary to reduce risk. 2.5.2.6 Learning. The organization learns from its own failures and from those of allied and similar businesses. The organization uses acquired data to feed analysis processes and assess performance, the results of which yield information that can be acted on to improve safety. 2.5.2.7 Code of Ethics. A code of ethics is a set of principles designed to help aviation professionals conduct aviation operations honestly, with integrity, and with safe operations at the core of all decisions. 2.5.2.8 Safety Attributes. System safety attributes are the core characteristics that are integrated into all processes and procedures. For additional discussion, see Appendix F, Safety Attributes. 2.5.3 Management Involvement. An organization’s employees look to executive leadership to demonstrate their visible commitment to and involvement in safe operation while performing their daily work. SMS processes do not have to be expensive or sophisticated; however, active personal involvement of operational leaders is essential. Effective safety management is accomplished by those individuals who “own” the processes in which risk resides. Safety cultures also cannot be “created” or “implemented” by management decree no matter how sincere their intentions. Every organization has a safety culture. It is embodied in the way the organization and its members approach safety in their jobs. If positive aspects of culture are to emerge, the organization’s senior management must set up the policies and processes that create a working environment that fosters safe behavior, and they should lead by example. 2.6 Definitions. The following definitions are used throughout this AC. 2.6.1 Compliance Statement. A document developed by an aviation organization that states how the organization complies with part 5. For specific information on developing a ### Page 13 2-7 compliance statement, see Appendix D, Guidance for Developing a Compliance Statement. 2.6.2 De c laration of Compliance. A document submitted to the FAA that declares the aviation organization has developed and implemented an SMS in compliance with part 5 whether required by regulation or implemented voluntarily. 2.6.3 H azard . A condition or an object that could foreseeably cause or contribute to an incident or aircraft accident as defined in Title 49 of the Code of Federal Regulations (49 CFR) part 830, § 830.2. 2.6.4 Person. The term “person” is defined in 14 CFR part 1, § 1.1 as “an individual, firm, partnership, corporation, company, association, joint-stock association, or governmental entity. It includes a trustee, receiver, assignee, or similar representative of any of them.” This definition includes certificate holders (CH), service providers, or other types of individuals or business entities and is used throughout 14 CFR. For the purposes of part 5, the term “person” can be used to refer to an individual or to an aviation organization. 2.6.5 P rocess Owner . The individual responsible for ensuring that one or more process areas are performing as intended from an aviation safety standpoint. 2.6.6 Ri sk . The composite of predicted severity and likelihood of the potential effect of a hazard. 2.6.7 R isk Control . A means to reduce or eliminate the effects of hazards. 2.6.8 Safety Assurance. Processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information. 2.6.9 S afety Management System (SMS) . The formal, top-down, organization-wide approach to managing safety risk and ensuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. 2.6.10 S afety Objective . A measurable goal or desirable outcome related to safety. 2.6.11 Safety Performance. Realized or actual safety accomplishment relative to the organization’s safety objectives. 2.6.12 S afety Policy . The person’s documented commitment to safety, which defines their safety objectives and the accountabilities and responsibilities of its employees in regard to safety. 2.6.13 S afety Promotion. A combination of training and communication of safety information to support the implementation and operation of an SMS in an organization. ### Page 14 2-8 2.6.14 Safety Risk Management (SRM). A process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk. 2.6.15 S ystem Safety . The application of technical and managerial skills to the systematic, forward-looking identification and control of hazards throughout the life cycle of a project, program, or activity. The primary objective of system safety is accident prevention. ### Page 15 **3-1 CHAPTER 3. SAFETY MANAGEMENT SYSTEM (SMS) COMPONENTS** **EXPLAINED** 3.1 Overview of This Chapter. SMS requirements are organized around the four components of safety management. These components are broken down into subparts of 14 CFR part 5 (e.g., Part 5 Subpart B, Safety Pol icy). This chapter contains a description of each SMS requirement contained in part 5. After the title of each requirement, where appropriate, the following information is provided. 3.1.1 References. This pa ragraph contains references for part 5. Where applicable, other related regulatory requirements are provided for cross-reference purposes. These other regulatory references are hyperlinked for ease of access. 3.1.2 Regulatory Text Box. A copy of the part 5 regulatory tex t for reference. The discussions in this chapter apply equally to aviation organizations subject to part 5 requirements and those seeking to implement a voluntary SMS. Note 1: T he word “person” in the regulatory text box typically refers to the aviation organization. When a specific individual is required to be identified, the regulatory language will use the term “individual.” Note 2: This AC does not include guidance on part 5 regulations applicable only to type certificate holders (TCH) and licensees and production certificate holders (CH) under 14 CFR part 21. For info rmation applicable to a ircraft certification products and service providers, refer to AC 21-58, Safety Management Systems for Part 21 Type and Production Certificate Holders. 3.1.3 Discussion. A more detailed plain language explanation of the process as it relates to the SMS. It includes some examples, when appropriate, and offers optional recommended design characteristics. 3.1.4 Implementation Strategies. 3.1.4.1 A short discussion, where applicable, of potential methods different-sized aviation organizations could use to meet the pertinent SMS requirements that could be scaled to the size and complexity of their organization. The Safety Management International Collaboration Group (SM ICG) SMS for Small Organizations3 document defines a small organization as one with between 5 and 20 staff and a very small organization as one with less than 5 staff. The FAA has not defined these organizations because an SMS is designed to be adaptable based on the size and complexity of the organization. So, it is possible for an organization to be very small but highly complex, and a large organization could be low complexity based on the aviation activity they are involved with. 3 SM ICG guidance documents can be downloaded from https://skybrary.aero/enhancing-s afety/sm-icg-safetymanagement-products. ### Page 16 3-2 3.1.4.2 Aviation organizations are each unique, not only in organizational structure and the equipment operated and maintained but also in management structure and, very often, in management style. Therefore, a one-size-fits-all approach to scaling the aviation organization’s response to each section of part 5 is not advisable. This AC stresses the importance of recognizing aviation organizations have different operational environments and different levels of resources. Less complex organizations could use simple methods for conducting the processes within the SMS. More complex organizations may require more detailed processes within the SMS. 3.1.4.3 For organizations that have only a single pilot or technician and perhaps minimal support staff to carry out daily responsibilities, this AC suggests utilizing a commonsense approach to SMS implementation and maintenance. In the case of a single-pilot operator, that single pilot could be the one to develop, implement, and use the SMS processes. At medium and large organizations, the complexity and departmentalization of duties may require that more personnel be involved in the SMS. Regardless of the organization’s size, many aviation organizations will find their existing processes and procedures can serve as the foundation for portions of their SMS. Integration of these existing processes should be used as much as practical. Note: Implementation strategy discussions are for illustration only and neither impose requirements nor mandate specific resource allocation by an aviation organization. Aviation organizations should integrate methods and procedures that best fit their organizational structure and that leverage processes and procedures already in place to the greatest extent possible. 3.1.5 C onsiderations for Small and Single -Individual Organizations. Where appropriate, additional guidance and recommendations are provided for small and single-individual organizations. 3.1.6 Example. Throughout this chapter, w e will use fictional aviation service provider Flyslow Aviation as an example of how a typical organization could integrate part 5 requirements into their operations. 3.2 Subpa rt A , G eneral. 3.2.1 Applicability: Who Is Required to Implement an SMS. 3.2.1.1 References. Section 5.1 and 14 CFR part 91, § 91.147 and part 119, § 119.8. ### Page 17 3-3 3.2.1.2 Part 5 Requirement. § 5.1, Applicability. This part applies to all of the following: (a) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 121 of this chapter. (b) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 135 of this chapter. (c) Any person that holds or applies for a Letter of Authorization issued under § 91.147 of this chapter. 3.2.1.3 Discussion. SMSs should be applied to the aviation operational processes of the organization. For example, the aviation operational processes in a typical aviation organization may include: • Flight operations, • Operational control (dispatch/flight following), • Maintenance and inspection, • Parts receiving inspections, • Calibrated tooling procedures, • Cabin safety, • Ground handling and servicing, • Cargo handling, • Training, and • Recordkeeping. Note: Information concerning implementation planning for aviation organizations wanting to develop an SMS under part 5 is outlined in greater detail in Chapter 4, Implementation: Building a Safety Management System (SMS). 3.2.2 Definitions. 3.2.2.1 References. Section 5.3. 3.2.2.2 Part 5 Requirement. § 5.3, Definitions. Hazard means a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident, as defined in 49 CFR 830.2. Risk means the composite of predicted severity and likelihood of the potential effect of a hazard. ### Page 18 3-4 Risk control means a means to reduce or eliminate the effects of hazards. Safety assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information. Safety Management System (SMS) means the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. Safety objective means a measurable goal or desirable outcome related to safety. Safety performance means realized or actual safety accomplishment relative to the organization’s safety objectives. Safety policy means the person’s documented commitment to safety, which defines its safety objectives and the accountabilities and responsibilities of its employees in regards to safety. Safety promotion means a combination of training and communication of safety information to support the implementation and operation of an SMS in an organization. Safety Risk Management means a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk. 3.2.2.3 Discussion. These definitions apply to the use of these terms throughout part 5. 3.2.3 General Requirements. 3.2.3.1 References. Section 5.5. 3.2.3.2 Part 5 Requirement. § 5.5, General requirements. (a) SMS components. An SMS under this part must be appropriate to the size, scope, and complexity of the person’s organization and include, at a minimum, all of the following components: (1) Safety policy that meets the requirements of subpart B of this part. (2) Safety risk management that meets the requirements of subpart C of this part. (3) Safety assurance that meets the requirements of subpart D of this part. (4) Safety promotion that meets the requirements of subpart E of this part. (b) Continuing requirements. Any person required to develop and implement an SMS under this part must maintain the SMS in accordance with this part. 3.2.3.3 Discussion. Implementing an effective SMS requires an organization to fully understand its structure, processes, business arrangements, and interfaces that impact the Safety Risk Management (SRM) of aviation safety. While not regulatory, developing an organizational description should be the first step in SMS development. An organizational description is a summary of the organization’s processes, activities, and interfaces that need to be considered as a part of their SMS. It describes the aviation system, the interfaces within the organization, and the interfaces with external organizations that contribute to the safe delivery of aviation services. As organizations mature and grow, it is important to ensure the SMS continues to adapt and remain effective to changing requirements. Reviewing the organizational description and ### Page 19 3-5 interfaces that may have changed as well as updating operational processes and procedures ensures the aviation organization’s SMS continues to perform as designed. 3.2.4 R equirements for Domestic, Flag, and Supplemental Operations. 3.2.4.1 References. Sections 5.7 and 119.8. 3.2.4.2 Part 5 Requirement. § 5.7, Requirements for domestic, flag, and supplemental operations. (a) Any person authorized to conduct operations under part 121 of this chapter that has an SMS acceptable to the FAA on or before May 28, 2024, must revise its SMS to meet the requirements of this part no later than May 28, 2025. (b) Any person applying for authorization to conduct operations under part 121 of this chapter or with such application pending on or after May 28, 2024, must develop and implement an SMS that meets the requirements of this part. (c) Any person required to develop and implement an SMS under this section must maintain the SMS as long as the person is authorized to conduct operations under part 121 of this chapter. (d) Any person required to develop and implement an SMS under this section must make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part. 3.2.4.3 Discussion. 3.2.4.3.1 Title 14 CFR part 121 aviation organizations are required to meet updated part 5 requirements within 12 months of the effective date of this rule. Part 121 operators are required to revise their SMS to meet the new requirements in § 5.3 (definitions) by updating the definition of “hazard” and in §§ 5.21(a)(7) (s afety policy code of ethics), 5.53(b)(5) (SR M interfaces), 5.57 (notification of hazards to interfacing persons), 5.71(a)(7) (employee confidential reporting system), 5.71(a)(8) (investigations of hazard notifications that have been received from external sources), and 5.97(d) (SMS records). Part 121 aviation organizations will provide any required revisions to their SMS processes in accordance with existing submission procedures. 3.2.4.3.2 N ew part 121 applicants must meet part 5 requirements as a part of the certification process as defined in the Air Operator and Air Agency Certification and Application Process in FAA Order 8900.1, Volume 2, Chapter 4, The Certification Process—Title 14 CFR Part 135.4 The certification project manager (CPM) will brief the new applicants on the SMS requirements during initial meetings. For guidance on preparing a compliance 4 Order 8900.1 is available online on the FAA’s Dynamic Regulatory System (DRS) at https://drs.faa.gov/. ### Page 20 3-6 statement, see Appendix D, Guidance for Developing a Compliance Statement. 3.2.5 Requirements for Commuter and On-Demand Operations or Passen ger-Carrying Flights for Compensation or Hire. 3.2.5.1 References. Sections 5.9, 91.147, and 119.8. 3.2.5.2 Part 5 Requirement. § 5.9, Requirements for commuter and on-demand operations or passenger-carrying flights for compensation or hire. (a) Any person authorized to conduct operations under part 135 of this chapter or that holds a Letter of Authorization issued under § 91.147 of this chapter before May 28, 2024, must: (1) Develop and implement an SMS that meets the requirements of this part no later than May 28, 2027. (2) Submit to the FAA, a declaration of compliance with this part in a form and manner acceptable to the Administrator no later than May 28, 2027. (b) Any person applying for authorization to conduct operations under part 135 of this chapter or a Letter of Authorization under § 91.147 of this chapter, or with such application pending on or after May 28, 2024, must develop and implement an SMS that meets the requirements of this part. (c) Any person required to develop and implement an SMS under this section must maintain the SMS as long as the person is authorized to conduct operations under either part 135 or § 91.147 of this chapter. (d) Any person required to develop and implement an SMS under this section must make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part. 3.2.5.3 Discussion. Within 36 months of the effective date of the part 5 requirements, 14 CFR part 135 and § 91.147 air tour operators with a Letter of Authorization (LOA) must submit a declaration of compliance to their FAA certificate management office (CMO) as evidence the organization has met the requirements of part 5. 3.2.5.3.1 A declaration of compliance is a legal document that states the aviation organization has developed and implemented an SMS that meets the part 5 requirements. 3.2.5.3.2 A declaration of compliance must contain the following information: 1. The name of the aviation organization and its certificate number (if applicable). 2. The physical address of the aviation organization. 3. A statement that the aviation organization has developed and implemented an SMS that meets the requirements of part 5. ### Page 21 3-7 3.2.5.3.3 The declaration of compliance must be signed by the accountable executive or another senior member of management. 3.2.5.3.4 Once the FAA receives the declaration of compliance, the CMO will update the organization’s status in an internal FAA database noting that they have an SMS or a voluntary SMS that meets part 5 requirements. Validation of SMS performance will occur as a part of routine surveillance activities. Areas found deficient will be addressed using existing methods for ensuring compliance with the regulatory requirements. 3.2.5.3.5 Upon development and implementation of an SMS, if an operator that has an existing SMS through a voluntary SMS or a third-party provider realizes a manual change is required, then they must submit those changes in accordance with existing regulations and procedures. 3.2.5.3.6 Organizations not required to maintain a manual system need to document their SMS policies and procedures as well as record outputs of their SRM and safety assurance processes in accordance with §§ 5.95 and 5.97. 3.2.5.3.7 New part 135 applicants must meet part 5 requirements as a part of the certification process. The CPM will brief the new applicants on the SMS requirements during initial meetings. For guidance on preparation of a compliance statement, see Appendix D. More information on the certification process is contained in the Air Operator and Air Agency Certification and Application Process in Order 8900.1, Volume 2, Chapter 4. 3.2.5.3.8 New § 91.147 LOA applicants must meet part 5 requirements as part of the LOA issuance process as defined in § 91.147(b). Additional requirements for the issuance of LOA A049, Commercial Air Tour Operations Authorization and Drug and Alcohol Testing Program Registration, are described in Order 8900.1, Volume 3, Chapter 18, Operations Specifications. 3.2.6 Single-Pilot SMS Exceptions. 3.2.6.1 References. Section 5.9(e). 3.2.6.2 Part 5 Requirement. § 5.9, Requirements for commuter and on-demand operations or passenger-carrying flights for compensation or hire. (e) The following requirements do not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: §§ 5.21(a)(4), 5.21(a)(5), 5.21(c), 5.23(a)(2), 5.23(a)(3), 5.23(b), 5.25(b)(3), 5.25(c), 5.27(a), 5.27(b), 5.71(a)(7), 5.93, and 5.97(d) of this part. ### Page 22 3-8 3.2.6.3 Discussion. 3.2.6.3.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory sections are excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft. 1. Section 5.21(a)(4): A policy that defines the employee hazard reporting program. 2. Section 5.21(a)(5): A policy that defines unacceptable behavior and conditions for disciplinary action. 3. Section 5.21(c): A documented and communicated safety policy. 4. Section 5.23(a)(2): A requirement to identify all members of management in the organization. 5. Section 5.23(a)(3): A requirement to identify and define the safety accountability for all employees in the organization. 6. Section 5.23(b): Identifies the levels of management with the authority to make decisions regarding safety risk acceptance. 7. Section 5.25(b)(3): A requirement for the accountable executive to communicate the safety policy throughout the organization. 8. Section 5.25(c): Designation of management personnel. 9. Section 5.27(a): Delegation of emergency authority. 10. Section 5.27(b): Assignment of employee responsibilities during the emergency. 11. Section 5.71(a)(7): A requirement to have a confidential employee reporting program. 12. Section 5.93: A procedure for communicating safety-related information throughout the organization. 13. Section 5.97(d): A requirement to retain records of communications provided under § 5.93. 3.2.6.3.2 SMSs are important for organizations of all sizes. SMSs are designed to be scalable and flexible for organizations of various sizes and complexity; small organizations have different needs and challenges. In an organization such as one with a single pilot where a sole individual performs all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft, trying to meet every unique requirement defined in part 5 would not be feasible as some are written for multiperson organizations. ### Page 23 3-9 Note: Single-pilot organizations and those with a single individual responsible for the SMS of the organization that have excepted requirements will be further discussed in the specific discussions that follow. For example, a single individual might be the sole employee in a small repair station. 3.2.6.3.3 These exceptions are built around sole-individual organizations and provide relief from activities that would be typical in a multi-individual organization. If you look closely at the excepted sections of part 5, they are all addressing communication and some recordkeeping requirements. The excepted sections also address management duties and responsibilities throughout an organization that would not be present in a single-individual organization. These exceptions are limited to aviation organizations with a sole individual performing all necessary functions in the conduct and execution related to or in direct support of the safe operation of the aircraft. All necessary functions generally include the performance of work related to flight crewmember duties for part 135 and LOA holders under § 91.147. The Safety Management System Voluntary Program (SMSVP) will also provide this exception for other entities who are sole individuals performing all the necessary functions applicable to them (e.g., mechanics or repair stations conducting aircraft maintenance). 3.2.6.3.4 External vendors contracted to aid or provide a service (e.g., in routine aircraft handling, such as FBO services (fueling and towing) or airworthiness (annual inspections and unscheduled maintenance)) are not a part of the organization and would not have any bearing as to the applicability of these exceptions. These excepted areas would also apply to a repair station with a sole individual implementing a voluntary SMS. As an example, vendors contracted to maintain calibrated tools are not directly involved in the performance of the aviation service and would not be considered employees. These exceptions do not remove the requirements of § 5.57 for hazard information sharing or the receipt of hazard information in § 5.71(a)(8). 3.2.6.3.5 Determination of whether or not the exception applies can be determined by defining the organization requiring the SMS and who within the organization accomplishes all the necessary functions relating to or in direct support of the safe operation of the aircraft. 3.2.6.3.6 For example, part 145, § 145.151 requires designation of an accountab le manager as well as definition of employees who perform the service. To have the exception, one person would have to act in all of these capacities, as well as be the accountable executive under part 5, as each has a role in the conduct and execution related to or in direct support of the safe operation of the aircraft. ### Page 24 3-10 3.2.6.3.7 The following are the four key steps to determine if the excepted sections would apply to your organization: 1. Define the organizational structure. Is there more than one employee? 2. Identify the necessary functions. 3. Identify who is doing each function. 4. Is there more than one employee performing functions that could affect the safe operation of the product or service? If the answer is no, the excepted sections apply. Note 1: An organization could have someone who does not do any of the necessary functions but does other tasks within the organization (e.g., accounting, invoicing, answering phones, and cleaning). In this situation, the exceptions may still apply. Note 2: If the sole individual tracks and coordinates the completion of maintenance activities and utilizes a maintenance service provider to conduct those activities, such as annual inspections or unscheduled maintenance, the exception still applies. However, if the sole individual allows a service provider to track and/or coordinate the completion of maintenance activities, then the exception does not apply. 3.2.7 G eneral Applicability Example . 3.2.7.1 To meet the requirement to implement an SMS, Flyslow Aviation starts by reviewing their organization to consider the operating environment, personnel needed, any interfaces with other organizations and facilities, and materials needed to provide their aviation service or product. They may identify flight operations, maintenance, dispatch, and training departments as areas that support the aviation product or service. They might also identify external organizations that support the aviation product or service, such as fuel service providers, third-party maintenance, and catering. All this information would be documented in an organizational description that can be used to ensure all aviation-related areas are considered in the SMS development. 3.2.7.2 To ensure part 5 is fully integrated into the organization, Flyslow Aviation may develop a compliance statement for their internal tracking to document how they already meet the requirements of part 5. While not required for existing operators, a compliance statement makes identifying existing processes and procedures as well as existing methods and voluntary programs easier to verify when documenting how an organization meets the regulatory requirements. This is accomplished for all departments and areas identified in the organizational description. ### Page 25 3-11 3.3 Subpart B, Safety Policy. 3.3.1 Safety Policy. 3.3.1.1 References. Section 5.21. 3.3.1.2 Part 5 Requirement. § 5.21, Safety policy. (a) Any person required to have an SMS under this part must have a safety policy that includes at least the following: (1) The person’s safety objectives. (2) The person’s commitment to fulfill the safety objectives. (3) A clear statement about the provision of the necessary resources for the implementation of the SMS. (4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues. (5) A policy that defines unacceptable behavior and conditions for disciplinary action. (6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27. (7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority. (b) The safety policy must be signed by the accountable executive described in § 5.25. (c) The safety policy must be documented and communicated throughout the person’s organization. (d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the person. 3.3.1.3 Discussion. Part 5 requires aviation organizations to document their safety policy (where required). Many aviation organizations do this by using several documents to meet the requirements of this section. One technique used is to develop a safety policy and code of ethics statement, which is a concise document from the accountable executive that conveys the organization’s basic commitments to safety management. This document must include a code of ethics that specifies that safety is the organization’s highest priority and applies to all employees, including management personnel and officers. The safety policy and code of ethics statement should be viewed as a promotional document as it conveys the executive management’s commitment to safety and the organizational goals in communications to the workforce in a short one- or two-page document. It provides the basis for a more detailed setting of objectives for planning and performance measurement, assignment of responsibilities, and confidential hazard reporting, including clear statements regarding behavioral and performance expectations. Appendix C provides guidance on the development of a safety policy and code of ethics statement. 3.3.1.3.1 The safety policy and code of ethics statement may need to be supported by additional documentation that expands in some areas and, where applicable, ### Page 26 3-12 sets out specific organizational objectives and procedures. For aviation organizations not required to maintain manuals, the safety policy and code of ethics statement could be integrated into a compliance statement discussing how the organization meets the requirements. Some of these areas are the emergency response plan (ERP) and procedures for accessing and using the confidential hazard reporting program. 3.3.1.3.2 Section 5.21(a)(1) requires aviation organizations to develop safety objectives as part of their safety policy. Safety objectives should be measurable and not just inspirational statements, such as “We will strive to be the best,” “We will maintain a zero-accident rate,” etc. They may be based off key performance indicators or safety performance indicators and tracked by the safety assurance component of the organization’s SMS to ensure the organization’s objectives are being met. A technique that may work is to list the organization’s goals in the policy and point to the measurable safety objectives that support the goal(s) if they are located in another place in your manual system (if required). 3.3.1.3.3 The assessment process required by § 5.73 is where decisions are made regarding attainment of these objectives. In setting these objectives, this is a case where “starting with the end in sight” is sound advice. 3.3.1.3.4 O bjectives can fall into a number of categories, including: 1. Compliance with regulations. Compliance with all applicable FAA regulations is an expectation for all aviation organizations, and assurance of such compliance is an explicit requirement of the SMS (refer to § 5.71(a)(6)). 2. Milestones for implementation of safety-related programs or initiatives. This is a good area for development of safety objectives, which are measurable and provide early successes that can be shared with the workforce. 3. Reduction of error or incident rates. This is also an area that is easily monitored, and success can be identified and shared with the workforce. 4. Increased employee involvement through hazard or incident reporting programs. 5. Tracking of safety events. Certain events such as aircraft ground damage, pilot deviations (PD), Weight and Balance (W&B) errors, or maintenance errors may be targets for safety objectives and associated tracking and action. One caution with these types of measures is not to lose focus on risk factors that may be associated with potentially more serious events. 3.3.1.3.5 A key consideration for scalability of safety objectives is the relevance and achievability for the size and complexity of the organization. The most effective safety objectives are those setting specific safety goals reflecting the ### Page 27 3-13 organization’s safety vision and the management’s commitment to the systematic management of safety. In order for their effectiveness to be measured, safety objectives should be SMART,5 which means they should be: 5 The first known use of the term occurs in the November 1981 issue of Management Review by George T. Doran. Sp ecific, Measurable, Achievable, Relevant, and Timely. 3.3.1.3.6 Aviation organizations must have documentation (where required) that defines the requirements for employee reporting of safety hazards or issues. Processes and procedures describing how this is to be accomplished must also be included in the documentation. 3.3.1.3.7 Unacceptable behavior and conditions for disciplinary action also need to be documented (where appropriate). Aviation organizations should explain that gross negligence or deliberate misconduct are not protected behaviors and will not be tolerated. This may be documented in their SMS processes and procedures or could be located elsewhere, such as in a human resources manual. In any case, employees need to be made aware of where this policy can be located. 3.3.1.3.8 Aviation organizations must develop an ERP, which ensures normal SMS functions and risk acceptance continues when key personnel are removed from their normal risk management positions. This should include a line of succession, where required, of management authority sufficient to respond to emergencies. This plan should also address transition to normal operations after the emergency condition subsides. Additional discussion is located in paragraph 3.3.5. 3.3.1.3.9 The safety policy must include a code of ethics that specifies that safety is the organization’s highest priority and applies to all employees, including management personnel and officers. This requirement, while originally mandated for manufacturers under the Aircraft Certification Safety and Accountability Act of 2020, has been applied to all aviation organizations that are required to have an SMS that meets part 5 requirements. For additional discussion on how to develop a safety policy and code of ethics statement, see Appendix C. 3.3.1.3.10 Part 5 requires the accountable executive to sign the safety policy and code of ethics statement. This may be accomplished by signing the safety policy and code of ethics statement, safety policy processes and procedures, or both. A signature on one or both documents is indicative of the accountable executive meeting this requirement. If the safety policy and code of ethics statement is ### Page 28 3-14 incorporated into a compliance statement, the accountable executive must sign the compliance statement to meet the requirements of § 5.25(b)(2). 3.3.1.3.11 Aviation organizations are required to have documented processes and procedures describing how safety policy is communicated throughout the organization. This could be accomplished by inserting the safety policy and code of ethics statement in an employee handbook or another manual or making it available through computer-based documentation. Irrespective of how the aviation organization decides to communicate the safety policy, they need to ensure all employees engaged in the aviation service or product are aware of the organization’s safety policy. 3.3.1.3.12 Part 5 does not define the term “regularly” when it comes to the periodic review of the safety policy. It is expected that the aviation organization will determine and document an interval that is appropriate for the size and complexity of the operation. The accountable executive is required to review the safety policy and safety objectives to ensure they remain relevant (§§ 5.21(d) and 5.25(b)(4)). There should be evidence showing this review has been accomplished in the aviation organization’s records. 3.3.1.4 Implementation Strategies. The safety policy and code of ethics statement requirements are not expected to vary between aviation organizations; however, the processes and procedures described in § 5.95 SMS documentation and how they are documented could vary due to the complexity of the processes being described. The safety policy and code of ethics statement could be a part of the organization’s safety manual or included in other existing documentation or manuals. For aviation organizations not required to maintain manuals, it could be integrated into a compliance statement discussing how the organization meets the requirements. Under part 5, the safety policy and SMS processes and procedures only need to be documented. 3.3.1.4.1 When developing organizational goals and objectives, both financial and time resources can be limited, so the focus should be where resources will have the greatest safety benefit. This may be achieved by focusing safety goals on the top one, two, or three risks from the organization’s safety risk profile. In other words, focus on those things that keep you up at night. 3.3.1.4.2 Confidential reporting is an important part of encouraging a safety reporting culture in all organizations. Employees should know they can speak up because their personal information and reports are provided a level of protection. The practicality of this is obviously more difficult in a small organization where everybody often knows everybody’s business. If a just reporting culture is not in place, reporting may be limited because of the difficulty of ensuring confidentiality in a small organization. While not prohibited by the regulation, anonymous reporting does not allow the aviation ### Page 29 3-15 organization the ability to get additional information concerning the hazard or incident since the ability to reach out to the reporter is lost. 3.3.1.5 Considerations for Small and Single-Individual Organizations. The following part 5 requirements are excepted for single-pilot organizations. 1. Section 5.21(a)(4): A safety reporting policy that defines requirements for employee reporting of safety hazards or issues. 2. Section 5.21(a)(5): A policy that defines unacceptable behavior and conditions for disciplinary action. 3. Section 5.21(c): The safety policy must be documented and communicated throughout person’s organization. 3.3.1.5.1 Single-individual organizations will not have a confidential reporting program; however, they should have a way of recording and managing (§ 5.55) hazards they identify in the course of operations. 3.3.1.5.2 A single-individual organization is not required to have a process to communicate safety information throughout the aviation organization. 3.3.1.6 Examples. The following examples demonstrate ways aviation organizations might choose to implement §5.21(c) based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.3.1.6.1 For smaller, lower complexity organizations, the owner or most senior manager (the accountable executive) may personally perform this process. The policy statement can be a simple, often single-page, written document signed by the accountable executive. Small organizations typically operate in smaller networks of employees, so the policy may be posted in the organization’s work areas or included in organizational briefings or in training. 3.3.1.6.2 Aviation organizations on the higher end of the spectrum of complexity may require senior managers and technical staff to perform this process in addition to the accountable executive. While the regulations only require the accountable executive to sign the safety policy and code of ethics statement, members of senior management may also sign the safety policy and code of ethics statement. Large or highly complex aviation organizations may choose to disseminate their policy using a variety of resources, such as organizational websites, intranets, email, or existing indoctrination and recurrent training. ### Page 30 3-16 3.3.2 Safety Accountability and Authority. 3.3.2.1 References. Sections 5.23, 119.65, and 119.67; 14 CFR part 125, § 125.25; part 133, § 133.21; part 137, § 137.41; part 141, § 141.33; part 142, § 142.13; and part 145, § 145.151. 3.3.2.2 Part 5 Requirement. § 5.23, Safety accountability and authority. (a) Any person required to have an SMS under this part must define in its safety policy the accountability for safety of the following individuals: (1) Accountable executive, as described in § 5.25. (2) All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to: (i) Hazard identification and safety risk assessment. (ii) Assuring the effectiveness of safety risk controls. (iii) Promoting safety as required in subpart E of this part. (iv) Advising the accountable executive on the performance of the SMS and on any need for improvement. (3) Employees relative to the person’s safety performance. (b) The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance. 3.3.2.3 Discussion. “Accountability,” as used in this requirement, refers to active management and line employee involvement and actions in managing and maintaining organizational safety performance. An aviation organization demonstrates accountability by ensuring each of its employees are aware of their specific role within the SMS and that they actively participate in accomplishing their SMS-related duties. Once the SMS requirements for the employee positions have been established, part 5 subpart E requires that these requirements be communicated throughout the organization. The safety accountability process requires the aviation organization to define duties and responsibilities for achieving safety performance objectives within the organization’s safety policy for the following individuals. 3.3.2.3.1 A ccountable Executive. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are discussed in more detail in paragraph 3.3.3.3. 3.3.2.3.2 All Members of Management. Managers, who may also be process owners, are the individuals who are responsible for identifying hazards, conducting risk assessments, and developing risk controls for their areas of responsibility. They have the technical expertise and are the ones responsible for the implementation and operation of risk controls (often in the form of operational procedures, specified tools, training, communication, etc.). Process owners may not always be in a regulatorily required position as required by ### Page 31 3-17 §§ 119.65, 119.69, and 145.151 and might not appear on an organizational chart. Process owners, such as a battery shop manager or cargo manager, may have the technical expertise to manage the processes and procedures, and, if so, they would be able to accept risk in their functional area. A key element in the SRM process is to identify the levels of management with the authority to make risk decisions related to aviation safety. Thus, managers that have the authority to implement changes in systems and procedures should use the SMS processes in managing their area of operational responsibility. They are also responsible for ensuring the continuing operational safety of risk controls. Through data collection methods and analytical processes in the safety assurance component, managers are able to determine that risk controls are effective and that their safety performance is acceptable. For example, the Director of Maintenance (DOM) is one of the managers accountable for SMS within their area of responsibility. 3.3.2.3.3 Em ployees. All employees should be aware of the organization’s safety policies as well as the processes, procedures, and tools relevant to their responsibilities. They need to know how the confidential employee reporting system works. Employees at all levels of the organization have a responsibility to report hazards, issues, and concerns related to aviation safety as well as to propose solutions and safety improvements. Employees have a duty and responsibility to follow an organization’s processes and procedures. 3.3.2.4 Im plementation Strategies. The method for meeting these requirements could vary greatly between different organizations. The numbers and relationships of personnel will be unique to each organization, and the organizational structure and accountability should be appropriate to the aviation organization. 3.3.2.4.1 Aviation organizations are required to define the duties and responsibilities of the accountable executive. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are defined in § 5.25. 3.3.2.4.2 Aviation organizations need to define the duties and responsibilities of management (process owners) in their areas of the operation. 3.3.2.4.3 All employee safety-related duties and responsibilities must be documented (where required). They could be located in the safety manual or in another organizational document. The SMS documentation should point to where the requirement is located if it is in a place other than the safety documentation. 3.3.2.4.4 A key element in the SRM process is to identify the levels of management with the authority to make risk decisions related to aviation safety. The positions identified must have the knowledge and skills to determine the acceptability of risk in their functional areas. Managers that have the authority ### Page 32 3-18 to implement changes in systems and procedures should use the SMS processes in managing risk in their area of operational responsibility. 3.3.2.4.5 Accountability for all employees directly involved in delivering the aviation organization’s product or service should be defined. Employees at all levels of the organization have a responsibility to report hazards, issues, and concerns as well as to propose solutions and safety improvements. Employees have a duty and responsibility to follow an organization’s processes and procedures. 3.3.2.4.6 In single-individual organizations, the personnel structure will be very simple and consist of the person in charge being the accountable executive, who is responsible for ensuring all required duties and activities are accomplished. In a small organization, other management personnel should be identified since they would have a role in how the organization is managed on a day-to-day basis. 3.3.2.5 Considerations for Small and Single-Individual Organizations. The following part 5 requirements are excepted for single-pilot organizations: 1. Section 5.23(a)(2): All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to: (i) Hazard identification and safety risk assessment. (ii) Assuring the effectiveness of safety risk controls. (iii) Promoting safety as required in subpart E of this part. (iv) Advising the accountable executive on the performance of the SMS and on any need for improvement. 2. Section 5.23(a)(3): Employees relative to the person’s safety performance. 3. Section 5.23(b): The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance. 3.3.2.5.1 In single-individual organizations, this structure will be very simple and consist of the sole individual being the accountable executive and assuming the various roles and responsibilities, which would normally be assigned to other members of management. The single individual would also be responsible for accepting all risks associated with the aviation organization’s products or services. 3.3.2.5.2 As their organizational duties change, which could happen many times during the day, the single individual could be said to be changing hats as their role changes as they manage the activities required in § 5.23. 3.3.3 D esignation and Responsibilities of Required Safety Management Personnel. 3.3.3.1 References. Section 5.25(a) and (b). ### Page 33 3-19 3.3.3.2 Part 5 Requirement. § 5.25, Designation and responsibilities of required safety management personnel. (a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following: (1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization. (2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization. (3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization. (4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization. (b) Responsibilities of the accountable executive. The accountable executive must accomplish the following: (1) Ensure that the SMS is properly implemented and is performing across all pertinent areas. (2) Develop and sign the safety policy. (3) Communicate the safety policy throughout the person’s organization. (4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person. (5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75. 3.3.3.3 Discussion. 3.3.3.3.1 D esignation. 3.3.3.3.1.1 Section 5.25(a) requires the organization to identify an individual in the organization to be the accountable executive who holds the ultimate decision-making authority over the organization’s aviation-related operations. The accountable executive is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. A flowchart outlining a process for designating an accountable executive is available in Appendix E, Identifying the Accountable Executive. 3.3.3.3.1.2 When identifying the accountable executive, it is very important t o select an individual in the organization who holds the ultimate decision-making authority over the aviation organization’s operations. This individual is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. The organizational job title is not important when making this determination but rather the individual’s ### Page 34 3-20 responsibility to ensure appropriate resources are available and to accept risk for and oversee the aviation product or service. 3.3.3.3.2 R esponsibilities. As the ultimate authority in the organization, the accountable executive is responsible for the proper functioning of the SMS. This entails, among other things, keeping an open line of communication with the designated management personnel, providing sufficient resources for the SMS to function properly, and being actively involved in the safety assurance component of the SMS. 3.3.3.3.2.1 If an aviation organization chooses to integrate the safety policy an d code of ethics statement into a compliance statement, the accountable executive must sign the compliance statement to meet the requirements of § 5.25(b)(2). One way the aviation organization could define accountability for the accountable executive is by listing the duties and responsibilities identified in § 5.25 in a position description. These may be located in the SMS safety policy documentation or in another organizational manual, such as a human resources manual. If the duties and responsibilities are documented elsewhere, the safety policy should point to the location where they can be located. Smaller organizations could point to the regulatory requirements in § 5.25(b). 3.3.3.3.2.2 The accountable executive should maintain open lines of communication with the designated management personnel to ensure any identified hazards or issues are effectively communicated throughout the organization. Communicating the safety policy and code of ethics could be through publication of the safety policy statement in documentation employees have access to. It could also include periodic meetings where organizational information concerning the safety policy is shared with employees by the accountable executive and management. 3.3.3.3.2.3 The accountable executive must regularly review the safety performance of the organization. There should be documentation to show that it has occurred. The term “regularly” is not defined to specify an interval. Reviews should occur frequently enough for issues within the organization’s processes and procedures to be identified and corrected in a timely manner. This will vary based on the aviation organization’s size, scope, and complexity. 3.3.3.3.2.4 The accountable executive should designate sufficient management personnel to provide support for essential SMS functions, such as performing analysis, assisting operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive. ### Page 35 3-21 Personnel designated to perform this function should be in positions in the organization of sufficient independence to have direct access to the accountable executive to report on the safety performance of the operation and ability to recommend any necessary improvements. These individuals should be highly knowledgeable on the SMS and able to assist the process owners and functional area managers in accomplishing their SMS duties and responsibilities. This is not to say the management personnel are expected to accept risk in the functional areas, as they may not be the most qualified. The organization is not expected to add employees to fill this position either. These tasks could be accomplished by existing management personnel. 3.3.3.4 Implementation Strategies. The accountable executive is responsible for ensuring that sufficient management personnel are clearly designated for ensuring the safety of operational and SMS processes. When management personnel are designated, consideration should be given to ensure they are properly trained and qualified to perform the duties required of the position. 3.3.3.4.1 In smaller organizations, the accountable executive may directly supervise operational processes. This individual may serve in multiple positions within the organization. 3.3.3.4.2 It is unlikely that small organizations will have the resources for a designated representative to monitor the effectiveness of the SMS as a full-time position. A small organization may add the safety manager duties to an existing role (e.g., operations manager). In a single-individual operation, these duties would be filled by the accountable executive. 3.3.3.5 Considerations for Small and Single-Individual Organizations. Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft: Section 5.25(b)(3): Responsibilities of the accountable executive. The accountable executive must accomplish the following: Communicate the safety policy throughout the person’s organization. 3.3.4 D esignation of Management Personnel. 3.3.4.1 References. Sections 5.25(c), 119.65, 119.67, 145.151, and 145.153. ### Page 36 3-22 3.3.4.2 Part 5 Requirement. § 5.25(c), Designation of management personnel. (c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following: (1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization. (2) Facilitate hazard identification and safety risk analysis. (3) Monitor the effectiveness of safety risk controls. (4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part. (5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement. 3.3.4.3 Discussion. This section requires that the organization ensure that sufficient management personnel are available to provide support for essential SMS functions, such as performing analysis, assisting operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive. 3.3.4.3.1 When reviewing the designated management personnel required in § 5.25(c), the term “coordinate” means the management representative will aid other management personnel in the implementation and integration of the SMS throughout the organization. This position is not expected to “own” the SMS in the organization as everyone has a role and responsibilities to ensure proper functioning of the SMS. The term “facilitate” means the management representative will aid other process owners in hazard analysis and risk assessment. As they may not be a process owner, they are not expected to make risk-based decisions. The term “monitor” means the management representative will aid other process owners in determining if risk controls are functioning as designed. The duties and responsibilities listed above should be left to the process owners. 3.3.4.3.2 The designated management representative is expected to communicate safety information throughout the organization. Per § 5.97(d), a record of this activity should be retained so it can be validated during audits. 3.3.4.3.3 Designated management personnel are not necessarily subject matter experts (SME) in all areas of the aviation organization. Rather, they are personnel in a position to assist the process owners and management personnel with hazard identification and risk analysis, aid in communicating safety information throughout the organization, and monitor the effectiveness of safety risk controls. 3.3.4.3.4 Personnel designated to perform this function should be in positions in the organization with sufficient independence to have direct access to the ### Page 37 3-23 accountable executive to report on the safety performance of the operation and recommend any necessary improvements. 3.3.4.4 Implementation Strategies. These responsibilities may be carried by the accountable executive as defined in § 5.23(a)(1) or as collateral duties by managers referred to in § 5.23(a)(2), or the aviation organization could assign the tasks of supporting SMS functions to other management personnel. 3.3.4.5 Example. The following example demonstrates a way aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following is an example only and is not the only way the requirements could be met. For example, Flyslow Aviation has chosen to use an existing required management individual required under §§ 119.65, 119.69, or 145.151 and 145.153 to fulfill these responsibilities. As Flyslow Aviation grows and expands, they could establish a safety department with designated personnel assigned this requirement. 3.3.4.6 Considerations for Small and Single-Individual Organizations. 3.3.4.6.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft: Section 5.25(c): Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following: (1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization. (2) Facilitate hazard identification and safety risk analysis. (3) Monitor the effectiveness of safety risk controls. (4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part. (5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement. 3.3.4.6.2 In a single-pilot organization, the accountable executive would perform these designated duties as part of their duties under § 5.25. Effective communication of safety information is still important, even in a single-pilot or single-individual organization. The communication focus would be focused outside of the organization (i.e., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations.) ### Page 38 3-24 3.3.4.7 Safety Policy Example. Flyslow Aviation recognizes the key to a successful organization is open communication and strong leadership. They identify the accountable executive and management representatives (§ 5.23) and start working on the safety policy. While developing safety objectives (§ 5.21(a)(1)), management reviewed the organization’s performance indicators as well as reports from previous audits. Management then determined a reduction in uncalibrated tools being issued by the tool room would be an appropriate objective for the coming year. Management communicates the organization’s goal of reducing uncalibrated tool issuance by 20 percent by publishing an updated safety policy (§ 5.21(c) and (d)) and through employee meetings (§ 5.23). Management also develops processes and procedures describing how employees are expected to accomplish their duties and responsibilities under the SMS. 3.3.5 Coordination of Emergency Response Planning. 3.3.5.1 References. Section 5.27. 3.3.5.2 Part 5 Requirement. § 5.27, Coordination of emergency response planning. Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following: (a) Delegation of emergency authority throughout the person’s organization. (b) Assignment of employee responsibilities during the emergency. (c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services. 3.3.5.3 Discussion. The aviation organization is required to develop an ERP. This may be a part of the safety policy documentation or a separate document. If it is a separate document, the safety policy should point to where the ERP is located. 3.3.5.3.1 The ERP should be developed, which ensures normal SMS functions and risk acceptance continues while key personnel are removed from their normal risk management positions. The plan should also address how the aviation organization will transition to normal operations after the emergency condition subsides. 3.3.5.3.2 The ERP should provide procedures for management decision making and action in an emergency. For the purposes of meeting this section, the aviation organization should develop an ERP that ensures normal SMS functions and risk acceptance continues when process owners are removed from their normal risk management positions. This also should be applied for vacations or other absences. A line of succession of management authority sufficient to respond to emergencies needs to be established and documented in the ### Page 39 3-25 position description so employees required to assume these duties are able to understand the additional duties and responsibilities. As proxies are identified to step into these roles, organizations must ensure they are trained and competent to perform the additional duties of SMS risk acceptance. 3.3.5.3.3 Coordination of ERPs with the ERPs of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous materials (HAZMAT) authorities. Many organizations already have ERPs that may be used to fulfill this requirement. 3.3.5.4 Implementation Strategies. Consider whether the ERP covers the likely emergencies and has been coordinated with other organizations that may be affected and with the emergency services. A small, noncomplex organization’s ERP might consist of a checklist of simple steps involving who to call when and what information to impart and a regularly updated list of contact details. When considering the ERP, succession planning must be considered. If a member of management is removed from their position to address an emergency, there should be another individual trained and competent to step into the position to ensure the organization continues to function as designed. This could even take place when the individual is away for other reasons. Common sense must prevail; processes need to be workable and tailored for the operation. In other words, do not over think it! 3.3.5.5 Considerations for Small and Single-Individual Organizations. 3.3.5.5.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft: Section 5.27: Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following: (a) Delegation of emergency authority throughout the person’s organization. (b) Assignment of employee responsibilities during the emergency. 3.3.5.5.2 Effective communication of safety information is important, even in a single-pilot organization. In an organization with a single pilot or single individual, the communication focus may be outside the organization (e.g., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Interfacing with maintenance, fixed-based operators, and flight followers (if one is used) all ### Page 40 3-26 require communication so they are aware of the aviation organization’s activities. This will aid in scheduling support activities as well as having someone keep an eye out in case plans do not go as predicted. In a single-pilot or single-individual organization, this could be met by simply filing flight plans with air traffic control (ATC) or leaving an envelope with emergency contact information at the local Fixed-Base Operator (FBO) if the aircraft does not return on time. 3.4 Subpart C, S afety Risk Management. 3.4.1 Applicability: Requirements to Apply SRM. 3.4.1.1 References. Section 5.51. 3.4.1.2 Part 5 Requirement. § 5.51, Applicability. Any person required to have an SMS under this part must apply safety risk management to the following: (a) Implementation of new systems. (b) Revision of existing systems. (c) Development of operational procedures. (d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part. 3.4.1.3 Discussion. To know when an SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets that are directly related to the organization’s aviation safety activities. Examples of broad-based systems could include: • Flight operations, • Operational control (dispatch/flight following), • Maintenance and inspection, • Cabin safety, • Ground handling and servicing, • Cargo handling, and • Training. 3.4.1.3.1 Within an aviation organization’s systems, there are subsystems related to aviation safety. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, component shops, deicing, fueling, aircraft fleet, ground operations, and HAZMAT training. ### Page 41 3-27 3.4.1.3.2 Under § 5.51, the SRM process is triggered when new systems or changes to existing systems related to aviation activities are being considered. For example, changes to operations could include the addition of new routes, opening or closing of line stations, addition or change of contractual arrangements for services, addition of new fleets or major modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS), or change in authorizations to a repair station’s ratings. 3.4.1.3.3 The SRM process is not triggered solely by major changes to a system; it is triggered by any aviation-safety-related revision of an existing system. 3.4.1.3.4 The SRM process is also triggered when any aviation-related change in the operating environment or ineffective risk controls are identified by the safety assurance processes. 3.4.1.3.5 Aviation organizations must document (where required) when the SRM processes are to be implemented based on the requirements in § 5.51. While it is not the intent to require the application of SRM processes and procedures to activities that are not related to the aviation operations, some aviation organizations may elect to add additional triggering events. 3.4.1.3.6 International Civil Aviation Organization (ICAO) Annex 19, Safety Management, requires hazard identification and SRM to be initiated using reactive and proactive methods. As discussed in § 5.51, proactive requirements are initiated when an organization implements new systems, revises existing systems, or develops operational procedures. The reactive trigger is hazards or ineffective risk controls identified through the organization’s safety assurance processes. 3.4.1.3.7 A question you might wonder is “Do I have to do SRM if I update a manual?” The answer is yes; any change to existing processes or revision to existing systems (the manual is part of your aviation organization’s system) requires SRM to be initiated. Now, you might be thinking “Do I have to do the entire SRM process?” The answer to that question is that it depends. If you are just updating the organizational chart due to promotions and turnover, then probably not. You would describe the system and then assess it for hazards. If no hazards are identified by updating the organizational chart, then the process is complete. Depending on how the process is written, there could be a simple check mark that indicates no hazards identified on the organization’s SRM tracking document. For an example, see Appendix B, Sample Safety Risk Management (SRM) Worksheets, Figure B-1, Safety Risk Management Triggering Conditions and Summary. 3.4.2 S ystem Analysis . 3.4.2.1 References. Section 5.53(a) and (b). ### Page 42 3-28 3.4.2.2 Part 5 Requirement. § 5.53(a) and (b), System analysis and hazard identification. (a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c). (b) In conducting the system analysis, the following information must be considered: (1) Function and purpose of the system. (2) The system’s operating environment. (3) An outline of the system’s processes and procedures. (4) The personnel, equipment, and facilities necessary for operation of the system. (5) The interfaces of the system. 3.4.2.3 Discussion. System analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by defining and analyzing the system. This can be as simple as creating a flowchart of the system or writing a short narrative to help the aviation organization understand the interfaces with the processes and procedures that are affected by the change. 3.4.2.3.1 Aviation organizations must document processes and procedures defining how the process owners will conduct a system analysis and hazard identification as part of their SRM analysis. 3.4.2.3.2 Documentation should provide sufficient procedural guidance to aid the process owners in defining the function and purpose of the system. When accomplishing this step, all interfaces with the various divisions, internal and external to the process being evaluated, need to be considered. Interfaces could be internal or external to the organization and the system being evaluated. An SMS must ensure an organization’s safety is not adversely affected by the products and services external organizations provide. Some examples of external interfaces could be maintenance providers, contract flight instructors and pilots, ground handlers, refuellers, and airport services. In other words, if you are analyzing a change in engine inspection requirements, do not worry about analyzing the aircraft landing gear unless it is directly affected by the task being changed. 3.4.2.3.3 Good documentation provides sufficient guidance to aid the process owners in defining the personnel, equipment, and facilities necessary for safe operation of the equipment. It also ensures consistent results when different process owners perform SRM. ### Page 43 3-29 3.4.2.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.4.2.4.1 The system analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers, such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them. Aviation organizations on the higher end of the spectrum of size or complexity may develop their system analysis at multiple organizational levels (e.g., corporate, division, or department) and be facilitated by the safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels. 3.4.2.4.2 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where the aviation organization will tailor the processes to their size, complexity, and operating environment. 3.4.2.4.3 Aviation organizations should consider how their service providers and contractors interact with the organization. Identify the areas where risk could be introduced into the operations. 3.4.2.5 System Analysis Example. Flyslow Aviation is considering the addition of a new aircraft (or a fleet of aircraft) for operations to meet organizational or corporate goals. Several organizational systems would be affected (e.g., flight operations, maintenance, station, ground, etc.). As part of the examination of the flight operations system, Flyslow Aviation needs to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, employee representation participation, and several other areas. This is a process normally done as part of business activities. 3.4.2.5.1 The system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to the fleet, Flyslow Aviation identifies the pilot training system as one of the affected systems and the need for additional activities and resources necessary for pilot training to operate the additional aircraft. These resources may include simulators, training curriculum, training aids, and instructors. A repair station might be adding a rating or changing from paper to digital manual systems and need to update their revision tracking process and training for employees. 3.4.2.5.2 Although Flyslow Aviation has to consider many systems and procedures when considering larger, systemic changes, simpler changes, such as a change in a single procedure (e.g., arming cabin doors prior to pushback), would only ### Page 44 3-30 have to consider the elements of the system that would be affected by the change. The system analysis process frequently includes representatives from management, safety staff, SMEs, employees, and representation groups (e.g., pilots and mechanics) in workgroups, such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process. 3.4.2.5.3 Flyslow Aviation records the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider. One example is the Web-Based Application Tool (WBAT)6 (see Appendix H, References and Additional Information). 6 WBAT is a federally developed and funded software system that may be used to assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which supports the aviation organization’s implementation of SMS. 3.4.2.5.4 O utput s of the system analysis, which define the function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, and the personnel, equipment, and facilities necessary for the operation of the system, should be retained. Appendix B provides an example of a set of SRM worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBATs. 3.4.3 Hazard Identification. 3.4.3.1 References. Sections 5.23(a)(2)(i), 5.25(c)(2), and 5.53(c). 3.4.3.2 Part 5 Requirement. § 5.53(c), System analysis and hazard identification. (c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis. 3.4.3.3 Discussion. The hazard identification process flows from the system analysis. In hazard identification, the process owner would ask, “What could go wrong with the processes under typical or abnormal operational conditions that could cause an incident or an accident?” 3.4.3.3.1 Most often, the same individuals or groups conducting the system analysis process (safety committees, safety roundtables, etc.) would conduct hazard identification. Process owners use their experience, FAA requirements, manufacturers’ technical data, and knowledge of the operation to identify hazards. For example, a newly modified component of an aircraft cabin door ### Page 45 3-31 might require new arming and disarming procedures by flight attendants (F/A) and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. Hazards could include the effectiveness of new procedure training, employees missing training or failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc. Although identification of every conceivable hazard is unlikely, process owners are expected to exercise due diligence in identifying hazards that could foreseeably lead to an aircraft incident or accident. 3.4.3.3.2 There are many risk assessment models available that may be used to identify hazards based on the system analysis. It is not a requirement that one specific model be integrated into the aviation organization’s documentation. The model or method used is the aviation organization’s choice. This will ensure process owners in the various divisions are performing the system analysis the same way. This leads to consistency within the organization. 3.4.3.3.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management may vary based on the size and complexity of the organization. For example, it may be accomplished by using worksheets completed manually, computer spreadsheets, or commercial software. 3.4.3.3.4 The output of hazard identification could be recorded in a simple recording medium, such as a spreadsheet, paper files, or a third-party software program or provider. One example is WBAT. The WBAT platform (maintained by Universal Technical Resource Services, Inc. (UTRS)) is a web-based system that supports all aspects of a complete SMS, including safety policy, SRM, safety assurance, safety promotion, and SMS recordkeeping and documentation. Any organization can utilize the WBAT platform to collect, process, and analyze safety reports, conduct audits, and identify and manage risk. Additional information is available in Appendix H. Outputs could consist of identified or potential hazards. 3.4.3.4 Im plementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on the aviation organization’s size or complexity. The following are examples only and are not the only ways the requirements could be met: 3.4.3.4.1 Hazard identification could be performed by the owner/manager (accountable executive) and/or another employee(s), often as part of the system analysis. Aviation organizations on the higher end of the size or complexity spectrum may perform hazard identification at multiple organizational levels (e.g., corporate, division, or department levels). It could be facilitated by a safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels. ### Page 46 3-32 3.4.4 Safety Risk Analysis. 3.4.4.1 References. Sections 5.25(c)(2) and 5.55(a). 3.4.4.2 Part 5 Requirement. § 5.55(a), Safety risk assessment and control. Any person required to have an SMS under this part must: (a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c). 3.4.4.3 Discussion. For each identified hazard, an aviation organization should define the potential for injury and damage that may result from an incident or accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, process owners need to define the likelihood of occurrence of an incident or accident and the severity of the injury or damage that may result from the aircraft incident or accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential consequence (accident or incident) related to the hazard. 3.4.4.3.1 The process owner conducting risk analysis also should consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, that could result in an incident or accident? Has the organization recently changed equipment that employees must use, the procedures for using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For example, if, in the process of a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that could lead to errors? 3.4.4.3.2 This is one reason why the system analysis is an essential foundational step in risk management. If the risk analysis is not based on a thorough understanding of the system, process owners may miss important details that could cause the system to fail. The knowledge gained in the system analysis and subsequent risk analysis will be used to develop a mitigating strategy. Risk controls will target the conditions the aviation organization thinks have caused or will cause an incident or accident and affect the severity or likelihood. 3.4.4.3.3 Risk analyses in operational contexts are often based on the expertise and expert judgment of the process owners but should also use data from the aviation organization’s own experience or from others in the industry where available. A review of accident statistics, failure data, error data (e.g., runway incursion reports or information from the National Aeronautics and Space ### Page 47 3-33 Administration’s (NASA) Aviation Safety Reporting System (ASRS)), or equipment reliability data may help in determining the likelihood. 3.4.4.3.4 The type of consequence (e.g., error, failure, accident, or incident) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often lead only to aircraft damage. 3.4.4.3.5 Aviation organizations should define a process for analyzing risk associated with the hazards identified in the system analysis. This can be accomplished utilizing a risk matrix that looks at severity and likelihood. Likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. A risk matrix may be qualitative or quantitative in nature or contain both types of scales. It is important to ensure that all process owners are trained in the use of the defined tool to ensure consistent results throughout the aviation organization. The important thing is do not try to over engineer the risk matrix or process for analyzing risk. Use what works best for your organization. 3.4.4.3.6 Organizations should not assume the worst possible outcome, loss of life, or destruction of property possible in an event when determining severity. The best estimate of severity should be based on reasonable expert judgment. Severity and likelihood of various outcomes could be recorded in a simple recording medium, such as a notebook, basic desktop software, or third-party software program or provider (e.g., WBAT). 3.4.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.4.4.4.1 In smaller or lower complexity aviation organizations, risk analysis could be performed by the owner/manager (accountable executive) and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk assessment, and risk control. Aviation organizations on the higher end of the size or complexity spectrum may perform the risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The aviation organization might have standing committees of SMEs and stakeholders participating at various levels. 3.4.5 S afety Risk Assessment . 3.4.5.1 References. Section 5.55(b). ### Page 48 3-34 3.4.5.2 Part 5 Requirement. § 5.55(b), Safety risk assessment and control. Any person required to have an SMS under this part must: (b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk. 3.4.5.3 Discussion. Once the risk is analyzed, the process owner must determine whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides aviation organizations with a way to integrate the effect of severity of the outcome and the probability of occurrence. Aviation organizations are then able to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present. 3.4.5.3.1 If a risk matrix is used, the aviation organization should develop criteria for the severity and likelihood that are appropriate for their type of operations and their operational environment. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. Different types of aircraft operated, their operating environment, and their relative values would dictate different definitions of risk severity between aviation organizations. Likewise, the method that the aviation organization uses to estimate likelihood will have an effect on how likelihood levels are defined. If the aviation organization prefers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Table 3-1 below depicts a sample risk matrix. Table 3-1. Sample Risk Matrix Risk Likelihood Risk Severity Catastrophic Hazardous Major Minor Negligible Frequent High (red) High (red) High (red) Medium (yellow) Medium (yellow) Occasional High (red) High (red) Medium (yellow) Medium (yellow) Medium (yellow) Remote High (red) Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Improbable Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Low (green) Extremely Improbable Low (green) Low (green) Low (green) Low (green) Low (green) ### Page 49 3-35 3.4.5.3.2 Risk assessment is based on the process owners’ judgment, experience, and input. If the process owner determines the risk is acceptable, the SRM process would be complete at this point. The system may already be in operation or placed into operation and monitored in the safety assurance process. If the process owner decides the risk is not acceptable, the SRM process continues with the development of risk controls. 3.4.5.3.3 Risk assessments must include the levels of management with the authority to make risk acceptance decisions to decide what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispatching a flight that presents a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For large-scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance decisions will depend on the scope of the proposed change to the operation and the level of risk presented to the aviation organization. 3.4.5.3.4 It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. The method utilized is not important, but the process owners must be knowledgeable on how to utilize the aviation organization’s documented processes and procedures. 3.4.5.3.5 The outputs of this process could be recorded on paper or via an electronic medium, such as a third-party software program or provider. One example is WBAT. 3.4.5.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.4.5.4.1 In a small or lower complexity aviation organization, risk assessments could be performed by the owner/manager (accountable executive) and/or other employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. While similar to a Flight Risk Assessment Tool (FRAT), the risk assessment required by § 5.55 is to determine if the residual and associated risks to the process are acceptable. Quite often, a risk matrix is utilized to determine if any residual risk or substitute risk are acceptable to the aviation organization. A FRAT would be used to determine if conditions are acceptable for a specific flight to commence. It is important not to confuse the purpose of these two distinctly different tools and their application. Aviation organizations on the higher end of the size or complexity spectrum may coordinate their SRM processes across the divisional and geographic units of the organization to ensure ### Page 50 3-36 integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems. 3.4.5.4.2 Many organizations have standing committees made up of senior managers, who are the decisionmakers, supported by working groups of technical personnel. For example, the accountable executive could make organization-level decisions, and department managers could make the decisions for their process areas. A risk matrix may be useful to determine who in the organization makes the risk decision, whether the risk is acceptable, or what the priority is for mitigating risk. 3.4.6 S afety Risk Control . 3.4.6.1 References. Section 5.55(c) and (d). 3.4.6.2 Part 5 Requirement. § 5.55(c) and (d), Safety risk assessment and control. Any person required to have an SMS under this part must: (c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section. (d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented. 3.4.6.3 Discussion. Aviation organizations must document their processes and procedures for how risk controls should be developed/designed to control identified hazards. The method used should be documented by the aviation organization, and process owners must be trained to produce consistent results. A typical risk control process is the acronym META, which stands for: Mitigate the risk; Eliminate the risk; Transfer the risk; or Accept the risk. While the method described here is an example, aviation organizations are encouraged to develop or implement any method that works for their organizational size and complexity. 3.4.6.3.1 After process owners understand the hazards and associated risks, if they determine that the risk is unacceptable, they must design risk controls to mitigate risks to an acceptable level by using a risk assessment process, as specified in § 5.55(b). Examples of where new risk controls may be applied include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any number of other system changes. In short, risk controls could include anything that would reduce the likelihood or severity of a potential incident/accident. 3.4.6.3.2 The aviation organization must develop procedures requiring a system analysis and hazard identification after the proposed risk control is developed. ### Page 51 3-37 Once a proposed control has been determined and designed, process owners need to determine if the level of risk is acceptable and if the proposed control has introduced unintended consequences or new hazards. This is commonly referred to as “substitute risk.” Section 5.55(d) requires aviation organizations to evaluate whether the risk will be acceptable with the proposed safety risk control applied. The risk that remains is often referred to as “residual risk.” If it is not possible to completely remove risk from a process, the organization must determine whether the residual risk is acceptable to the organization. 3.4.6.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.4.6.4.1 In aviation organizations with a lower complexity or size, the risk control process could be a documented activity performed by the owner/manager (accountable executive) and/or other employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk analysis, and risk assessment. Aviation organizations on the higher end of the size or complexity spectrum may have the risk control process performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to design the risk controls. There would be interdepartmental coordination before the controls are implemented. After the control is approved, it is implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel. 3.4.6.5 SRM Considerations for Small and Single-Individual Organizations. SRM for single-individual organizations does not need to be overly complex. In very small organizations, individuals across the organization should be aware of the organization’s biggest risks and what actions are in place to mitigate them. 3.4.6.5.1 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where a small organization or a single-individual organization will tailor the processes to the size, complexity, and operating environment. 3.4.6.5.2 Small organizations should consider how their service providers and contractors interact with the organization. Where are areas that risk could be introduced into the operations? 3.4.6.5.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, ### Page 52 3-38 communicate, and track aspects associated with risk management will vary based on the size and complexity of the organization. For example, tracking or storing SRM outputs could be accomplished by using worksheets that are completed manually, computer spreadsheets, or commercial software, such as WBAT. 3.4.6.5.4 In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be or employ a risk specialist, as they will most likely know the risks in the organization already. 3.4.6.5.5 Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. How does your organization identify safety issues, from occurrence or incident reports? In a small organization, is hazard reporting encouraged? In a single-person organization, are you looking for and documenting hazards? Does the organization maintain a good reporting culture? As mentioned in § 5.21, a confidential reporting program is required for all organizations except single-pilot, sole-individual organizations. In small organizations, it is quite common for everyone to know everyone else’s business and could lead to a failure to report safety-related issues. Having a nonreprisal policy in place would encourage the reporting of hazards as employees would be assured their concerns are valued. Does the aviation organization have a hazard log and, more importantly, is it used? 3.4.6.5.6 Consider the process for identifying what could happen as a result of each safety issue and assessing the consequence and likelihood. Is there a risk assessment tool and is it used? Is it appropriate? Does the process determine acceptable risks? A risk matrix may be useful, but in a very small organization, it may not be necessary. 3.4.6.6 SRM Example. Flyslow Aviation initiates the SRM processes due to an employee report identifying a hazard: an uncalibrated tool issued to a technician. This was in response to a report sent through the safety assurance employee safety reporting system (§ 5.71(a)(7)). 3.4.6.6.1 The tool room process owner starts by conducting a system analysis (§ 5.53(b)) on the calibrated tool control process by identifying the various interfaces with the procedure. The process owner also looks for areas where a hazard might exist (§ 5.53(c)). Once potential areas where mistakes (hazards) could occur, the process owner conducts a risk assessment (§ 5.55(b)) using Flyslow Aviation’s risk matrix. By identifying the likelihood of uncalibrated tools being issued and the severity of a potential failure where uncalibrated tools were used, the process owner determines the risk is moderate due to the criticality of the tasks the technicians using the tools are completing. The process owner, remembering their training, uses a risk matrix to determine the potential risk of the uncalibrated tool being used. As risk is a composite of ### Page 53 3-39 likelihood and severity and since uncalibrated tools have been issued to technicians previously, the process owner considers this a likely occurrence. 3.4.6.6.2 Flyslow Aviation’s management, process owners, and employee representatives work together to develop risk controls (§ 5.55(c)) to prevent future issuance of uncalibrated tools to employees. Brainstorming identifies several methods they can use to enhance existing processes. These include a complete audit and verification of the online tool tracking software to ensure all information is entered correctly. A review of calibrated tool expiration dates will be accomplished at the start of each shift to ensure any tools that may have expired are removed from use. Signs will be designed and posted in the tool room reminding the technicians to double check the calibration dates on tools prior to use, and management will be provided with talking points to use during routine employee meetings to ensure everyone is aware of the need to verify the calibrated tool dates. 3.4.6.6.3 The aviation organization reviews the proposed risk controls and determines the revised procedure is acceptable before implementation (§ 5.55(d)). 3.4.7 H azard Notif ication. 3.4.7.1 References. Section 5.57. 3.4.7.2 Part 5 Requirement. § 5.57, Notification of hazards to interfacing persons. If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services. 3.4.7.3 Discussion. The SMS should be designed to work in parallel with other aviation organizations, with or without an SMS, to encourage hazard information sharing with one another when safety issues are identified through their respective SMS processes and procedures. This section requires aviation organizations to notify the organization responsible for addressing the hazard of its existence and need for mitigation to ensure that all potentially affected entities are made aware of issues so they can analyze the risks and take appropriate actions to address the hazard. 3.4.7.4 Implementation Strategies. Aviation organizations must provide hazard notifications to interfacing organizations that, to the best of their knowledge, could address a hazard or mitigate the hazard’s risk (§ 5.57). This requirement limits hazard notifications only to those interfacing organizations that contribute to the safety of the products or services you provide. ### Page 54 3-40 3.4.7.4.1 Per § 5.3, a hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards, and the report should only be provided to the interfacing organization you believe can best address the hazard or mitigate its risk. Section 5.57 does not require the reporting of concerns that are not hazards (e.g., commercial issues between companies) as the intent of § 5.57 is to facilitate timely sharing of safety information. 3.4.7.4.2 In single-individual organizations, to meet the requirement of § 5.97(a), it is recommended to retain outputs of your hazard information sharing for no less than 24 calendar months. ### Page 55 3-41 Figure 3-1. Hazard Notification Process 3.4.7.4.3 Details for each step of the hazard notification process are: Start: Complete the following steps for each hazard that is identified through your SRM processes. Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer ### Page 56 3-42 is “yes,” go to step 2. If the answer is “no,” notification is not required for this hazard. Note: This decision may occur at any time while the hazard is being assessed through the SRM steps (§§ 5.51, 5.53, and 5.55). Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard. Note: Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide. Step 3: Provide a notification of the hazard to the external organization. Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified or risk controls put in place to address the hazard). You may use a nondisclosure agreement or other contract if you determine that the hazard notification cannot be provided without disclosing confidential or proprietary information. 3.4.7.5 Hazard Notification Example. The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a Technical Standard Order (TSO) article manufacturer that is not required to have an SMS. 3.4.7.5.1 Flyslow Aviation received an employee report from a pilot stating that the aircraft flight management system (FMS) deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. Flyslow Aviation’s SMS classified this employee report as a hazard because the airport is surrounded by high-elevation terrain. Although this incident occurred during the daytime and in visual meteorological conditions (VMC), management determined that if the same issue occurred during a night landing or instrument meteorological conditions (IMC), the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident. 3.4.7.5.2 Flyslow Aviation followed its hazard notification process and decided that the aircraft manufacturer was the best organization to mitigate the risk (step 1). Flyslow Aviation also decided that the aircraft manufacturer contributed to the safety of the services provided by Flyslow Aviation (step 2). Flyslow Aviation provided the following hazard notification to the aircraft manufacturer ### Page 57 3-43 (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.” 3.4.7.5.3 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the FMS database supplier was the best organization to mitigate the risk (step 1). The aircraft manufacturer also decided the FMS system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the FMS database supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.” 3.4.7.5.4 No further action under § 5.57 is required by either Flyslow Aviation or the aircraft manufacturer. Both organizations have met the § 5.57 hazard notification requirements in this example. Other regulatory notification requirements (such as part 121, § 121.703 or part 135, § 135.415) which require service difficulty reporting must still be complied with. 3.5 Subpa rt D , S afety Assurance. 3.5.1 Monitoring of Operational Processes. 3.5.1.1 References. Sections 5.71(a)(1), 121.703, 121.705, 135.415, 145.107(a)(4), and 145.211. 3.5.1.2 Part 5 Requirement. § 5.71(a)(1), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (1) Monitoring of operational processes. 3.5.1.3 Discussion. Managers/process owners may monitor operational processes on a day-to-day basis by directly supervising employee activities, monitoring pilot currency, monitoring minimum equipment list (MEL) status, reviewing pass down logs or Required Inspection Item (RII) status, and performing other supervisory actions. Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance (e.g., duty logs, crew reports, work cards, process sheets, and reports from the employee safety feedback system). This may include monitoring products and services from outside sources that are used in the aviation organization’s operations, such as teardown reports, oil consumption, delay and cancellation reports, and customer feedback forms. ### Page 58 3-44 3.5.1.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.1.4.1 In small or lower complexity organizations, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel (e.g., accountable executive) who are directly involved in the day-to-day operations. For example, regularly reviewing (e.g., weekly, monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of monitoring and could be conducted during the normal course of duties. Some aviation organizations might utilize the line managers and departmental or key management personnel to observe and review day-to-day activity, noting work task inconsistencies and potential safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit (LOSA) programs may also be sources of information to monitor operations. Aviation organizations on the higher end of the spectrum of size or complexity may involve multiple levels of management, safety professionals, functional area managers (such as the DO, DOM, Chief Inspector, and Chief Pilot), trained auditors/analysts, and teams/groups of line managers in the monitoring of operational processes. Operational processes may need to be coordinated across adjacent work function boundaries, so effective monitoring may also need to be coordinated. 3.5.2 Monitoring of Operational Environment. 3.5.2.1 References. Section 5.71(a)(2). 3.5.2.2 Part 5 Requirement. § 5.71(a)(2), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (2) Monitoring of the operational environment to detect changes. 3.5.2.3 Discussion. 3.5.2.3.1 Aviation organizations need to understand their operating environment so they are able to monitor it for changes. Procedures should include how the operating environment will be monitored and who will do the monitoring. Organizational descriptions developed and annotated in operations specifications (OpSpecs) or system analysis developed under § 5.53 establish the context for monitoring the operational environment of the aviation organization. Once the scope of the operational environment is defined, this ### Page 59 3-45 section requires monitoring to assess changes that could impact aviation safety. 3.5.2.3.2 Processes used will vary based on the size and complexity of the organization and the aviation service the organization provides or supports. Monitoring of the operational environment involves practices that are similar to those of monitoring operational processes. For example, seasonal weather conditions may require aviation organizations to change their scheduling, routes, and aircraft utilization. 3.5.2.4 Considerations for Small and Single-Individual Organizations. Small or single-individual organizations might keep a log tracking operational issues or deviations from existing processes and procedures. This information could be used to detect changes in the operating environment. Information sharing with other organizations could also provide input to changing operational environments. 3.5.3 A uditing of Operational Processes and Systems. 3.5.3.1 References. Sections 5.23(a)(2)(ii), 5.71(a)(3), 145.205(a), and 145.215. 3.5.3.2 Part 5 Requirement. § 5.71(a)(3), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (3) Auditing of operational processes and systems. 3.5.3.3 Discussion. 3.5.3.3.1 Audits are a means of collecting data to confirm whether or not actual practices are being followed within a department. Audits typically involve the operational management and process owners responsible for the system(s) being audited. Organizations should develop procedures for auditing that describe the audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits. Auditors should not audit their own work but may audit the work of others around them in the same department. Audit procedures should include the responsibilities and expectations for planning and conducting audits, reporting the results of audits, and maintaining records of audit results and include processes for auditing contractors and vendors, as necessary. These audits should include monitoring risk controls to ensure they are performing as designed and no new hazards have been introduced into the system. ### Page 60 3-46 3.5.3.3.2 The results of audits can be recorded in paper format (e.g., a common logbook-style binder) or in electronic media (e.g., a desktop spreadsheet program or a program such as WBAT). 3.5.3.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.3.4.1 In smaller or lower complexity aviation organizations, the auditing process could be carried out periodically by the accountable executive/owner, key management person, or a trained employee as a collateral duty. Audits may also be carried out as a subfunction of normal business processes. For example, comparisons of deferred maintenance logs and repair part receipts are a form of safety auditing that are probably already accomplished routinely. Aviation organizations on the higher end of the spectrum of size or complexity may utilize divisional auditors to conduct the auditing processes. These aviation organizations may already have safety and safety/quality auditors who perform this function. 3.5.3.5 Considerations for Small and Single-Individual Organizations. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures. 3.5.4 Evaluation of SMS and Operational Processes and Systems. 3.5.4.1 References. Sections 5.25(c)(3) and 5.71(a)(4). 3.5.4.2 Part 5 Requirement. § 5.71(a)(4), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (4) Evaluations of the SMS and operational processes and systems. 3.5.4.3 Discussion. An evaluation is typically an independent review of the organization’s processes, procedures, and systems. The evaluation process builds on the concepts of audit and inspection. Evaluations are internal oversight tools that provide the accountable executive with a snapshot of the safety performance of the aviation organization’s operational processes, systems, and SMS processes. The evaluation should include all available data about the organization, including information from the audits conducted by the operational management and/or process owners. ### Page 61 3-47 3.5.4.3.1 Evaluations performed at planned intervals help the aviation organization’s management determine if its safety management methods and practices are meeting the safety objectives and expectations documented in the safety policy. Evaluation planning should consider the safety criticality of the processes that are being evaluated and the results from previous evaluations. The scope, content, and frequency of evaluations should be based on the organization’s need for information to assess the health of operational processes and the SMS. Aviation organizations also need to define criteria for selecting evaluators. 3.5.4.3.2 The results of evaluations can be recorded in a paper or electronic medium, such as in a common logbook-style binder, an electronic file folder, or a secure email account. 3.5.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.4.4.1 In a small organization, the evaluation process could be carried out periodically by the accountable executive/owner. In larger organizations, evaluations could be performed by a key management person or designated employees as a collateral duty. The process could be accomplished by the Director of Safety (DOS) or the safety department on a monthly, quarterly, or other periodic basis, as determined by the information needs of the accountable executive or other senior management decisionmakers. 3.5.4.4.2 Aviation organizations on the higher end of the spectrum of size or complexity may accomplish evaluations by utilizing a safety department or an Internal Evaluation Program (IEP) office on a quarterly, annual, or other periodic basis, as determined by the information needs of the accountable executive or other senior management decisionmakers. Many part 121 and some part 135 organizations have IEPs, and their outputs can be integrated into the SMS. Analysis of evaluations is typically performed by a safety department. The resulting data would be acted on by the appropriate operational department with the safety department managing the data and assisting the responsible process owners in resolving identified issues. Most large organizations have standing management committees that consider results of evaluations and any corrective action needed. 3.5.4.5 Considerations for Small and Single-Individual Organizations. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures. ### Page 62 3-48 3.5.5 Investigation of Incidents and Accidents. 3.5.5.1 References. Section 5.71(a)(5). 3.5.5.2 Part 5 Requirement. § 5.71(a)(5), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (5) Investigations of incidents and accidents. 3.5.5.3 Discussion. Investigations should be treated as an opportunity for organizational learning to prevent a repeat of errors and/or change organizational processes so that mistakes do not recur. 3.5.5.3.1 Aviation organizations need to define the types of incidents and accidents that require investigations. Part 5 only requires incidents and accidents that directly affect the aviation product or service be investigated. 3.5.5.3.2 Processes used will vary based on the size and complexity of the organization and aviation service the organization provides or supports. Investigations should focus on what went wrong rather than who caused the error and emphasize improvement of safety performance. To the extent permitted by law, the organization should include data, if available, from outside sources, such as the FAA or National Transportation Safety Board (NTSB) investigations. 3.5.5.3.3 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.5.3.4 In smaller or less complex aviation organizations, investigations can be conducted by the accountable executive or assigned employees. Investigations can be conducted by a safety department with additional assigned line personnel providing technical expertise. Aviation organizations on the higher end of the spectrum of size or complexity may have safety teams with specialized disciplines conduct the investigations. The results of investigations can be recorded in paper or electronic medium (e.g., in a common logbook-style binder, an electronic file folder, or other electronic system, such as WBAT or another suitable system). 3.5.5.4 Considerations for Small and Single-Individual Organizations. Investigation is a necessary activity within any SMS, regardless of the ### Page 63 3-49 organization’s size. If, as a single-individual organization, you do not have the knowledge or experience to develop a process to conduct investigations, consider using industry resources outside of your organization or contracting services from a third-party provider. As a one-person organization, you know exactly how it operates. With a sound documented process to conduct an investigation, you should be able to come up with relevant conclusions as long as you remain objective. 3.5.6 I nvestigation of Potential Noncompliance. 3.5.6.1 References. Section 5.71(a)(5). 3.5.6.2 Part 5 Requirement. § 5.71(a)(6), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part. 3.5.6.3 Discussion. 3.5.6.3.1 This subject is very similar to § 5.71(a)(5) in that the focus of the investigation should reveal information that, when utilized correctly, will identify system deficiencies that led to a noncompliance with regulatory standards or other safety risk controls. It is not as important to identify “who did it” as it is to determine why it happened. Within this process, it is important to distinguish between errors and intentional/willful noncompliant actions. Investigations of reports regarding potential noncompliance with regulatory standards or of inadequate safety risk controls established by the aviation organization must be mitigated through the organization’s corrective action process as required by § 5.75. Instances of noncompliance with an FAA regulation may be reported through the Voluntary Disclosure Reporting Program (VDRP), where applicable. For instances involving individual employee noncompliance with FAA regulations, these employees may use an Aviation Safety Action Program (ASAP), if one is available. 3.5.6.3.2 A n SMS does not relieve aviation organizations from other regulatory requirements. This also includes documented processes and procedures that may be contained in maintenance manuals or Aircraft Flight Manuals (AFM) or that are organization specific. ### Page 64 3-50 3.5.6.4 Implementation Strategies. Methods of conducting investigations of potential noncompliance can be accomplished in a manner similar to that for investigations of accidents and incidents. 3.5.7 Confidential Employee Reporting System. 3.5.7.1 References. Sections 5.21(a)(4) and 5.71(a)(7). 3.5.7.2 Part 5 Requirement. § 5.71(a)(7), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting. 3.5.7.3 Discussion. The data-gathering process should include information provided by the workforce. Frontline employees are in the best position to observe aspects of the operation or environment that are not expected and may not be included in audits or evaluation protocols. In this respect, employee reporting systems can fill important gaps in the organization’s data collection process. 3.5.7.3.1 Open communication is a key component of a successful SMS. A robust employee reporting system is a critical part of this communication concept. Aviation organizations must have documented processes and procedures for employee reporting. The methods utilized could be an ASAP for employees covered by a memorandum of understanding or computer-based reporting for employees not covered by an ASAP. Smaller organizations could be part of a community organization working with a managed employee reporting program. The important thing is all employees in an aviation-related position must have a means of reporting hazards and issues they come across in their normal duties. 3.5.7.3.2 Part 5 requires aviation organizations to establish confidential employee reporting programs. Aviation organizations are not required to establish anonymous reporting systems in order to comply with this requirement. In fact, anonymous reporting has some disadvantages. While not prohibited by the regulation, anonymous reporting does not allow the aviation organization the ability to get additional information concerning the hazard or incident since the ability to reach out to the reporter is lost. 3.5.7.3.3 Employees should not fear retribution for reporting issues to the organization if those issues do not involve gross negligence or willful misconduct. Employees should also be encouraged and have a means of providing ### Page 65 3-51 proposed solutions to the issues raised. In order to be effective, an environment in which employees feel comfortable reporting hazards, issues, and concerns, as well as occurrences, incidents, etc., should be established. This is known as a nonretributive culture or a just culture. The accountable executive and management team need to encourage employees to report safety issues and not fear reprisal from management as long as the safety issues or identified hazards are not based on an employee’s gross negligence or deliberate misconduct. Policies that assure employees of fair treatment and a nonreprisal reporting policy that establishes clear standards of behavior are an essential part of the reporting process. 3.5.7.3.4 A key aspect of the confidential reporting system is that the submitter’s identity is protected. Therefore, aviation organizations must define methods for employee reporting and de-identification of sources without losing essential information. As confidential reporting procedures are developed and implemented, employees will begin to trust the organization to work toward hazard identification and elimination of systemic problems. When employees recognize the organization’s commitment to address employee reports, they will be more willing to report safety concerns. 3.5.7.3.5 With a confidential reporting program, a trusted source who manages the confidential reporting system hides the reporter’s identity from the process owners responsible for addressing the identified hazard. If additional information is needed, the trusted source could contact the reporter and request the additional information needed for the investigation. With an anonymous reporting program, any opportunity to obtain additional information is lost as the original reporter would remain unknown. 3.5.7.3.6 ASAPs can be used as part of the employee reporting system for the employee groups covered by a memorandum of understanding that is established with the implementation of an ASAP. However, the confidential employee reporting system required by part 5 must include all employees in the organization whose work directly affects aviation safety. Other methods of employee reporting may include hotlines, suggestion boxes, or information and forms for NASA ASRS. If WBAT is used, this system provides a portal for ASRS reporting. ASRS provides certificated employees with limited immunity in the form of waivers of sanctions for reported events with certain restrictions. One problem with using ASRS as an organization’s employee reporting program is that there is no transmittal to the organization when a report has been filed and no opportunity to conduct an investigation. 3.5.7.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. ### Page 66 3-52 3.5.7.4.1 An employee reporting system need not be highly sophisticated to be effective. The employees might report a hazard either orally or in a note or email to their supervisor. Several industry groups provide an employee reporting program for small aviation organizations and provide management and de-identification of information. They also provide access to other de-identified reports so identified hazards can be integrated into the participating aviation organization’s SMS. Aviation organizations on the higher end of the size or complexity spectrum may have an existing online employee reporting system or ASAPs for some employee groups. Data collection for the reporting system can take many forms, from a simple suggestion box to organizational websites or intranets or a dedicated email address. Data management can be accomplished with a common desktop spreadsheet, database software, or specialized software, such as WBAT. 3.5.7.5 Considerations for Small and Single-Individual Organizations. 3.5.7.5.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft: Section 5.71(a)(7): A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting. 3.5.7.5.2 Single-individual organizations are not required to have a confidential reporting system; however, they should have a process for documenting and managing hazards identified in the course of operations. 3.5.8 H azard Notification . 3.5.8.1 References. Sections 5.57 and 5.71(a)(8). 3.5.8.2 Part 5 Requirement. § 5.71(a)(8), Safety performance monitoring and measurement. (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (8) Investigations of hazard notifications that have been received from external sources. ### Page 67 3-53 3.5.8.3 Discussion. 3.5.8.3.1 When an aviation organization receives notification of a hazard from an external source, they are required to evaluate the hazard utilizing the same safety assurance processes as they would if they received a confidential employee report. The hazard should be evaluated using the SRM processes, and if the aviation organization determines the hazard would best be addressed by an external organization, they must notify that organization by utilizing their hazard notification process as required by § 5.57. 3.5.8.3.2 If the aviation organization is best suited to address the hazard, they should implement their SRM processes and procedures as defined in §§ 5.53 and 5.55. 3.5.9 Analysis of Data. 3.5.9.1 References. Sections 5.25(c)(2), 5.71(b), and 145.209(d)(2). 3.5.9.2 Part 5 Requirement. § 5.71(b), Safety performance monitoring and measurement. (b) Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services. 3.5.9.3 Discussion. Analysis involves examining data acquired from various sources as specified in § 5.71(a) in order to make inferences about the safety performance of operational systems and the SMS. It is common for organizations to treat each employee report, audit finding, or investigation in isolation. Often, system problems may not be seen if data points are examined in isolation. Thus, analysis processes should also look across individual reports and among various data sources for patterns or trends. The following is a starting point for developing and maintaining a process for analyzing data acquired through the data acquisition processes. 3.5.9.3.1 Establish the Context. Understand the safety performance objectives of the system, operations, and SMS. For system impacts and to analyze risk controls developed under SRM, process owners would also need to review the system analysis conducted under SRM. 3.5.9.3.2 Id entify the Objective of the Analysis. What is being analyzed: the safety performance of a system or an operation or the SMS itself? 3.5.9.3.3 S ecure Appropriate Data. Section 5.71(a) provides a framework for data sources. The data needed may be already on hand, or additional data-gathering, such as conducting a special audit with focus on a specific problem, may be needed. ### Page 68 3-54 3.5.9.3.4 S elect an Appropriate Data Analysis Method. Analysis need not be sophisticated to yield valuable results. For example, analysis of employee reports or qualitative analysis by SMEs may be the best method. If desired, several classification systems exist to help convert subjective, qualitative data into quantitative data for tracking and trend analysis. For routine reporting, analysis may consist of tracking such things as dispatch reliability per month, system or part failure rates, crew utilization/duty time, and events such as minor incidents, diversions, and precautionary engine shutdowns. 3.5.9.3.5 Reco mmendation. At this point, the individual conducting the analysis may compare performance against relevant organizational safety objectives. Unless the decisionmaker is personally conducting the analysis, an assessment recommendation may be made. In the case that a potential regulatory violation is discovered during analysis, the aviation organization may initiate a self-disclosure under voluntary reporting procedures. 3.5.9.3.6 Doc umentation. Prepare reports and records in a format appropriate to the operation. Note: T he outputs from data analysis could be recorded in a simple recording medium (e.g., a notebook, paper files, a common desktop software, specialized systems, or a third-party software, such as WBAT). 3.5.9.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.9.4.1 In a single-individual aviation organization, data acquisition may consist of making notes about how things did not go as planned, how communications were compromised at low altitude in certain flight route segments, etc. This data could be reviewed on a regular basis (perhaps monthly or quarterly). Hazards could be analyzed in SRM, and mitigating actions could be recorded as changes to procedures, minimum performance requirements, etc. are identified. Aviation organizations on the higher end of the size or complexity spectrum may have the DOS or other individuals conduct the analysis of data. This information would be shared with other departments and management during regularly scheduled meetings. Operational departments may have their own data analysis group reviewing data and analyzing the data by SMEs within the respective department, possibly supported and coordinated by a safety department. 3.5.9.5 Considerations for Small and Single-Individual Organizations. In a single-individual organization, the accountable executive will perform this ### Page 69 3-55 function. In a small organization, this may be accomplished by another member of management. 3.5.10 S afety Performance Assessment (SPA). 3.5.10.1 References. Sections 5.23(a)(2)(ii), 5.25(b)(1), and 5.73. 3.5.10.2 Part 5 Requirement. § 5.73, Safety performance assessment. (a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to: (1) Ensure compliance with the safety risk controls established by the person. (2) Evaluate the performance of the SMS. (3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls. (4) Identify changes in the operational environment that may introduce new hazards. (5) Identify new hazards. (b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part. 3.5.10.3 Discussion. Under § 5.71, the aviation organization is required to collect and review safety performance data. This is typically conducted by the process owner of the area being reviewed. Analysis takes place, and informed decision making occurs. When developing SPAs, it is important to ensure the process is appropriate for the size of the organization. The SPA process should consider who makes the decisions regarding whether the organization’s safety performance is effective and whether the organization is meeting its safety objectives and expectations that are identified in the safety policy required by § 5.21. When reviewing the aviation organization’s goals and objectives, it is important to determine if the expected result is being achieved. The conclusions of the SPAs are reported to the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary. 3.5.10.3.1 This requirement does not define a specific interval, but the assessments should be accomplished at a frequency to permit a change in processes or procedures to better align the organization to meet the safety objectives. Aviation organizations must define the SPA review frequency in their processes and procedures. A small organization will likely conduct less frequent reviews as opposed to a larger organization. The assessment and review frequency should be sufficient to monitor activities so changes can be made in a timely manner. 3.5.10.3.2 The aviation organization must develop processes and procedures to ensure the SMS is working as designed. It should be generating appropriate data to ### Page 70 3-56 aid in identification of hazards and changes in the operational environment. It should also aid process owners in determining if any ineffective processes or procedures are in their areas of responsibility. Processes should be developed to update the SMS if any areas of deficiencies are noted. The SMS should provide information for proactive risk management. 3.5.10.3.3 This section also requires evaluating the effectiveness of safety risk controls developed to address any known hazards in the operational environment. Any new hazards identified in the assessment would need to be evaluated using the SRM processes in §§ 5.53 and 5.55. 3.5.10.3.4 Section 5.97(a) requires aviation organizations to retain outputs of their SRM processes as long as the risk controls are relevant to the operation. This is a good place to start when developing areas that should be monitored to ensure the risk controls remain effective. 3.5.10.3.5 Assessments can have one of the following general outcomes: 1. Performance is acceptable and objectives are being met. 2. Performance is not acceptable, and analysis suggests that the problem lies with conformity of either the regulations or organizational policy and procedures or the necessary resources have not been provided. In the event this occurs, corrective action under § 5.75 would be warranted. 3. Conformity with the risk controls and regulations or organizational policy and procedures appears to be satisfactory; however, desired results are not being obtained. In the event that this occurs, the SRM processes would be triggered. 4. New hazards or changes to the operational environment are discovered. This may be due to new hazards having arisen since the system was designed or discovery of factors that were overlooked. In this case, as in the previous case, the SRM processes must be followed. 3.5.10.3.6 The results of assessments can be recorded in a paper or electronic medium (e.g., in a common logbook-style binder, electronic file folder, common desktop software, specialized system, or third-party software program, such as WBAT). 3.5.10.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.5.10.4.1 As an organization grows in size, it is normal to have additional personnel performing safety, quality, or internal evaluation functions. An SMS does not change the number and types of personnel in these situations as much as it ### Page 71 3-57 may change the way in which these persons and organizations work and interact. For example, in a small or lower complexity aviation organization, safety performance and assessment could be a documented activity performed by the accountable executive or a coordinated activity between the accountable executive and other operational managers, supported and coordinated by the DOS if the organization has this position. Risk acceptance would also normally fall to managers within this group. Aviation organizations on the higher end of the size or complexity spectrum may have the accountable executive, division vice presidents, and other defined leaders or process owners conduct the SPA. At each level, the organization would define who is responsible for making risk acceptance decisions and what actions should be taken to either correct the problem or design new risk controls. Larger organizations typically have standing management committees at the functional organization level (e.g., flight operations, technical operations/maintenance, in-flight services, and dispatch/operational control) and a second body at the corporate level to ensure integration, coordination, and review by the accountable executive. 3.5.10.5 Considerations for Small and Single-Individual Organizations. For single-individual organizations, an internal review (a self-assessment) may be as effective as a formal audit. Networking with other similar organizations and sharing safety information may provide insights into vulnerabilities that may exist in the organization’s processes and procedures. In small organizations, the reactive data gathered may not be statistically significant due to small sample sizes. This can be managed by looking beyond the data within your own organization. Where available, include data from industry organizations and associations, related industries, regulatory bodies, and safety boards. 3.5.11 C ontinuous Improvement . 3.5.11.1 References. Sections 5.25(b)(5) and 5.75. 3.5.11.2 Part 5 Requirement. § 5.75, Continuous improvement. Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73. 3.5.11.3 Discussion. The final step within safety assurance is continuous improvement. This process is designed to ensure that the aviation organization corrects substandard safety performance identified during the SPA in order to continuously improve safety. 3.5.11.3.1 In general, the corrective action process required by § 5.75 is triggered when an aviation organization’s employees are not utilizing the established risk controls that are integrated into a developed and implemented process or procedure. It is not always necessary to conduct a new safety risk analysis as ### Page 72 3-58 these deficiencies are typically employee performance-based and do not rise to the level of requiring initiating SRM processes. Quite often, retraining or counseling employees as to the need to follow processes and procedures is sufficient. The key is determining if the problem identified is systemic or employee related. 3.5.11.3.2 If the aviation organization has previously evaluated the process and procedure and determined the risk controls are effective but not properly used, the assessment should attempt to determine why the employee failed to follow the designed process. For example, if it has been found that an Airworthiness Directive (AD) has not been applied to a particular aircraft, the only correct action is to comply with the risk control (in this case, the AD), as that is required by regulation (14 CFR part 39, § 39.7), and an organization does not have discretion to take an action that violates a regulatory requirement. If the organization determined that the AD was missed due to an employee failing to input the records correctly into the tracking software, additional training of the employee may be an appropriate corrective action. 3.5.11.4 Impl ementation Strategies. Continuous improvement decision making is an output of the SPA process. Therefore, corrective actions discussed during the assessment apply to continuous improvement activities. The managers, committees, or working groups that make assessment decisions for the aviation organization would also determine the appropriate corrective actions based on the situation. 3.5.11.5 Safety Assurance Example. Flyslow Aviation becomes aware of an uncalibrated tool being issued to a technician through their confidential employee reporting program (§ 5.71(a)(7)). During a review of the tool control program, the process owner recognized this could be a potential noncompliance with regulatory standards7 (§ 5.71(a)(6)) and uses the VDRP to notify Flyslow Aviation’s FAA Certificate Management Team (CMT) of the incident. 7 The use of calibrated tools is regulatory under 14 CFR part 43, § 4 3.13 and §§ 121.369(b)(5), 135.427(b)(5), and 145.109(b). 3.5.11.5.1 A n investigation of the calibrated tool program is initiated as required by § 5.71(a)(3). Records of previous audits (§ 5.97(b)) were reviewed for any previous calibrated tool findings. It was noted during the records review and interviews with employees that the tool room changed from a manual calibrated tool tracking system to a computer-based tracking system since the previous audit occurred. 3.5.11.5.2 Uncalibrated tools being issued to employees is identified as a new hazard (§ 5.73(c)). Flyslow Aviation initiates their SRM process as required by § 5.51(d). A discussion of the SRM process is located in paragraph 3.4.6. ### Page 73 3-59 3.5.11.5.3 Once acceptable risk controls are developed and implemented using their SRM processes, Flyslow Aviation establishes a new objective to reduce the issuance of uncalibrated tools and adds a requirement to track calibrated tool control under § 5.73(a)(3) to ensure the developed risk controls are functioning as designed. The process owner regularly reviews the data acquired through their safety assurance monitoring processes and evaluates the effectiveness of the changes to the calibrated tool program. 3.5.11.5.4 After a defined period of monitoring the tool tracking process, Flyslow Aviation determines the risk controls are working as designed as there have been no further instances of uncalibrated tools being issued to technicians. They close out the special audit and monitoring of this risk control for their calibrated tool program. 3.6 Subpart E, Safety Promotion. 3.6.1 Competencies and Training. 3.6.1.1 References. Section 5.91. 3.6.1.2 Part 5 Requirement. § 5.91, Competencies and training. Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS. 3.6.1.3 Discussion. Aviation organizations are required to provide initial safety training for employees so they can perform their SMS-related duties. Training should be specific to employee roles and responsibilities with regard to their duties associated with the maintenance of the SMS. Training can take any form or manner the aviation organization determines is acceptable when considering the size and complexity of their operations. An example of this could be all aviation-related employees must be trained on hazard reporting processes and procedures while process owners would require additional training in the SRM and safety assurance processes. 3.6.1.3.1 Recurrent training may also be necessary to reinforce skills to meet the requirement for an employee to maintain competencies. For example, an employee who is a process owner will probably need recurrent SMS training (such as safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) where a baggage handler would only need a refresher on how to use the confidential hazard reporting program. Intervals for recurrent training are determined by the organization based on historical and operational requirements. These intervals must be of sufficient frequency to ensure employees maintain the competencies required. ### Page 74 3-60 3.6.1.3.2 Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they successfully perform work functions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. Aviation organizations should establish competencies for all employees commensurate with their duties relevant to the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests and then measured periodically during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As a part of safety assurance, organizations should periodically review the training program(s) to ensure those programs meet the objectives set out in the safety policy. 3.6.1.3.3 It is the responsibility of all aviation organizations to determine their training needs based on operational requirements. Management personnel specifically designated by the accountable executive to ensure the SMS is fully implemented may need to be trained first and may also need specialized training to fulfill their responsibilities. Determining the organization’s training needs starts with a careful review of the safety policy, processes, and objectives. Everyone working within the scope of the SMS should receive training commensurate with their position in the organization. 3.6.1.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.6.1.4.1 Aviation organizations may choose to either train their employees in house or contract the training to outside vendors. Whichever option is taken, the training must be specific to the SMS and aviation activities conducted. Training can be in person or virtual based on organizational needs. Training should be modular so only the material pertinent to the position within the organization is presented. For example, a maintenance technician might only need to be trained on hazard reporting while a process owner would need to understand the organization’s SRM processes and procedures. A small or low-complexity organization with only a few employees would likely complete online training to meet this requirement. Aviation organizations on the higher end of the size or complexity spectrum could have a training department that develops and conducts the training. 3.6.1.5 Considerations for Small and Single-Individual Organizations. The knowledge and experience gained by a single individual developing the organization’s SMS is likely sufficient to meet training requirements for the organization. In a small organization, consider whether the safety manager or ### Page 75 3-61 the individual assigned the associated duties (if there is one in a small organization) has received SMS training. 3.6.2 S afety Communication . 3.6.2.1 References. Section 5.93. 3.6.2.2 Part 5 Requirement. § 5.93, Safety communication. Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum: (a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities. (b) Conveys hazard information relevant to the employee’s responsibilities. (c) Explains why safety actions have been taken. (d) Explains why safety procedures are introduced or changed. 3.6.2.3 Discussion. 3.6.2.4 Effective communication involves adjusting the content and manner in which the information is delivered to match the employee’s role in the organization. The accountable executive must ensure communication mechanisms are available and are effectively used. The delivery system should be appropriate to the size and complexity of the organization. 3.6.2.4.1 Safety policy and information could be provided as text, visual media (e.g., posters or short videos), orally, or through examples. Communication should be consistent and in a format that employees at each level can relate to and be delivered using whichever media the organization utilizes. For example, hazard communications regarding birds for flightcrew members (regarding new bird strike avoidance techniques) may be in a “Notices” section of the Flight Operations Manual (FOM) and may be reinforced by recurrent training. Hazard communications made to line maintenance technicians (regarding birds roosting and nesting in flight controls, auxiliary power unit (APU) intakes, and engine cowlings) may be conveyed by posters and changes to daily inspection procedures. Hazard communications regarding birds made to ground service personnel may be in the form of posters, videos, and demonstrations (cleaning and removing bird droppings from windshields). 3.6.2.5 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. ### Page 76 3-62 3.6.2.5.1 In smaller or lower complexity aviation organizations, communicating safety considerations to employees may be simple and direct. For example, the accountable executive could conduct regular all-hands/employee meetings, such as “hangar talk sessions.” Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams. Aviation organizations with only a few employees could utilize a required reading list consisting of material from industry or other sources. The selected material would be applicable to the operations conducted. Documentation of what was reviewed would meet the requirements of § 5.97(d). Aviation organizations on the higher end of the spectrum of size or complexity may utilize communication methods that are more structured. Safety information may be distributed throughout the organization by printed or electronic means or a combination of both. Communication and feedback may be formalized in order to provide information to individual employees as well as organization-wide information for cross-boundary issues and/or common hazards. A tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. Information technology approaches, such as email broadcasts or intranet websites, may be considered to facilitate directing the flow of safety information and recording its accomplishment for evaluation and auditing purposes. 3.6.2.6 Single-Individual Organizations. 3.6.2.6.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory sections are excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft: Section 5.93: Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum: (a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities. (b) Conveys hazard information relevant to the employee’s responsibilities. (c) Explains why safety actions have been taken. (d) Explains why safety procedures are introduced or changed. 3.6.2.6.2 Single-individual organizations are not required to have a safety communication process or procedure; however, they should consider the methods they will utilize when sharing information with other aviation service ### Page 77 3-63 providers they interface with. Methods used can be as simple or as complex as the organization chooses, but they should be consistent. Maintaining a “Journey Log” or “Unusual Occurrences” log may be useful for regular review and reinforcement of safety concerns identified when performing the aviation service. This will facilitate entering the occurrences into the safety assurance component (§ 5.71) for tracking and resolution. 3.7 Subpart F, SMS Documentation and Recordkeeping. 3.7.1 SMS Documentation. 3.7.1.1 References. Sections 5.95 and 145.215. 3.7.1.2 Part 5 Requirement. § 5.95, SMS documentation. Any person required to have an SMS under this part must develop and maintain the following SMS documentation: (a) Safety policy. (b) SMS processes and procedures. 3.7.1.3 Discussion. 3.7.1.3.1 Part 5 does not require aviation organizations to develop and maintain an SMS manual. All that part 5 requires an aviation organization to do is document their SMS safety policy and SMS processes and procedures. How this is accomplished is up to the aviation organization. Larger organizations are likely to have an SMS manual whereas smaller organizations might use a compliance statement or spreadsheet listing the part 5 requirements and how the organization meets the requirements. SMS documentation may be maintained either as hard copies or electronically. It may be contained in a General Operations Manual (GOM) or Repair Station Manual (RSM) or any other combination of documentation and manuals that is appropriate for the organization. However, the documentation is maintained, the organization should ensure it remains up to date. 3.7.1.3.2 The aviation organization should also implement a distribution system (if needed) to ensure documents dealing with SMS processes and procedures are promptly updated whenever there is a change. 3.7.1.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement SMS documentation based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. ### Page 78 3-64 3.7.1.4.1 In a small or lower complexity aviation organization, the owner/manager (accountable executive) or designee may be responsible for maintaining and distributing current versions of guidance documents. Documentation may consist of a set of typewritten documents, spreadsheets, and forms that are kept in file cabinets or binders. They may also use WBAT or other third-party providers. Managers of medium-complexity organizations need the same type of information to make decisions; however, the volume is typically larger than that of a low-complexity organization and smaller than that of a high-complexity organization. Aviation organizations on the higher end of the size or complexity spectrum may institute documentation and recordkeeping processes using WBAT, other third-party providers, unique software applications, or development of new database tools to support risk reporting and analysis. These organizations should examine existing tools and infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements. 3.7.1.5 Considerations for Small and Single-Individual Organizations. While single-pilot organizations are not required to maintain a manual system per § 135.21, they are still required to document their SMS safety policy and SMS processes and procedures. How this is accomplished is up to the aviation organization. 3.7.2 S MS Records. 3.7.2.1 References. Section 5.97. 3.7.2.2 Part 5 Requirement. § 5.97, SMS records. Any person required to have an SMS under this part must: (a) Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation. (b) Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years. (c) Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person. (d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months. 3.7.2.3 Discussion. Organizations are required to retain documents associated with the outputs of SRM processes for as long as the risk control remains relevant to the operation. For SRM processes that do not result in any risk controls being implemented or where risks are acceptable, aviation organizations are not required to retain these documents. While part 5 does not require an organization to retain a system analysis when no risk control is developed, aviation organizations may find it useful to retain this analysis for future use. ### Page 79 3-65 Part 5 requires documentation of risk assessments and risk controls and any supporting data used in the SRM process be retained for as long as the risk control remains appropriate for the operations. These outputs serve as evidence of the organization reviewing the system and finding the associated hazards and residual risks acceptable. Outputs of the safety assurance processes must be retained for a minimum of 5 years. Section 5.23 requires the members of management and the accountable executive to review the outputs of the SRM and safety assurance processes to ensure the effectiveness of safety risk controls and that the SMS is functioning as designed. Documentation showing the process owners and accountable executive have reviewed these documents should also be retained. Training records must show when the individual initially received training to attain the competencies necessary for their position. Proof of recurrent training completion must also be retained as documentation of maintaining the competencies required for their position. Superseded recurrent training records must be retained in accordance with the aviation organization’s record retention processes and procedures for as long as the employee is employed by the aviation organization. Records of safety communications and hazard information sharing must be retained for a minimum of 24 consecutive calendar months. Attendance rosters from meetings or training events also provide documentation of employees that have received the safety communications. 3.7.2.3.1 Aviation organizations are required to retain the outputs of their SRM processes. Section 5.97(a) requires maintaining these records for as long as the associated risk control remains applicable to the current operational activities. While not a regulatory requirement, it is a good policy to retain all SRM documentation so work previously conducted can be reviewed by future SRM workgroups. This has the potential of reducing duplicative work or undoing existing risk controls. 3.7.2.3.2 Aviation organizations are also required to maintain records of their safety assurance outputs and retain them for a minimum of 5 years. As with an SMS, the process used for safety assurance outputs needs to be appropriate for the aviation organization. A good practice would be to develop a method of documenting who in the organization has reviewed the data. Other sections of this part require a review of this data to ensure risk controls are working properly and organizational objectives are being met; this would be an appropriate way to meet this requirement. 3.7.2.3.3 Training records need to be retained for each individual in the organization with duties and responsibilities under the SMS. These records must be maintained as long as the individual is employed by the organization. There is no provision for purging SMS training records. SMS training records are in addition to any other required training records from other parts. It is key to ensure the process developed for record retention is appropriate for the size and complexity of the aviation organization. ### Page 80 3-66 3.7.2.3.4 Records of all safety communications are required to be retained for a minimum of 24 consecutive calendar months. The process developed for record retention should be appropriate for the aviation organization. As an example, digital photographs of safety-related posters or signs in a maintenance hangar could be retained as a record of the communication. Read-and-initial files would also provide a record. Hangar talks and flight crew alerts are also types of communications that would be retained. These communications can be retained electronically or in paper format. The method utilized should be appropriate to the size and complexity of the aviation organization. 3.7.2.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met. 3.7.2.4.1 In smaller or lower complexity aviation organizations, the owner/manager (accountable executive) or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, and completed forms that are kept in file cabinets or binders. Aviation organizations on the higher end of the spectrum of size or complexity may identify an individual or small staff to coordinate document maintenance and retention. This staff may use a combination of paper and electronic media or a combination of both to administer the process. Some records may be retained by department heads in accordance with a procedure delegating this responsibility. Some aviation organizations may have a dedicated records staff or department whose duties include document distribution and records retention. Due to the size and complexity of the organization, the use of technology is probably more pronounced. 3.7.2.5 Single-Individual Organizations. Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft. Section 5.97: Any person required to have an SMS under this part must: (d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months. 3.7.2.5.1 Single-individual organizations are not required to have a safety communication process or procedure; therefore, there is not a requirement to retain records of communications. ### Page 81 3-67 3.7.2.6 SMS Documentation and Recordkeeping Example. In an effort to raise awareness of the calibrated tool issue and employee reporting, Flyslow Aviation’s management included discussions on these areas as a monthly topic during employee meetings (§§ 5.23(2)(iii) and 5.93). In addition, management also posted signs and posters in the breakroom and work areas. Rosters of meeting attendees were retained as well as a copy of the agenda topics (§ 5.97(d)). Note 1: In this example, § 5.91 would not be required as the training requirement addresses SMS processes and procedures. Calibrated tool usage, which is the subject of the training, is covered by other regulations and not the SMS. Note 2: Flyslow Aviation has control of the calibrated tool program and the associated hazards. If the hazard was under the control of an interfacing organization, then Flyslow Aviation would communicate the hazard under § 5.57. ### Page 82 4-1 CHAPTER 4. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT **SYSTEM (SMS)** 4.1 Process Overview. 4.1.1 Title 14 CFR Part 5 Regulatory Requirements. Title 14 CFR part 119 certificate holders (CH) authorized to operate under 14 CFR part 121 must show compliance with all revised part 5 requirements by May 28, 2025 (part 5, § 5.7(a)). 4.1.1.1 Existing part 119 aviation organizations authorized to operate under 14 CFR part 135 or aviation organizations conducting air tours under a 14 CFR part 91, § 91.147 Letter of Authorization (LOA) with an existing SMS need to review their existing SMS programs for compliance with part 5 (§ 5.9(a)). Areas found not in compliance, that need to be added, or that have been changed should be identified and addressed. Once the aviation organizations have implemented and developed an SMS meeting the requirements of part 5, they must submit a declaration of compliance stating the SMS meets the requirements of part 5 prior to May 28, 2027. 4.1.1.2 New applicants for a part 119 certificate authorizing them to operate under part 121 or 135 or air tour operators requiring a § 91.147 LOA must demonstrate they meet the applicable regulatory requirements of part 5 prior to issuance of a certificate or LOA (§§ 5.7(b) and 5.9(b), as applicable). New applicants must meet part 5 requirements as a part of the certification process as defined in the Air Operator and Air Agency Certification and Application Process in FAA Order 8900.1, Volume 2. 4.1.2 Aviation Organizations Voluntarily Implementing an SMS. Aviation organizations that seek FAA acknowledgement of their voluntary SMS should develop and implement an SMS that meets part 5. They should submit a declaration of compliance once this has been accomplished. The FAA will validate SMS implementation as a part of routine surveillance activities. For information pertaining to a voluntary SMS, refer to Order 8900.1, Volume 17, Safety Management System. 4.2 Building an SMS. The first step in developing an SMS is mapping out and analyzing the aviation organization by developing an organizational description. The initial mapping and analysis start by describing and documenting the organizational structure and looking at the internal interfaces and external interfaces with other aviation organizations. 4.2.1 Organizational Description. 4.2.1.1 The organizational description should detail each of the aviation organization’s activities by function as well as the management personnel responsible for the organization’s departments (e.g., flight operations, training, ground operations, cabin safety, dispatch, and maintenance). The organizational description may also include, for example, a discussion of external interfaces, such as using contractors for fueling and deicing operations, maintenance functions, etc. It is also common for representatives ### Page 83 4-2 of various employee groups to be discussed and described during the organizational description process. Existing aviation organizations could review their LOAs, operations specifications (OpSpecs), or ratings and limitations to determine if their organization is properly described. 4.2.1.2 As a part of the organizational description, aviation organizations should describe and document key positions for risk acceptance. Managers and process owners should also be identified in this analysis. Process owners sometimes occupy positions that may not be considered management but are in a position to accept risk or change processes or procedures in their area. An example of this could be a battery shop technician or lead dispatcher. 4.2.2 D eveloping a Plan of Action. To develop a plan of action for SMS development and implementation, aviation organizations need to understand their current state of compliance with the requirements of part 5. This should include programs already adopted that may meet the requirements of part 5. One way to accomplish this is by conducting a gap analysis and documenting the results in a compliance statement. A gap analysis involves analyzing and assessing the aviation organization’s existing programs, systems, processes, and activities with respect to part 5. If a process in the aviation organization satisfies part 5, the analysis should document how that process meets the requirements. This may be accomplished by referencing the process or procedure in the manual system (if required) where the requirement is discussed. Aviation organizations may use any technique to identify what needs to be accomplished to implement an SMS. Many organizations have developed spreadsheets with the part 5 requirements in one column with the next column being used to describe how the organization meets the requirement or what the organization needs to develop to “fill the gap.” For detailed information on developing and completing a compliance statement, see Appendix D, Guidance for Developing a Compliance Statement. 4.2.3 Organizational Processes. Many aviation organizations may find that they have most of the elements of part 5 in their current operational processes. While these processes may not entirely fulfill the requirements (e.g., they may be limited in scope (do not cover the entire organization) and interoperability (do not interface sufficiently to form a “system”)), credit should be taken for those areas already meeting part 5 requirements. Areas that are deficient should be addressed and processes developed. Existing processes may be internally developed or from third-party contractors’ products or services. The goal here is to ensure that all part 5 requirements are met. 4.2.4 Regulatory and Voluntary Programs. A list of regulatory and voluntary programs that may be appropriate for inclusion in the SMS to satisfy the requirements can be found in Chapter 5, Integrating Existing Safety Programs Into the Safety Management System (SMS). ### Page 84 **5-1 CHAPTER 5. INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY** **MANAGEMENT SYSTEM (SMS)** 5.1 Purpose of This Chapter. This chapter explains how existing safety programs may be integrated into the SMS safety assurance processes. The FAA encourages the continued use of existing safety programs as an input into the safety assurance processes to ensure the safety performance of aviation organizations. Expanding current safety programs across the entire aviation organization is one way to provide a comprehensive systems approach to safety assurance. These programs would be accepted as one means of meeting some of the provisions of 14 CFR part 5, § 5.71, but they may not fully meet the requirements. Other means may be required. Note: I t is not the intent or purpose of an SMS to override any existing regulatory standards or alter approval and acceptance processes that already apply to the aviation organization. 5.2 Discussion of Individual Programs. The following are FAA or FAA-sanctioned programs that could be integrated into an SMS. This is not intended to be an all-inclusive listing, and other programs may also satisfy SMS requirements. 5.2.1 C ontinuing Analysis and Surveillance System (CASS). 5.2.1.1 Program. A CASS is required by 14 CFR part 121, § 121.373 and part 135, § 135.431. A CASS is a quality assurance system that monitors and analyzes the performance and effectiveness of the air carrier’s Continuous Airworthiness Maintenance Program (CAMP). 5.2.1.2 I ntegration. A CASS overlaps some part 5 required SMS safety assurance functions (§ 5.71). A CASS could be a standalone system or a subsystem within an SMS. A CASS may be maintained separately; however, it would probably be beneficial to integrate a CASS within the SMS. However accomplished, it is imperative to understand that a CASS should supply information to the SMS. The SMS may even support a CASS through the use of Safety Risk Management (SRM) and safety assurance processes applied to CASS needs. An SMS may evaluate the CASS to ensure that all critical CASS elements are being performed and controlled and all outcomes are acceptable in accordance with FAA Order 8900.1 and AC 120-79, Developing and Implementing an Air Carrier Continuing Analysis and Surveillance System. 5.2.2 Aviation Safety Action Program (ASAP). 5.2.2.1 Program. The ASAP is meant to encourage voluntary reporting of safety issues and events that come to the attention of a participating aviation organization’s employees. ASAPs include processes for intake of data from employees, analysis of the data, and development of corrective actions within a confidential environment. ASAP is accepted by the FAA but is not a required program. ASAP development, implementation, acceptance, and operation are detailed in AC 120-66, Aviation Safety Action Program. An ### Page 85 5-2 ASAP may provide some protection from sanctions due to a regulatory noncompliance to participating employees. 5.2.2.2 Integration. An ASAP can be used to satisfy some SMS requirements (§ 5.71(a)(7)). For example, the ASAP can be used to partially satisfy the requirement for a confidential reporting system. Employee groups not covered by an ASAP would need some type of confidential employee reporting system. In the event of termination of an ASAP program, those covered employees would be required to have a confidential employee reporting system. The ASAP requires analysis and corrective action; however, it does not require analysis of patterns or trends across reports that would identify systemic problems. This information should be analyzed through the safety assurance and SRM processes. 5.2.3 A viation Safety Reporting System (ASRS). 5.2.3.1 Program. The FAA ASRS uses the National Aeronautics and Space Administration (NASA) as a third party to receive aviation safety reports. ASRS does not provide an explicit requirement for corrective actions nor does it provide sufficient detailed data with which to adequately analyze specific systems or processes. Another limitation of ASRS is it does not provide information to the aviation organization that a report has been submitted. 5.2.3.2 Integration. Trend and global systemic information may be appropriate for safety assurance analysis under SMS. While the actual submitted report is not available for the aviation organization to input into their SMS, ASRS provides periodic reports on various hazards that have been identified. They have a monthly newsletter called “Callback” that looks at submitted reports and provides an analysis of what happened based on the submitter’s comments. A review of these reports could be useful if input into the safety assurance component and monitored to ensure they are not present in the current operational environment. For additional information, refer to AC 00-46, Aviation Safety Reporting Program. 5.2.4 Flight Operations Quality Assurance (FOQA). 5.2.4.1 Program. FOQA is a voluntary program for the routine collection and analysis of digital flight data generated during aircraft operations. The FOQA program is another potential tool in an aviation organization’s SMS to monitor operational data and provide data analysis and assessment. FOQA program development, implementation, acceptance, and operation are covered in AC 120-82, Flight Operational Quality Assurance. 5.2.4.2 Integration. FOQA can be used to satisfy some SMS safety assurance requirements (§ 5.71). FOQA requires data collection and analysis but stops short of requiring corrective action. Thus, this requirement would be dependent on the configuration of the specific aviation organization’s ### Page 86 5-3 program. FOQA, if present, must interface with the aviation organization’s other safety programs and their SMS. 5.2.5 V oluntary Disclosure Reporting Program (VDRP). 5.2.5.1 Program. The VDRP provides incentives for an aviation organization to voluntarily identify, report, and correct instances of regulatory noncompliance. The FAA will review, accept, and oversee corrective actions and conduct followup surveillance. The FAA’s acceptance of the voluntary disclosure foregoes legal enforcement action and protects from release, when specific criteria are met, qualifying disclosures and corrective actions. For additional information on the VDRP, refer to AC 00-58, Voluntary Disclosure Reporting Program. 5.2.5.2 I ntegration. VDRP data can be a useful source of safety information. Section 5.71(a)(6) requires aviation organizations to investigate any discoveries of a potential noncompliance with regulatory standards or other safety risk controls that are documented in the organization’s processes and procedures. Data gathered during an investigation, subsequent development, and implementation of a corrective action should be integrated into the data analysis, assessment, and validation processes of a service provider’s SMS safety assurance. 5.2.5.3 Joint Discovery. If a regulated entity voluntarily agrees to conduct a joint audit (inspection) with the FAA during which an apparent violation is discovered either by the organization or FAA members of the audit (inspection) team, the FAA may accept a voluntary disclosure submitted by the organization even though the FAA has already learned of the apparent violation during the course of the joint audit (inspection). For additional information, refer to Order 8900.1, Volume 11, Chapter 1, Voluntary Disclosure Reporting Program. 5.2.6 In ternal Evaluation Program (IEP). 5.2.6.1 Program. The IEP is a safety process that, through inspections, audits, and evaluations, assesses the adequacy of managerial controls and processes in critical safety systems. The FAA encourages (and the Department of Defense (DOD) requires) using an IEP to increase awareness management and employees’ responsibility to follow organizational safety practices and comply with all regulatory requirements. IEP is the subject of AC 120-59, Internal Evaluation Programs, and AC 145-5, Repair Station In ternal Evaluation Programs. 5.2.6.2 I ntegration. An IEP can be part of a safety assurance process. If used by an aviation organization, an IEP can satisfy the internal evaluation requirement of § 5.71. Aviation organizations are encouraged to input any findings from an IEP into their safety assurance processes to ensure they are tracked for any ### Page 87 5-4 negative trends, and, if needed, SRM could be applied and appropriate controls developed and integrated. Since an IEP is not covered by a standalone regulation or formal voluntary program approval process, its use within an SMS is dependent on the configuration. 5.2.7 L ine Operations Safety Audit (LOSA). 5.2.7.1 Program. The LOSA is a formal process where qualified observers ride in the jump seat during regularly scheduled flights to collect safety-related data on various weather and visibility conditions, operational complexities, and flightcrew performance. A LOSA program is not formally approved or accepted by the FAA. LOSA is the subject of AC 120-90, Line Operations Safety Audits. 5.2.7.2 I ntegration. A LOSA program could be used to satisfy part of the internal audit requirements of § 5.71. LOSA results, if present, should be included in the safety assurance data acquisition process. Many organizations provide a service for smaller operators wanting to participate in a LOSA program. 5.2.8 A dvanced Qualification Program (AQP) . 5.2.8.1 Program. The AQP is a systematic methodology for developing training program components for air carrier crewmembers and dispatchers. An AQP incorporates data-supported quality control processes for validating and maintaining the effectiveness of curriculum content. AQP is the subject of AC 120-54, Advanced Qualification Program. 5.2.8.2 Integration. The AQP can be used to satisfy a portion of the SMS safety assurance monitoring requirement (§ 5.71(a)(1)). The aviation organization may elect to use or develop an AQP depending on their unique operational complexities. 5.2.9 O ther Information Sources. Other sources of information to be considered are safety recommendations from the National Transportation Safety Board (NTSB). Aviation organizations should review these recommendations as part of their safety assurance functions to determine if there are any potential hazards that could exist in their processes or procedures. Manufacturers’ mandatory Service Bulletins (SB), Service Difficulty Reports (SDR), and Airworthiness Directives (AD) are also sources of potential hazards that could affect operations. Information for Operators (InFO) and Safety Alerts for Operators (SAFO) are also sources of information that should be reviewed and integrated into the safety assurance process, if applicable. 5.3 U se of Third -Party Providers to Assist in SMS Implementation and Maintenance. 5.3.1 The FAA and many industry stakeholders have gained significant experience with SMS principles in the years since part 5 was originally published. As SMS requirements expand to other organizations, the FAA expects more third-party providers to offer ### Page 88 5-5 services to aid aviation organizations in developing and implementing a part 5 compliant SMS. 5.3.2 Aviation organizations may work with a third-party provider to develop or implement an SMS that meets part 5 requirements. A third-party SMS provider could assist in developing the SMS and training the operator to use it. Producing and providing software applications to aid in SMS documentation and recordkeeping are other potential support services of third-party providers. Other options could include not only development and training but the third-party provider could also operate some parts of the SMS on behalf of the aviation service provider. As an example, many third-party providers offer mediation services for employee ASAP reporting programs. The organizations serve as mediator and de-identify the reports, meet with the FAA to discuss the report, and work to develop a corrective action to mitigate the reported hazard or reason for the report. The third-party provider would then provide periodic reports on the aggregated ASAP reports received and moderated with corrective actions so the aviation organization could enter the data into their SMS for monitoring if it is applicable to the activities conducted by the aviation organization. 5.3.3 When considering utilizing a third-party organization to assist with SMS management, there are some areas that cannot be delegated. For instance, the accountable executive responsibilities and roles cannot be delegated to a contractor. 5.3.4 Aviation organizations are encouraged to leverage their existing SMS processes, whether developed in-house or developed by third-party contractors, to meet part 5 requirements and to utilize all available industry resources, such as educational institutions, international organizations, and FAA guidance and support. Aviation organizations remain fully responsible for ensuring regulatory compliance. Note: The FAA does not endorse the use of any specific product or third-party provider. The responsibility for ensuring compliance with part 5 remains with the aviation organization. ### Page 89 Appendix A A-1 APPENDIX A. SMS CROSS-REFERENCE FROM PART 5 TO THE ICAO FRAMEWORK A.1 The following table provides a cross-reference between 14 CFR part 5 and the International Civil Aviation Organization (ICAO) Annex 19, Safety Management, Appendix 2, Framework for a Safety Management System (SMS). It is an aid to aviation organizations who have implemented all or part of an SMS under another program that may have been based on the ICAO framework. The FAA emphasizes that this cross-reference chart does not mean that an existing process automatically satisfies the pertinent requirements of part 5. Aviation organizations should evaluate their existing SMS to determine whether changes need to be made in order to fully satisfy the requirements of part 5. Note: I CAO s afety management standards require aviation organizations of airplanes over 27,000 kilograms (kg) to have included a Flight Data Analysis (FDA) program as part of their SMS. Part 5 does not require these programs. Table A-1. Part 5 to ICAO SMS Framework Cross-Reference Part 5 Section Text ICAO Framework Components and Elements Subpart A General § 5.1 Applicability. § 5.1 This part applies to all of the following: N/A § 5.1(a) (a) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 121 of this chapter. N/A § 5.1(b) (b) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 135 of this chapter. N/A § 5.1(c) (c) Any person that holds or applies for a Letter of Authorization issued under § 91.147 of this chapter. N/A § 5.3 Definitions. § 5.3 Hazard means a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident, as defined in 49 CFR 830.2. N/A ### Page 90 Appendix A A-2 Part 5 Section Text ICAO Framework Components and Elements Risk means the composite of predicted severity and likelihood of the potential effect of a hazard. Risk control means a means to reduce or eliminate the effects of hazards. Safety assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information. Safety Management System (SMS) means the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. Safety objective means a measurable goal or desirable outcome related to safety. Safety performance means realized or actual safety accomplishment relative to the organization’s safety objectives. Safety policy means the person’s documented commitment to safety, which defines its safety objectives and the accountabilities and responsibilities of its employees in regards to safety. Safety promotion means a combination of training and communication of safety information to support the implementation and operation of an SMS in an organization. Safety Risk Management means a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk. § 5.5 General requirements. § 5.5(a) (a) SMS components. An SMS under this part must be appropriate to the size, scope, and complexity of the person’s organization and include, at a minimum, all of the following components: N/A § 5.5(a)(1) (1) Safety policy that meets the requirements of subpart B of this part. N/A ### Page 91 Appendix A A-3 Part 5 Section Text ICAO Framework Components and Elements § 5.5(a)(2) (2) Safety risk management that meets the requirements of subpart C of this part. N/A § 5.5(a)(3) (3) Safety assurance that meets the requirements of subpart D of this part. N/A § 5.5(a)(4) (4) Safety promotion that meets the requirements of subpart E of this part. N/A § 5.5(b) (b) Continuing requirements. Any person required to develop and implement an SMS under this part must maintain the SMS in accordance with this part. N/A § 5.7 Requirements for domestic, flag, and supplemental operations. § 5.7(a) (a) Any person authorized to conduct operations under part 121 of this chapter that has an SMS acceptable to the FAA on or before May 28, 2024, must revise its SMS to meet the requirements of this part no later than May 28, 2025. N/A § 5.7(b) (b) Any person applying for authorization to conduct operations under part 121 of this chapter or with such application pending on or after May 28, 2024, must develop and implement an SMS that meets the requirements of this part. N/A § 5.7(c) (c) Any person required to develop and implement an SMS under this section must maintain the SMS as long as the person is authorized to conduct operations under part 121 of this chapter. N/A § 5.7(d) (d) Any person required to develop and implement an SMS under this section must make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part. N/A ### Page 92 Appendix A A-4 Part 5 Section Text ICAO Framework Components and Elements § 5.9 Requirements for commuter and on-demand operations or passenger-carrying flights for compensation or hire. § 5.9(a) (a) Any person authorized to conduct operations under part 135 of this chapter or that holds a Letter of Authorization issued under § 91.147 of this chapter before May 28, 2024, must: N/A § 5.9(a)(1) (1) Develop and implement an SMS that meets the requirements of this part no later than May 28, 2027. N/A § 5.9(a)(2) (2) Submit to the FAA, a declaration of compliance with this part in a form and manner acceptable to the Administrator no later than May 28, 2027. N/A § 5.9(b) (b) Any person applying for authorization to conduct operations under part 135 of this chapter or a Letter of Authorization under § 91.147 of this chapter, or with such application pending on or after May 28, 2024, must develop and implement an SMS that meets the requirements of this part. N/A § 5.9(c) (c) Any person required to develop and implement an SMS under this section must maintain the SMS as long as the person is authorized to conduct operations under either part 135 or § 91.147 of this chapter. N/A § 5.9(d) (d) Any person required to develop and implement an SMS under this section must make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part. N/A § 5.9(e) (e) The following requirements do not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: §§ 5.21(a)(4), 5.21(a)(5), 5.21(c), 5.23(a)(2), 5.23(a)(3), 5.23(b), 5.25(b)(3), 5.25(c), 5.27(a), 5.27(b), 5.71(a)(7), 5.93, and 5.97(d) of this part. N/A ### Page 93 Appendix A A-5 Part 5 Section Text ICAO Framework Components and Elements Subpart B Safety Policy 1.0 § 5.21 Safety policy. § 5.21(a) (a) Any person required to have an SMS under this part must have a safety policy that includes at least the following: 1.1 § 5.21(a)(1) (1) The person’s safety objectives. 1.1 § 5.21(a)(2) (2) The person’s commitment to fulfill the safety objectives. 1.1 § 5.21(a)(3) (3) A clear statement about the provision of the necessary resources for the implementation of the SMS. 1.1 § 5.21(a)(4) (4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues. 1.1 § 5.21(a)(5) (5) A policy that defines unacceptable behavior and conditions for disciplinary action. 1.1 § 5.21(a)(6) (6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27. 1.1 § 5.21(a)(7) (7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority. N/A § 5.21(b) (b) The safety policy must be signed by the accountable executive described in § 5.25. 1.1 §5.21(c) (c) The safety policy must be documented and communicated throughout the person’s organization. 1.1 § 5.21(d) (d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the person. 1.1 § 5.23 Safety accountability and authority. § 5.23(a) (a) Any person required to have an SMS under this part must define in its safety policy the accountability for safety of the following individuals: 1.2 § 5.23(a)(1) (1) Accountable executive, as described in § 5.25. 1.2 ### Page 94 Appendix A A-6 Part 5 Section Text ICAO Framework Components and Elements § 5.23(a)(2) (2) All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to: 1.2 § 5.23(a)(2)(i) (i) Hazard identification and safety risk assessment. 1.2 § 5.23(a)(2)(ii) (ii) Assuring the effectiveness of safety risk controls. 1.2 § 5.23(a)(2)(iii) (iii) Promoting safety as required in subpart E of this part. 1.2 § 5.23(a)(2)(iv) (iv) Advising the accountable executive on the performance of the SMS and on any need for improvement. 1.2 § 5.23(a)(3) (3) Employees relative to the person’s safety performance. 1.2 § 5.23(b) (b) The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance. 1.2 § 5.25 Designation and responsibilities of required safety management personnel. § 5.25(a) (a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following: 1.2 § 5.25(a)(1) (1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization. N/A § 5.25(a)(2) (2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization. N/A § 5.25(a)(3) (3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization. N/A § 5.25(a)(4) (4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization. N/A ### Page 95 Appendix A A-7 Part 5 Section Text ICAO Framework Components and Elements § 5.25(b) (b) Responsibilities of the accountable executive. The accountable executive must accomplish the following: N/A § 5.25(b)(1) (1) Ensure that the SMS is properly implemented and is performing across all pertinent areas. 1.2 § 5.25(b)(2) (2) Develop and sign the safety policy. 1.1.1 § 5.25(b)(3) (3) Communicate the safety policy throughout the person’s organization. N/A § 5.25(b)(4) (4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person. 1.1.1 § 5.25(b)(5) (5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75. 1.1 § 5.25(c) (c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following: 1.3 § 5.25(c)(1) (1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization. 1.3 § 5.25(c)(2) (2) Facilitate hazard identification and safety risk analysis. N/A § 5.25(c)(3) (3) Monitor the effectiveness of safety risk controls. N/A § 5.25(c)(4) (4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part. N/A § 5.25(c)(5) (5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement. N/A § 5.27 Coordination of emergency response planning. § 5.27 Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following: 1.4 ### Page 96 Appendix A A-8 Part 5 Section Text ICAO Framework Components and Elements § 5.27(a) (a) Delegation of emergency authority throughout the person’s organization. N/A § 5.27(b) (b) Assignment of employee responsibilities during the emergency. N/A § 5.27(c) (c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services. 1.4 Subpart C Safety Risk Management 2.0 § 5.51 Applicability. § 5.51 Any person required to have an SMS under this part must apply safety risk management to the following: 2.1.1 § 5.51(a) (a) Implementation of new systems. 2.1.2 § 5.51(b) (b) Revision of existing systems. 2.1.2 § 5.51(c) (c) Development of operational procedures. 2.1.2 § 5.51(d) (d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part. 2.1.2 § 5.53 System analysis and hazard identification. § 5.53(a) (a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c). 2.1 § 5.53(b) (b) In conducting the system analysis, the following information must be considered: N/A § 5.53(b)(1) (1) Function and purpose of the system. 2.1 § 5.53(b)(2) (2) The system’s operating environment. 2.1 § 5.53(b)(3) (3) An outline of the system’s processes and procedures. N/A ### Page 97 Appendix A A-9 Part 5 Section Text ICAO Framework Components and Elements § 5.53(b)(4) (4) The personnel, equipment, and facilities necessary for operation of the system. 2.1 § 5.53(b)(5) (5) The interfaces of the system. 2.1 § 5.53(c) (c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis. 2.1 § 5.55 Safety risk assessment and control. § 5.55 Any person required to have an SMS under this part must: N/A § 5.55(a) (a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c). 2.2 § 5.55(b) (b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk. 2.2 § 5.55(c) (c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section. 2.2 § 5.55(d) (d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented. N/A § 5.57 Notification of hazards to interfacing persons. 2.2 § 5.57 If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services. 2.2 ### Page 98 Appendix A A-10 Part 5 Section Text ICAO Framework Components and Elements Subpart D Safety Assurance 3.0 § 5.71 Safety performance monitoring and measurement. § 5.71(a) (a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: 3.1.1 § 5.71(a)(1) (1) Monitoring of operational processes. 3.1.1 § 5.71(a)(2) (2) Monitoring of the operational environment to detect changes. 3.1.1 § 5.71(a)(3) (3) Auditing of operational processes and systems. 3.1.1 § 5.71(a)(4) (4) Evaluations of the SMS and operational processes and systems. 3.1.1 § 5.71(a)(5) (5) Investigations of incidents and accidents. 3.1.1 § 5.71(a)(6) (6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part. 3.1.1 § 5.71(a)(7) (7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting. 3.1.1 § 5.71(a)(8) (8) Investigations of hazard notifications that have been received from external sources. 3.1.1 § 5.71(b) (b) Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services. 3.1 ### Page 99 Appendix A A-11 Part 5 Section Text ICAO Framework Components and Elements § 5.73 Safety performance assessment. § 5.73(a) (a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to: 3.2 § 5.73(a)(1) (1) Ensure compliance with the safety risk controls established by the person. 3.2 § 5.73(a)(2) (2) Evaluate the performance of the SMS. 3.2 § 5.73(a)(3) (3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls. 3.2 § 5.73(a)(4) (4) Identify changes in the operational environment that may introduce new hazards. 3.2 § 5.73(a)(5) (5) Identify new hazards. 3.2 § 5.73(b) (b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part. 3.2 § 5.75 Continuous improvement. § 5.75 Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73. 3.3 Subpart E Safety Promotion 4.0 § 5.91 Competencies and training. § 5.91 Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS. 4.1 ### Page 100 Appendix A A-12 Part 5 Section Text ICAO Framework Components and Elements § 5.93 Safety communication. § 5.93 Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum: 4.2 § 5.93(a) (a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities. 4.2 § 5.93(b) (b) Conveys hazard information relevant to the employee’s responsibilities. 4.2 § 5.93(c) (c) Explains why safety actions have been taken. 4.2 § 5.93(d) (d) Explains why safety procedures are introduced or changed. 4.2 Subpart F SMS Documentation and Recordkeeping. 1.5 § 5.95 SMS documentation. 1.5 § 5.95 Any person required to have an SMS under this part must develop and maintain the following SMS documentation: 1.5.1 § 5.95(a) (a) Safety policy. 1.5.1 § 5.95(b) (b) SMS processes and procedures. 1.5.1 § 5.97 SMS records. 1.5 § 5.97 Any person required to have an SMS under this part must: § 5.97(a) (a) Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation. 1.5.2 § 5.97(b) (b) Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years. 1.5.2 ### Page 101 Appendix A A-13 Part 5 Section Text ICAO Framework Components and Elements § 5.97(c) (c) Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person. 1.5.2 § 5.97(d) (d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months. 1.5.2 ### Page 102 Appendix B B-1 APPENDIX B. SAMPLE SAFETY RISK MANAGEMENT (SRM) WORKSHEETS B.1 The sample worksheets in this appendix are provided to illustrate the Safety Risk Management (SRM) process and a possible way to develop and document the SRM processes required under 14 CFR part 5 subpart C. These worksheets are provided for illustrative purposes only. Aviation organizations may develop their own recordkeeping systems and should determine the amount and depth of documentation and recordkeeping that are needed to show compliance. Not all situations will require the same degree of detail. ### Page 103 Appendix B B-2 Figure B-1. Safety Risk Management Triggering Conditions and Summary Note: Refer to part 5, § 5.51. Title: Reason for Risk Assessment Implementation of new systems Revision of existing systems Development of operational procedures Identification of hazards or ineffective risk controls through the safety assurance processes in part 5 subpart D Brief Summary Where signed below, the responsible manager/process owner has determined that no new hazards have been introduced by this change. Name: Signature: ### Page 104 Appendix B B-3 Figure B-2. System Analysis Note: Refer to § 5.53(a) and (b ). Responsible Manager/Process Owner: Authority for Implementation and Risk Acceptance: Function and Purpose of the System or Change: Description of Operating Environment Personnel Equipment Facilities Internal Interfaces External Interfaces ### Page 105 Appendix B B-4 Figure B-3. Hazard List Note: Refer to §§ 5.23(a)(1) and 5.53(c). System/Project: Responsible Manager/Process Owner: Hazard Potential Consequence(s) H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 ### Page 106 Appendix B B-5 Figure B-4. Risk Analysis Note: Refer to § 5.55(a). Pre-Control Post-Control Hazard Potential Consequences Severity Likelihood Substitute Risk? Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 ### Page 107 Appendix B B-6 Figure B-5. Risk Analysis and Assessment Summary Note: Refer to §§ 5.23(b) and 5.55(b). Acceptance Authority (Sign Here and Initial Appropriate Columns): Pre-Control Accept? Post-Control Accept? Hazard Potential Consequences Severity Likelihood Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 ### Page 108 Appendix B B-7 Figure B-6. Risk Control Note: Refer to § 5.55(c) and (d). System/Project: Responsible Manager/Process Owner: Hazard Control Substitute Risk Residual Risk H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 ### Page 109 Appendix B B-8 Figure B-7. Risk Control Documentation Note: Refer to part 5 subpart F. System/Project: Hazard Procedure Documentation H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 ### Page 110 Appendix C C-1 APPENDIX C. GUIDANCE FOR DEVELOPING A SAFETY POLICY AND CODE OF ETHICS STATEMENT C.1 Safety Policy Statement. C.1.1 Many aviation organizations have developed a safety policy statement. The safety policy must contain the requirements in 14 CFR part 5, § 5.21 and be signed by the accountable executive (§§ 5.21(b) and 5.25(b)(2)). It could make sense to combine the code of ethics and a safety policy statement into a single document. References (“pointers”) to other manuals or documentation that provide guidance on how each requirement is met should be embedded in the safety policy statement. For example, the requirement for an emergency response plan (ERP) could be met by referring to a separate document or an appendix in a Repair Station Manual (RSM) or General Operations Manual (GOM). By pointing to where the information is located, it makes it easier for employees to find that material. A secondary benefit is it prevents duplication of documentation. It is important to remember the safety policy is unique to the aviation organization and should be developed to meet the unique and specific needs, operating profile, and structure of the aviation organization. C.1.2 P art 5 list s the specific documentation requirements that must be included in the completed safety policy (§ 5.95). A safety policy statement is a document that states what the organization will do and how employees are expected to act. The SMS processes and procedures define actions employees will take to meet the safety policy requirements and measurable objectives (i.e., how they are to perform their SMS duties and responsibilities). A safety policy statement (if developed as a separate document) and safety policy processes and procedures are necessary when developing and maintaining an SMS for completeness. C.2 C ode of Ethics. C.2.1 Aviation organizations are required to develop a code of ethics for all employees, including management personnel and officers. The safety policy must include a code of ethics that specifies that safety is the organization’s highest priority and applies to all employees, including management personnel and officers. This requirement is in § 5.21(a)(7). A code of ethics defines the aviation organization’s standards of conduct that employees are expected to uphold. The code of ethics should be a concise statement that outlines values the aviation organization holds and maintains in the course of business. A code of ethics is a very high-level statement that gives employees at all levels of the organization a general idea of what types of behavior and decisions are acceptable and expected in the conduct of business. A code of ethics may be combined with a safety policy statement at the discretion of the aviation organization. C.2.2 A safety policy and code of ethics statement should not be confused with the requirements of § 5.95, which requires aviation organizations to document their safety policy. All that needs to be documented in the safety policy and code of ethics statement is the aviation organization’s expectations. ### Page 111 Appendix C C-2 C.3 Sample Statement. Figure C-1 is a sample safety policy and code of ethics statement. Figure C-1. Sample Safety Policy and Code of Ethics Statement The Executive Management of [aviation organization’s name] recognizes that an effective Safety Management System (SMS) is vital to the success and longevity of the company. Therefore, the Executive Management is committed to maintaining a fully functional SMS and to the continuous improvement of safety throughout [aviation organization’s name]. This Safety Policy and Code of Ethics Statement applies to all employees in [aviation organization’s name] from the organization’s executive officers to line employees. [Aviation organization’s name] believes the highest priority of our organization is ensuring the safety of our employees and customers. Every effort has been given to ensure this is always first and foremost in everything we do. The Executive Management of [aviation organization’s name] has established specific safety-related objectives and periodically publishes and distributes to all employees those objectives and plans. Specific objectives are located in the [state location of objectives] for regular employee review. These safety objectives are monitored, measured, and tracked to ensure overall corporate safety objectives are met. All employees and individuals in the company have the responsibility to perform their duties and activities in the safest practical manner. [Aviation organization’s name] Accountable Executive is committed to providing the necessary financial, personnel, and other resources to maintain a fully functional SMS. [Aviation organization’s name] Executive Management recognizes that open communication is critical to our success and is dedicated to maintaining a confidential employee reporting system for reporting all hazards, accidents, incidents, and safety issues without fear of reprisal. [Aviation organization’s name] encourages all employees to provide suggestions on how to improve processes and procedures as well as how to reduce workplace hazards they encounter during the course of their duties. Specific reporting procedures are located in the [state location of procedures]. Activities involving intentional disregard for FAA regulations and company policies and procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary action. [State location of unacceptable behaviors and disciplinary actions]. As a component of the SMS, [aviation organization’s name] Executive Management is committed to maintaining and periodically exercising an emergency response plan that provides for the safe transition from normal to emergency operations. [State location of emergency response plan]. [Aviation organization’s name] Executive Management will convey this expectation to all employees through postings, the intranet site, the company newsletter, and any other means to ensure all employees are aware of the company’s SMS, their duties and responsibilities, and our safety policy. This Safety Policy and Code of Ethics Statement will be periodically reviewed by Executive Management to ensure it remains relevant and appropriate to the company. [Signed], Accountable Executive [Additional management personnel optional] ### Page 112 Appendix D D-1 APPENDIX D. GUIDANCE FOR DEVELOPING A COMPLIANCE STATEMENT D.1 Compliance Statement. The purpose of a compliance statement is to ensure aviation organizations adequately address the applicable sections of 14 CFR part 5 during the development and implementation of an SMS. The compliance statement must list all part 5 sections and subsections that apply to the aviation organization’s operation. Next to each part 5 requirement (section and subsection), the applicant/aviation organization must provide a specific reference to a manual or other document, if required, and may provide a brief narrative description that describes how they will comply with each section or subsection. This statement also serves as a master index to the aviation organization’s documentation system to expedite the FAA’s oversight of the SMS. Aviation organizations are encouraged to maintain and routinely update their compliance statement, which is a living document, as changes are made to their SMS. D.2 How to Prepare a Compliance Statement.8 Preparation of the compliance statement benefits the aviation organization by systematically ensuring all applicable regulatory aspects are appropriately addressed during the SMS acceptance and oversight process. It can also serve as a master index to the aviation organization’s system documentation. 8 Refer to AC 120-49, Parts 121 and 135 Certification. D.2.1 To develop a compliance statement: 1. List all applicable sections contained in part 5. 2. Next to each subparagraph, provide a specific reference to a manual or other document where the method of compliance is documented. Aviation organizations not required to maintain a manual system are encouraged to provide a brief narrative description of how compliance with each regulation will be met; however, this description is not required. 3. The location of each reference should be as specific as possible and should contain the name of the manual, chapter, section, and paragraph number(s). Using manual page numbers in a compliance statement may produce inaccurate reference locations due to repagination problems. There may be multiple references for one requirement found within one manual, or there may be multiple reference locations found in several different manuals. It is not acceptable to enter references such as “ABC Airlines will comply with this requirement,” “ABC Airlines understands this regulation and will comply,” or “Noted.” 4. The compliance statement is an important document during certification and the SMS oversight process. After the SMS is determined to be acceptable to the Administrator, the compliance statement should be kept current in the aviation organization/applicant’s system. D.2.2 The following tables are examples of formats that may be used to present the list of specific requirements and subparts, including all subparagraphs. ### Page 113 Appendix D D-2 Table D-1. Sample Compliance Statement for Aviation Organizations That Are Required to Maintain a Manual System Section/ Subsection Text Reference § 5.21(a) (a) Any person required to have an SMS under this part must have a safety policy that includes at least the following: § 5.21(a)(1) (1) The person’s safety objectives. Repair Station Manual (RSM), paragraph 2-37 § 5.21(a)(2) (2) The person’s commitment to fulfill the safety objectives. RSM introductory message § 5.21(a)(3) (3) A clear statement about the provision of the necessary resources for the implementation of the SMS. RSM introductory message § 5.21(a)(4) (4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues. RSM, paragraph 241; Training Manual, Chapter 7 § 5.21(a)(5) (5) A policy that defines unacceptable behavior and conditions for disciplinary action. Human Resources Manual, Chapter 3, paragraph 3-17 § 5.21(a)(6) (6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27. Emergency Response Manual § 5.21(a)(7) (7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority. Employee Handbook and displayed in workplace ### Page 114 Appendix D D-3 Table D-2. Sample Compliance Statement for Aviation Organizations That Are Not Required to Maintain a Manual System Section/ Subsection Text Sample Verbiage § 5.21(a) (a) Any person required to have an SMS under this part must have a safety policy that includes at least the following: § 5.21(a)(1) (1) The person’s safety objectives. Our safety objectives are located in our company compliance statement and are updated annually or as required. § 5.21(a)(2) (2) The person’s commitment to fulfill the safety objectives. We will always operate at the highest levels to ensure the safety of our personnel and passengers. § 5.21(a)(3) (3) A clear statement about the provision of the necessary resources for the implementation of the SMS. We will ensure that resources are provided to ensure aircraft maintenance and pilot training are always maintained and in accordance with current regulations. § 5.21(a)(4) (4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues. We participate in the Community Aviation Safety Action Program (ASAP) and will report hazards and issues through their web portal. § 5.21(a)(5) (5) A policy that defines unacceptable behavior and conditions for disciplinary action. Drug and alcohol abuse are strictly forbidden in this company. Violations of this will result in termination. § 5.21(a)(6) (6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27. We will provide a copy of the flight dispatch log in case of emergency so the route of flight will be known to emergency services. § 5.21(a)(7) (7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority. We have our code of ethics statement posted in the workplace. ### Page 115 Appendix E E-1 APPENDIX E. IDENTIFYING THE ACCOUNTABLE EXECUTIVE E.1 To assist aviation organizations with selection of the accountable executive, Figure E-1, Accountable Executive Decision Process, and Figure E-2, Verifying the Accountable Executive, provide flowcharts with a series of questions. Figure E-1 identifies different organizational structures and how those structures may determine the accountable executive. These flowcharts cannot address all possible organizational structures. Any questions concerning the selection of the accountable executive should be addressed to the responsible Flight Standards office. E.2 O nce the accountable executive is identified (see Figure E -1), the questions in Figure E-2 will assist in verifying that the individual in the selected position is the correct choice. All questions must receive a “yes” answer as they are validating the requirements of 14 CFR part 5, § 5.25(a). Should any of the quest ions result in a “no” answer, the selection process should be initiated again with the new candidate. ### Page 116 Appendix E E-2 Figure E-1. Accountable Executive Decision Process ### Page 117 Appendix E E-3 Figure E-2. Verifying the Accountable Executive ### Page 118 Appendix F F-1 APPENDIX F. SAFETY ATTRIBUTES F.1 Safety Attributes. Safety attributes represent the core characteristics of any system that should be integrated into all processes and procedures. All aviation organizations use technical processes and procedures to provide their aviation product or service. However, some FAA regulations do not require certain operations to have manuals or documentation defining how they will operate. Even a “single-individual shop” follows an assortment of processes that may be undocumented to ensure the continued viability of the business. The extent to which the processes and procedures are described in writing is not as important as how effective they are in practice. As the complexity of an operation increases, the need for written procedures increases to ensure clear communication of organizational policies and priorities as well as a consistent and fair application of rules. Aviation organizations communicate these processes to their personnel in various ways (e.g., training curricula, employee briefings, new-hire discussions, etc.). Required records are generated using these organizationally developed processes. Processes scale the regulations to the scope and complexity of the operation. Processes also provide the balance between the economic and safety objectives of the organization. F.1.1 For aviation organizations with an SMS, it is easy to assign specific “SMS requirements” to the related process attributes. That can be done because SMS required activities are just extensions of certain safety attributes. Therefore, by understanding the safety attributes, there will be a better understanding of SMS concepts. It is important to note these are safety attributes, and they will not fully evaluate an SMS. F.1.2 Effective processes and procedures include provisions for the systematic identification, evaluation, and prevention or control of specific job hazards and potential hazards that may arise from foreseeable conditions. F.1.3 Although compliance with FAA regulations is an important objective, effective processes and procedures look beyond the requirements of the regulations to address all hazards. Aviation organizations should seek to prevent aviation-related injuries and illnesses whether or not compliance is at issue. F.1.4 The key to compliance with FAA regulations lies in the reliability of the aviation organization’s processes. F.1.5 One way to determine the effectiveness of an aviation organization’s processes is by looking for attributes that are embedded within good processes and procedures. Once the attributes are understood, these questions are relatively easy to apply. These common questions apply to those organizations that have an SMS as well as to aviation organizations that do not have an SMS. F.1.6 Every process includes certain characteristics that support ongoing reliability over time. That means every procedure and the associated processes should have these characteristics integrated into the process design and be updated when processes begin to fail due to changes in the organization’s operational environment. ### Page 119 Appendix F F-2 F.2 Safety Attribute Application. The following is a discussion of the safety attributes. There are seven safety attributes, and this discussion will start with those that are directly associated with the aviation organization’s employee groups. These are referred to as personnel-related attributes. They consist of responsibility, authority, and safety ownership. There are four safety attributes that are related to the technical processes. These are referred to as process-related attributes. These consist of controls, procedures, interfaces, and process measurement. F.2.1 These attributes can be further broken down into four categories based on their characteristics. These are: 1. Employee roles and responsibilities. These are responsibility, authority, and safety ownership. They are the same as the personnel-related attributes. 2. The design and application of system processes. These are controls and procedures attributes. 3. Internal and external supplier impacts on the system. This addresses the interfaces attribute. 4. System performance and monitoring. This is where the process measurement attribute is addressed. F.2.2 By organizing the safety attributes by their characteristics, this may improve understanding of how the foundations of system safety rely on both human and technical process areas to improve safety in all processes and procedures. F.3 Responsibility Attribute. The responsibility attribute is defined as “A clearly identified individual who is accountable for ensuring financial and human resources to ensure the safety and quality performance of the certificate holder.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) This attribute looks for “resource availability” that executive management allocates to support the aviation product or service. This could be adequate personnel and budgeting for facilities, parts, tooling, and any other resources required to ensure the success of the aviation organization. In aviation organizations with an SMS, this attribute is focused on the accountable executive and how they are ensuring the overall operational success of the aviation organization. In a non-SMS aviation organization, the responsibility attribute would be looking at the president, Chief Executive Officer (CEO), or owner or the individual ultimately responsible for the safe operations of the aviation activity. F.3.1 In larger organizations, executive management o r business-tier managers are typically not technical process managers. Executive management (e.g., CEOs, Chief Financial Officers (CFO), Board of Directors (BOD), etc.) control the financial resources of the organization. The FAA’s position is that technical managers cannot maintain reliable technical processes unless executive management provides the human and financial support to do so. Once sufficient resources are distributed to the technical managers, they must appropriately apply those resources in a manner that supports the safety objectives of the aviation organization. In a less complex organization, the same individual could “wear multiple hats.” In these organizations, it is important to only look at the attribute ### Page 120 Appendix F F-3 being evaluated and only consider the position being evaluated. As the individual’s active duties change, the attribute being evaluated will also change. This is very common in a single-individual organization. F.4 Authority Attribute. As mentioned above, the authority attribute seeks to determine if technical-level managers are managing process risk. The authority attribute is defined as “A clearly identifiable, qualified, and knowledgeable individual who effectively plans, directs, and controls resources; changes procedures; and makes key determinations including safety risk acceptance decisions.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) F.4.1 Technical-level management constitutes required regulatory personnel, managers, and all assigned process owners (e.g., lead engineer, fleet coordinator, or other authoritative positions without a manager title on the organizational chart) who “manage” specific technical functions. The description of these positions has been simplified by referring to them as “process owners.” Process owners speak with authority on behalf of the aviation organization in their process areas and may set additional workforce expectations not documented in FAA-approved or FAA-accepted manuals. F.4.2 Process owners are responsible for properly utilizing resources provided to them, for accepting risk within their process area, and for changing processes or procedures as operations change. F.5 Safety Ownership Attribute. This process characteristic is considered a key indicator of safety performance as it relates to an employee’s understanding of their contribution to the aviation organization’s safety goals and objectives. The safety ownership attribute helps determine whether an aviation organization is proactively ensuring employees understand how their day-to-day work activities support safety objectives in the workplace. F.5.1 The safety ownership attribute is defined as “An individual’s understanding of how their role contributes to the overall safety of the organization.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) Over time, data collected concerning this attribute may aid in determining the safety culture of an organization. A declining safety culture could be considered an indicator of risk. F.5.2 Safety in the workplace includes everyone, whether a direct hire employee or contract aviation organization that supports the aviation product or service. F.5.3 Safety ownership provides some insight as to the aviation organization’s proactive pursuit of a positive safety culture. It is well known that organizational culture directly affects the organization’s outcomes. The presumption is that employees who can explain or demonstrate their role in supporting safety initiatives in their daily work activities actually do participate in those safety efforts. Those employees who cannot explain their job-related safety contributions may not be participating to the extent they could be. For an aviation organization to leverage the eyes and ears of all its employees in identifying hazards and disposing safety concerns, action should be taken to solicit and encourage ### Page 121 Appendix F F-4 that support. Employee training events, supervisor reinforcement of safety objectives at regular meetings, safety discussions during employee performance evaluations, safety policy documentation in employee manuals, safety articles in organization newsletters, and providing positive feedback to employees who participate in hazard identification and reporting are a few ways that can be used to meet safety goals and objectives. F.6 Controls Attribute. The controls attribute aids in determining if integrated controls are mitigating systemic risks as intended by the process design. Subactivities are those individual processes that could stand alone but are connected together to make a larger procedure. The controls attribute is defined as “The checks and restraints that exist within a process that ensure the potential effects of risks are reduced to an acceptable level.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) In short, the entire procedure and its subordinate process steps constitute a “procedural control” that employees are expected to follow. It is not necessary to try to distinguish between controls and noncontrols when referencing an entire process/procedure. However, when process gaps are identified or certain activities in the procedures fail to mitigate unacceptable risk, then those segments of the procedure are referred to as “failed risk controls.” Once new or revised risk control segments are integrated in the procedure, we cease to call those activities “controls” and just refer to the string of procedural activities as the “procedure.” F.6.1 To address the controls attribute, aviation organizations must determine if the process or procedure is meeting its intended outputs with its current set of controls. Over time, changes occur in the operational environment that can degrade the performance of any process. Previously effective controls may no longer function properly in the changed operational environment. Therefore, it is important to monitor system processes to detect negative trends in operational performance. F.7 Procedures Attribute. The procedures attribute is used to evaluate whether an aviation organization is maintaining regulatory compliance and employees are following approved processes and procedures. The procedures attribute is defined as “Methods or practices that are written or unwritten, regulatory or nonregulatory, designed into a process that a certificate holder/applicant uses to accomplish a desired result.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) F.7.1 “Following approved processes and procedures” also means that employees are meeting management expectations when documentation is not available. During certification, an applicant is required to develop process designs that meet regulatory requirements. This is true for all aviation organizations whether they are a single-pilot air tour operator, a large air carrier, or a repair station. F.8 Interfaces Attribute. The interfaces attribute looks at how effective the interdependent processes and process owner “handoffs” to other process owners are. This also includes interfaces between aviation organizations. The interfaces attribute is defined as “Interactions between processes that must be managed in order to ensure desired outcomes.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) Another way to think about the interfaces attribute is “How well do various processes and procedures communicate with each other?” The same can be evaluated with the process owners and ### Page 122 Appendix F F-5 other employees in an organization. Interface failures are target-rich environments. It is easy to think of process interfaces in terms of linear handoffs between process owners. An example of a linear handoff would be the flight crew notifies maintenance control of an aircraft write-up. Maintenance control notifies dispatch of a maintenance delay. Dispatch notifies the gate agent and crew scheduling, etc. The linear handoffs continue until the flight is finally dispatched. There may be perpendicular interfaces as well. These are typically training requirements, documentation procedures, and recordkeeping activities that are ancillary to the linear interfaces. F.9 Process Measurement Attribute. The process measurement attribute assesses the “monitoring activities” each aviation organization and process owner uses to determine ongoing operational performance. The process measurement attribute is defined as “A method to monitor and measure the outputs and performance of a process, and to identify problems, or potential problems, in order to take corrective action.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) Often, we mistakenly only think of auditing programs when assessing this attribute. However, understanding what constitutes the activity called “audit” actually broadens our perspective on performance measurement. Generally speaking, an audit is gathering data and reviewing that data to determine whether intended performance expectations are being met. Most large or complex operations use formal auditing programs (e.g., audit schedules, qualified auditors, checklists, formal reports, etc.) as part of their performance monitoring. F.9.1 There are many types of data collection activities that occur throughout an organization. For example, a fleet manager might routinely review documentation of flight crew training and checking failures documented by instructors or pilot examiners. This data review allows the fleet manager the opportunity to evaluate the effectiveness of the training and to check the processes related to determining pilot competency. A maintenance shift manager might review Required Inspection Item (RII) documentation at the end of a shift to determine that qualified personnel accomplished all required verification checks/signoffs before returning the aircraft to service. This activity confirms process performance of the RII process. These examples fit the definition of an audit without all the bells and whistles. F.9.2 As performance reporting is elevated to higher management levels, the data becomes more broad-based and more refined. For example, a maintenance department manager may not be interested in the outcome of RII shift reviews, but they may be interested in the on-time, return-to-service performance that the RII checks support. By the time the performance reporting reaches the CEO, the reports may be refined to something that represents meeting or not meeting a financial target associated with scheduled maintenance. For example, a CEO might want to know whether the organization met its cost targets for on-time performance for heavy maintenance. The CEO performance report is dependent on subordinate process monitoring and performance management by assigned process owners. When high-level performance targets have not been met, the organization will begin to backtrack and review the data that was collected by subordinate levels of management to determine root cause. In this light, process measurement is critical to Root Cause Analysis (RCA) and corrective action. ### Page 123 Appendix F F-6 F.9.3 Technical managers and process owners are expected to know how data is used to monitor process performance under their purview. Table F-1. Safety Attributes and Part 5 Reference Attribute Definition Part 5 Responsibility A clearly identified individual who is accountable for ensuring financial and human resources to ensure the safety and quality performance of the certificate holder. Title 14 CFR part 5, §§ 5.23(a) and 5.25(a), (b), and (c). Authority A clearly identifiable, qualified, and knowledgeable individual who effectively plans, directs, and controls resources; changes procedures; and makes key determinations including safety risk acceptance decisions. Section 5.23(b). Safety Ownership An individual’s understanding of how their role contributes to the overall safety of the organization. Sections 5.23, 5.71, 5.91, and 5.93. Controls The checks and restraints that exist within a process that ensure the potential effects of risks are reduced to an acceptable level. Sections 5.51, 5.53, and 5.55. Procedures Methods or practices that are written or unwritten, regulatory or nonregulatory, designed into a process that a certificate holder/applicant uses to accomplish a desired result. Technical process standards through applicable specific regulatory requirements, ACs, and FAA Order 8900.1 guidance. While part 5 requires procedures relevant to the SMS be documented under § 5.97, this is not considered a procedure for the purposes of this attribute. Interfaces Interactions between processes that must be managed in order to ensure desired outcomes. Sections 5.57 and 5.71(a)(8). Process Measurement A method to monitor and measure the outputs and performance of a process, and to identify problems, or potential problems, in order to take corrective action. Sections 5.71, 5.73, and 5.75. ### Page 124 Appendix F F-7 F.10 Summary. Since FAA regulations define required mitigation actions for aviation organizations, each aviation organization is obligated to determine what processes will effectively maintain regulatory compliance for the size and scope of their operations. Once aviation organizations determine what processes they will use and the FAA validates technical process effectiveness during certification, the aviation organization is obligated to maintain the reliability of its processes in an ever-changing operational environment. This concept stands regardless of whether a formal SMS exists or not. F.10.1 As stated, leveraging the safety attributes is relatively easy. Once understood, they can be applied to any process. Simply put, the attribute questions can be evaluated as follows: 1. Responsibility attribute: Are there enough resources available to support the aviation service? 2. Authority attribute: Are process owners effectively managing process risk? 3. Safety ownership attribute: Do employees understand how their day-to-day work activities support safety objectives? 4. Procedures attribute: Are adequate procedures provided to all personnel to follow in performing their duties to meet management expectations in the performance of their work? 5. Controls attribute: Are the technical processes reliable (meeting expected outcomes) if personnel execute them as designed? 6. Interfaces attribute: Are the process handoffs and operational support between organizational groups reliable? 7. Process measurement attribute: Are process owners collecting and reviewing data to monitor process performance and make improvements? F.10.2 If the answer is “no” to any of the above process characteristics, this could be an indicator of increased risk and potential regulatory noncompliance that could result in an incident or accident. Leveraging safety attribute characteristics and their associated SMS requirements (when applicable) can improve an aviation organization’s ability to better manage risk in their operations. Note: While incorporation of safety attributes are the core characteristics of a good management system, a lack of any or all the attributes does not mean a technical process may not meet the regulatory requirements in that area. F.10.3 As discussed in this appendix, safety attributes represent the core characteristics of any system that should be integrated into all processes and procedures. This does not mean that each attribute should be specifically addressed when developing operational procedures, but rather the characteristics of the attributes should be identifiable. The attribute applications apply to both aviation organizations with a formal SMS and those without an SMS. All aviation organizations have a management philosophy that guides their operations. That philosophy and related activities can be referred to as a “management system.” Aviation organizations have to determine what processes will be implemented to deliver their aviation product or service. Those processes are referred to ### Page 125 Appendix F F-8 as “technical processes.” As previously mentioned, it is crucial that an aviation organization’s processes, both managerial and technical, are capable of meeting the organization’s safety objectives. ### Page 126 Appendix G G-1 APPENDIX G. SMALL OPERATOR IMPLEMENTATION G.1 General. This appendix provides potential methods smaller aviation organizations could use to meet the pertinent SMS requirements and how they can be scaled to the size and complexity of their organization. The Safety Management International Collaboration Group (SM ICG) SMS for Small Organizations9 document defines a small organization as one with between 5 and 20 staff and a very small organization as one with less than 5 staff. The FAA does not define these organizations because an SMS is designed to be adaptable based on the size and complexity of the organization. So, it is possible for an organization to be very small but highly complex and a large organization to be low complexity based on the aviation activity they are involved with. 9 SM ICG guidance documents can be downloaded from https://skybrary.aero/enhancing-safet y/sm-icg-safetymanagement-produ cts. G.1.1 A one -size-fits-all approach to scaling the aviation organization’s response to each section of 14 CFR part 5 is not advisable. Recognizing aviation organizations have different operational environments and different levels of resources needs to be acknowledged when developing and implementing an SMS. Less complex organizations could use simple methods for conducting the processes within the SMS. More complex organizations may require more detailed processes within the SMS. G.1.2 For organizations that have only a single pilot or technician and perhaps minimal support staff to carry out daily responsibilities, this appendix suggests utilizing a commonsense approach to SMS implementation and maintenance. In the case of a single-pilot operator, that single pilot could be the one to develop, implement, and use the SMS process. At medium and large organizations, the complexity and departmentalization of duties may require that more personnel be involved in the SMS. Regardless of the organization’s size, many aviation organizations will find their existing processes and procedures can serve as the foundation for portions of their SMS. Integration of these existing processes should be used as much as practical. Note: Implementation strategy discussions are for illustration only and neither impose requirements nor mandate specific resource allocation by an aviation organization. Aviation organizations should integrate methods and procedures that best fit their organizational structure and that leverage processes and procedures already in place to the greatest extent possible. For additional guidance, see Chapter 3, Safety Management System (SMS) Components Explained. G.2 Table G-1, Small Aviation Organization Implementatio n Strategies and Considerations. The table below describes ways in which the requirements could be met by small aviation organizations. ### Page 127 Appendix G G-2 Table G-1. Small Aviation Organization Implementation Strategies and Considerations Section Implementation Strategies Considerations for Small and Single Individual Organizations Subpart B – Safety Policy. § 5.21, Safety policy. The safety policy and code of ethics statement requirements are not expected to vary between aviation organizations; however, the processes and procedures described in part 5, § 5.95 SMS documentation and how they are documented could vary due to the complexity of the processes being described. The safety policy and code of ethics statement could be a part of the organization’s safety manual or included in other existing documentation or manuals. For aviation organizations not required to maintain manuals, it could be integrated into a compliance statement discussing how the organization meets the requirements. Under part 5, the safety policy and SMS processes and procedures only need to be documented. A single-individual organization is not required to have a process to communicate safety information throughout the aviation organization. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: §§ 5.21(a)(4), (a)(5), and (c). § 5.23, Safety accountability and authority. Aviation organizations are required to define the duties and responsibilities of the accountable executive. The accountable executive has the ultimate responsibility for safety management within the organization. In single-individual organizations, the personnel structure will be very simple and consist of the person in charge being the accountable executive, who is responsible for ensuring all required duties and activities are accomplished. In a small organization, other management personnel should be identified since they would have a role in how the organization is managed on a day-to-day basis. In single-individual organizations, this structure will be very simple and consist of the sole individual being the accountable executive and assuming the various roles and responsibilities, which would normally be assigned to other members of management. The single individual would also be responsible for accepting all risks associated with the aviation organization’s products or services. As their organizational duties change, which could happen many times during the day, the single individual could be said to be changing hats as their role changes as they manage the activities required in § 5.23. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: §§ 5.23(a)(2), (a)(3), and (b). § 5.25(a) and (b), Designation and responsibilities of required safety The accountable executive is responsible for ensuring that sufficient management personnel are clearly designated for ensuring the safety of operational and SMS processes. In a single-individual operation, these duties would be filled by the accountable executive. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary ### Page 128 Appendix G G-3 Section Implementation Strategies Considerations for Small and Single Individual Organizations management personnel. Accountable executive. In smaller organizations, the accountable executive may directly supervise operational processes. This individual may serve in multiple positions within the organization. Small organizations may not have the resources for a designated representative to monitor the effectiveness of the SMS as a full-time position. A small organization may add the safety manager duties to an existing role (e.g., operations manager). functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.25(b)(3). § 5.25(c), Designation of management personnel. These responsibilities may be carried by the accountable executive as defined in § 5.23(a)(1) or as collateral duties by managers referred to in § 5.23(a)(2), or the aviation organization could assign the tasks of supporting SMS functions to other management personnel. In a single-pilot organization, the accountable executive would perform these designated duties as part of their duties under § 5.25. Effective communication of safety information is still important, even in a single-pilot or single-individual organization. Communication would be focused outside of the organization (i.e., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.25(c). § 5.27, Coordination of emergency response planning. A small, noncomplex organization’s emergency response plan (ERP) might consist of a checklist of simple steps involving who to call when and what information to impart and a regularly updated list of contact details. When considering the ERP, succession planning should be considered. If a member of management is removed from their position to address an emergency, there should be another individual trained and competent to step into the position to ensure the organization continues to function as designed. This could even take place when the individual is away for other reasons. Common sense must prevail; processes need to be workable and tailored for the operation. In other words, do not over think it! Effective communication of safety information is important, even in a single-pilot organization. In an organization with a single pilot or single individual, the communication focus may be outside the organization (e.g., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Interfacing with maintenance, fixed-based operators, and flight followers (if one is used) all require communication so they are aware of the aviation organization’s activities. This will aid in scheduling support activities as well as having someone keep an eye out in case plans do not go as predicted. In a single-pilot or single-individual organization, this could be met by simply filing flight plans with air traffic control (ATC) or leaving an ### Page 129 Appendix G G-4 Section Implementation Strategies Considerations for Small and Single Individual Organizations envelope with emergency contact information at the local Fixed-Base Operator (FBO) if the aircraft does not return on time. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.27(a) and (b). Subpart C – Safety Risk Management. § 5.51, Applicability. Aviation organizations must document (where required) when the Safety Risk Management (SRM) processes are to be implemented based on the requirements in § 5.51. In small or single-pilot, sole-individual organizations, all of the risk management tasks could be accomplished by the accountable executive. § 5.53(a) and (b), System analysis and hazard identification. The system analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers, such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them. SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where the aviation organization will tailor the processes to their size, complexity, and operating environment. Aviation organizations should consider how their service providers and contractors interact with the organization. Identify the areas where risk could be introduced into the operations. Outputs of the system analysis, which define the function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, and the personnel, equipment, and facilities necessary for the operation of the system, should be retained. Appendix B, Sample Safety Risk Management (SRM) Worksheets, provides an example of a set of SRM worksheets that could be used as paper records or converted to a variety of software applications, including In small or single-pilot, sole-individual organizations, all of the risk management tasks could be accomplished by the accountable executive. In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be a risk specialist because they will most likely know the risks in the organization already. Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. In a small organization, the question “how does the organization identify safety issues from occurrence or incident reports?” should be asked. These organizations could record the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider (e.g., WBAT). ### Page 130 Appendix G G-5 Section Implementation Strategies Considerations for Small and Single Individual Organizations desktop spreadsheets or the Web-Based Application Tool (WBAT) (see Appendix H, References and Additional Information). § 5.53(c), System analysis and hazard identification. While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management may vary based on the size and complexity of the organization. For example, it may be accomplished by using worksheets completed manually, computer spreadsheets, or commercial software. The output of hazard identification could be recorded in a simple recording medium, such as a spreadsheet, paper files, or a third-party software program or provider (e.g., WBAT). Hazard identification could be performed by the owner/manager (accountable executive) and/or another employee(s), often as part of the system analysis. In small or single-pilot, sole-individual organizations, all of the risk management tasks could be accomplished by the accountable executive. In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be a risk specialist because they will most likely know the risks in the organization already. Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. In a small organization, the question “how does the organization identify safety issues from occurrence or incident reports?” should be asked. § 5.55(a), Safety risk assessment and control. In smaller or lower complexity aviation organizations, risk analysis could be performed by the owner/manager (accountable executive) and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk assessment, and risk control. In small or single-pilot, sole-individual organizations, all of the risk management tasks could be accomplished by the accountable executive. In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be a risk specialist because they will most likely know the risks in the organization already. Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. In a small organization, the question “how does the organization identify safety issues from occurrence or incident reports?” should be asked. ### Page 131 Appendix G G-6 Section Implementation Strategies Considerations for Small and Single Individual Organizations § 5.55(b), Safety risk assessment and control. In a small or lower complexity aviation organization, risk assessments could be performed by the owner/manager (accountable executive) and/or other employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. While similar to a Flight Risk Assessment Tool (FRAT), the risk assessment required by § 5.55 is to determine if the residual and associated risks to the process are acceptable. Quite often, a risk matrix is utilized to determine if any residual risk or substitute risk are acceptable to the aviation organization. A FRAT would be used to determine if conditions are acceptable for a specific flight to commence. It is important not to confuse the purpose of these two distinctly different tools and their application. The outputs of this process could be recorded on paper or via an electronic medium, such as a third-party software program or provider (e.g., WBAT). In small or single-pilot, sole-individual organizations, all of the risk management tasks could be accomplished by the accountable executive. In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be a risk specialist because they will most likely know the risks in the organization already. Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. In a small organization, the question “how does the organization identify safety issues from occurrence or incident reports?” should be asked. § 5.55(c) and (d), Safety risk assessment and control. In aviation organizations with a lower complexity or size, the risk control process could be a documented activity performed by the owner/manager (accountable executive) and/or other employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk analysis, and risk assessment. While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management will vary based on the size and complexity of the organization. Small organizations should consider how their service providers and contractors interact with the organization. In a small organization, the question “where are areas that risk could be introduced into the operations?” should be asked. In very small organizations, individuals across the organization should be aware of the organization’s biggest risks and what actions are in place to mitigate them. SRM for single-individual organizations does not need to be overly complex. In a single-person organization, the question “are you looking for and documenting hazards?” should be asked. ### Page 132 Appendix G G-7 Section Implementation Strategies Considerations for Small and Single Individual Organizations For any of these organizations, tracking or storing SRM outputs could be accomplished by using worksheets that are completed manually, computer spreadsheets, or commercial software, such as WBAT. § 5.57, Notification of hazards to interfacing persons. Aviation organizations must provide hazard notifications to interfacing organizations that, to the best of their knowledge, could address a hazard or mitigate the hazard’s risk (§ 5.57). This requirement is limited to hazard notifications to those interfacing organizations that contribute to the safety of the products or services you provide. Note: Per § 5.3, a ha zard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards, and the report should only be provided to the interfacing organization you believe can best address the hazard or mitigate its risk. Section 5.57 does not require the reporting of concerns that are not hazards (e.g., commercial issues between companies) as the intent of § 5.57 is to facilitate timely sharing of safety information. A small organization could communicate identified hazards to another organization via email, telephone call, or other means as appropriate. Subpart D – Safety Assurance. § 5.71(a)(1), Safety performance monitoring and measurement. Monitoring o perational processes. Some aviation organizations might utilize the line managers and departmental or key management personnel to observe and review day-to-day activity, noting work task inconsistencies and potential safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit (LOSA) programs may also be sources of information to monitor operations. In small or lower complexity organizations, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel (e.g., accountable executive) who are directly involved in the day-to-day operations. For example, regularly reviewing (e.g., weekly, monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of monitoring and could be conducted during the normal course of duties. § 5.71(a)(2), Safety performance monitoring and measurement. Processes used will vary based on the size and complexity of the organization and the aviation service the organization provides or supports. Monitoring of the operational environment involves practices that are similar to those of monitoring operational processes. For example, seasonal weather conditions may Small or single-individual organizations might keep a log tracking operational issues or deviations from existing processes and procedures. This information could be used to detect changes in the operating environment. Information sharing with other organizations could also provide input to changing operational environments. ### Page 133 Appendix G G-8 Section Implementation Strategies Considerations for Small and Single Individual Organizations Monitoring operational environment. require aviation organizations to change their scheduling, routes, and aircraft utilization. § 5.71(a)(3), Safety performance monitoring and measurement. Auditing operational processes and systems. Organizations should develop procedures for auditing that describe the audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits. The results of audits can be recorded in paper format (e.g., a common logbook-style binder) or in electronic media (e.g., a desktop spreadsheet program or a program such as WBAT). In smaller or lower complexity aviation organizations, the auditing process could be carried out periodically by the accountable executive/owner, key management person, or a trained employee as a collateral duty. Audits may also be carried out as a subfunction of normal business processes. For example, comparisons of deferred maintenance logs and repair part receipts are a form of safety auditing that are probably already accomplished routinely. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures. § 5.71(a)(4), Safety performance monitoring and measurement. Evaluations of the SMS and operational processes and systems. In a small organization, the evaluation process could be carried out periodically by the accountable executive/owner. In larger organizations, evaluations could be performed by a key management person or designated employees as a collateral duty. The process could be accomplished by the Director of Safety (DOS) or the safety department on a monthly, quarterly, or other periodic basis, as determined by the information needs of the accountable executive or other senior management decisionmakers. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures. ### Page 134 Appendix G G-9 Section Implementation Strategies Considerations for Small and Single Individual Organizations § 5.71(a)(5), Safety performance monitoring and measurement. Investigations of i ncidents and accidents. Aviation organizations need to define the types of incidents and accidents that require investigations. Part 5 only requires incidents and accidents that directly affect the aviation product or service be investigated. Processes used will vary based on the size and complexity of the organization and aviation service the organization provides or supports. Investigations should focus on what went wrong rather than who caused the error and emphasize improvement of safety performance. In smaller or less complex aviation organizations, investigations can be conducted by the accountable executive or assigned employees. Investigations can be conducted by a safety department with additional assigned line personnel providing technical expertise. Investigation is a necessary activity within any SMS, regardless of the organization’s size. If, as a single-individual organization, you do not have a process to conduct investigations, consider using industry resources outside of your organization or contracting services from a third-party provider. As a one-person organization, you know exactly how it operates. With a sound documented process to conduct an investigation, you should be able to come up with relevant conclusions as long as you remain objective. § 5.71(a)(6), Safety performance monitoring and measurement. Investigations of reports of potential non-compliances. An SMS does not relieve aviation organizations from other regulatory requirements. This also includes documented processes and procedures that may be contained in maintenance manuals or Aircraft Flight Manuals (AFM) or those that are organization specific. Methods of conducting investigations of potential noncompliance could be accomplished in a manner similar to that for investigations of accidents and incidents. § 5.71(a)(7), Safety performance monitoring and measurement. Confidential e mployee reporting system. An employee reporting system need not be highly sophisticated to be effective. The employees might report a hazard either orally or in a note or email to their supervisor. Several industry groups provide an employee reporting program for small aviation organizations and provide management and de-identification of information. They also provide access to other de-identified reports so identified hazards can be integrated into the participating aviation organization’s SMS. Aviation organizations on the higher end of the size or complexity spectrum may have an existing online employee reporting system or Aviation Safety Action Programs (ASAP) for some employee groups. In small organizations, data collection for the reporting system can take many forms, from a simple suggestion box to organizational websites or intranets or a dedicated email address. Data management can be accomplished with a common desktop spreadsheet, database software, or specialized software, such as WBAT. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.71(a)(7). ### Page 135 Appendix G G-10 Section Implementation Strategies Considerations for Small and Single Individual Organizations § 5.71(a)(8), Safety performance monitoring and measurement. Investigations of hazard notifications. Documentation and retention of these notifications can be in a spreadsheet, notebook, or other means that would ensure the hazard is appropriately addressed. Single-individual organizations should have a process for documenting and managing hazards shared from other organizations transmitted to them in the course of operations. Methods of conducting investigations of hazard notification could be accomplished in a manner similar to that for investigations of accidents and incidents. § 5.71(b), Safety performance monitoring and measurement. Data analysis. The outputs from data analysis could be recorded in a simple recording medium (e.g., a notebook, paper files, a common desktop software, specialized systems, or a third-party software, such as WBAT). In a small aviation organization, data acquisition may consist of making notes about how things did not go as planned, how communications were compromised at low altitude in certain flight route segments, etc. This data could be reviewed on a regular basis (perhaps monthly or quarterly). Hazards could be analyzed using SRM, and mitigating actions could be recorded as changes to procedures, minimum performance requirements, etc. are identified. In a single-individual organization, the accountable executive will perform this function. In a small organization, this could be accomplished by another member of management. § 5.73, Safety performance assessment. The results of assessments can be recorded in a paper or electronic medium (e.g., in a common logbook-style binder, electronic file folder, common desktop software, specialized system, or third-party software program, such as WBAT). In a small or lower complexity aviation organization, safety performance and assessment could be a documented activity performed by the accountable executive or a coordinated activity between the accountable executive and other operational managers, supported and coordinated by the DOS if the organization has this position. Risk acceptance would also normally fall to managers within this group. In small organizations, the reactive data gathered may not be statistically significant due to small sample sizes. This can be managed by looking beyond the data within your own organization. Where available, the organization could include data from industry organizations and associations, related industries, regulatory bodies, and safety boards. For single-individual organizations, an internal review (a self-assessment) may be as effective as a formal audit. Networking ### Page 136 Appendix G G-11 Section Implementation Strategies Considerations for Small and Single Individual Organizations with other similar organizations and sharing safety information may provide insights into vulnerabilities that may exist in the organization’s processes and procedures. § 5.75, Continuous improvement. Continuous improvement decision making is an output of the Safety Performance Assessment (SPA) process. Therefore, corrective actions discussed during the assessment apply to continuous improvement activities. The managers, committees, or working groups that make assessment decisions for the aviation organization would also determine the appropriate corrective actions based on the situation. There would be no difference in how this section is addressed by any aviation organization based on size, complexity, or scope of operations. Subpart E – Safety Promotion. § 5.91, Competencies and training. Aviation organizations may choose to either train their employees in house or contract the training to outside vendors. Whichever option is taken, the training must be specific to the SMS and aviation activities conducted. Training can be in person or virtual based on organizational needs. Training should be modular so only the material pertinent to the position within the organization is presented. A small or low-complexity organization with only a few employees would likely complete online training to meet this requirement. Aviation organizations on the higher end of the size or complexity spectrum could have a training department that develops and conducts the training. The knowledge and experience gained by a single individual developing the organization’s SMS is likely sufficient to meet training requirements for the organization. In a small organization, consider whether the safety manager or the individual assigned the associated duties (if there is one in a small organization) has received SMS training. § 5.93, Safety communication. In smaller or lower complexity aviation organizations, communicating safety considerations to employees may be simple and direct. For example, the accountable executive could conduct regular all-hands/employee meetings, such as “hangar talk sessions.” Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams. Aviation organizations with only a few employees could utilize a required reading list consisting of material from industry or other sources. The selected material would be applicable to the Small organizations should consider the methods they will utilize when sharing information with other aviation service providers they interface with. Methods used can be as simple or as complex as the organization chooses, but they should be consistent. Maintaining a “Journey Log” or “Unusual Occurrences” log may be useful for regular review and reinforcement of safety concerns identified when performing the aviation service. This will facilitate entering the occurrences into the safety assurance component (§ 5.71) for tracking and resolution. ### Page 137 Appendix G G-12 Section Implementation Strategies Considerations for Small and Single Individual Organizations operations conducted. Documentation of what was reviewed would meet the requirements of § 5.97(d). Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.93. Subpart F – SMS Documentation and Recordkeeping. § 5.95, SMS documentation. Smaller organizations might use a compliance statement or spreadsheet listing the part 5 requirements and how the organization meets the requirements. SMS documentation may be maintained either as hard copies or electronically. It may be contained in a General Operations Manual (GOM) or Repair Station Manual (RSM) or any other combination of documentation and manuals that is appropriate for the organization. However, the documentation is maintained, the organization should ensure it remains up to date. In a small or lower complexity aviation organization, the owner/manager (accountable executive) or designee may be responsible for maintaining and distributing current versions of guidance documents. Single-pilot organizations, while not required to maintain a manual system per 14 CFR part 135, § 135.21, are still required to document their SMS safety policy and SMS processes and procedures. Documentation may consist of a set of typewritten documents, spreadsheets, and forms that are kept in file cabinets or binders. They may also use WBAT or other third-party providers. Managers of medium-complexity organizations need the same type of information to make decisions; however, the volume is typically larger than that of a low-complexity organization and smaller than that of a high-complexity organization. § 5.97, SMS records. The process developed for record retention should be appropriate for the aviation organization. As an example, digital photographs of safety-related posters or signs in a maintenance hangar could be retained as a record of the communication. Read-and-initial documents would also provide a record. Hangar talks and flight crew alerts are also types of communications that would be retained. These communications can be retained electronically or in paper format. The method utilized should be appropriate to the size and complexity of the aviation organization. In smaller or lower complexity aviation organizations, the owner/manager (accountable executive) or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, phone and email logs, and completed forms that are kept in file cabinets or binders. Note: The following section does not apply to those organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft: § 5.97(d). ### Page 138 Appendix G G-13 G.3 Sample Scenarios. In the paragraphs below, we will use fictional aviation service provider Flyslow Aviation as an example of how a typical organization could integrate part 5 requirements into their operations and how different safety issues they encounter are addressed. G.3.1 G eneral Applicability Example. G.3.1.1 To meet the requirement to implement an SMS, Flyslow Aviation starts by reviewing their organization to consider the operating environment, personnel needed, any interfaces with other organizations and facilities, and materials needed to provide their aviation service or product. They may identify flight operations, maintenance, dispatch, and training departments as areas that support the aviation product or service. They might also identify external organizations that support the aviation product or service, such as fuel service providers, third-party maintenance, and catering. All this information would be documented in an organizational description that can be used to ensure all aviation-related areas are considered in the SMS development. G.3.1.2 To ensure part 5 is fully integrated into the organization, Flyslow Aviation may develop a compliance statement for their internal tracking to document how they already meet the requirements of part 5. While not required for existing operators, a compliance statement makes identifying existing processes and procedures as well as existing methods and voluntary programs easier to verify when documenting how an organization meets the regulatory requirements. This is accomplished for all departments and areas identified in the organizational description. G.3.2 D esignation of Management Personnel Example. Flyslow Aviation has chosen to use an existing required management individual required under 14 CFR part 119, §§ 119.65 and 119.69 or part 145, §§ 145.151 and 145.153 to fulfill these responsibilities. As Flyslow Aviation grows and expands, they could establish a safety department with designated personnel assigned this requirement. G.3.3 Safety Policy Example. Flyslow Aviation recognizes the key to a successful organization is open communication and strong leadership. They identify the accountable executive and management representatives (§ 5.23) and start working on the safety policy. While developing safety objectives (§ 5.21(a)(1)), management reviewed the organization’s performance indicators as well as reports from previous audits. Management then determined a reduction in uncalibrated tools being issued by the tool room would be an appropriate objective for the coming year. Management communicates the organization’s goal of reducing uncalibrated tool issuance by 20 percent by publishing an updated safety policy (§ 5.21(c) and (d)) and through employee meetings (§ 5.23). Management also develops processes and procedures describing how employees are expected to accomplish their duties and responsibilities under the SMS. ### Page 139 Appendix G G-14 G.3.4 S ystem Analysis Example . Flyslow Aviation is considering the addition of a new aircraft (or a fleet of aircraft) for operations to meet organizational or corporate goals. Several organizational systems would be affected (e.g., flight operations, maintenance, station, ground, etc.). As part of the examination of the flight operations system, Flyslow Aviation needs to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, employee representation participation, and several other areas. This is a process normally done as part of business activities. G.3.4.1 T he system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to the fleet, Flyslow Aviation identifies the pilot training system as one of the affected systems and the need for additional activities and resources necessary for pilot training to operate the additional aircraft. These resources may include simulators, training curriculum, training aids, and instructors. A repair station might be adding a rating or changing from paper to digital manual systems and need to update their revision tracking process and training for employees. G.3.4.2 Although Flyslow Aviation has to consider many systems and procedures when considering larger, systemic changes, simpler changes, such as a change in a single procedure (e.g., arming cabin doors prior to pushback), would only have to consider the elements of the system that would be affected by the change. The system analysis process frequently includes representatives from management, safety staff, subject matter experts (SME), employees, and representation groups (e.g., pilots and mechanics) in workgroups, such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process. G.3.4.3 Flyslow Aviation records the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider. One example is the Web-Based Application Tool (WBAT) (see Appendix H, References and Additional Information). G.3.5 SRM Example. F lyslow Aviation initiates the SRM processes due to an employee report identifying a hazard: an uncalibrated tool issued to a technician. This was in response to a report sent through the safety assurance employee safety reporting system (§ 5.71(a)(7)). G.3.5.1 T he tool room process owner starts by conducting a system analysis (§ 5.53(b)) on the calibrated tool control process by identifying the various interfaces with the procedure. The process owner also looks for areas where a hazard might exist (§ 5.53(c)). Once potential areas where mistakes (hazards) could occur, the process owner conducts a risk assessment (§ 5.55(b)) using Flyslow Aviation’s risk matrix. By identifying the likelihood of uncalibrated tools being issued and the severity of a potential failure where uncalibrated ### Page 140 Appendix G G-15 tools were used, the process owner determines the risk is moderate due to the criticality of the tasks the technicians using the tools are completing. The process owner, remembering their training, uses a risk matrix to determine the potential risk of the uncalibrated tool being used. As risk is a composite of likelihood and severity and since uncalibrated tools have been issued to technicians previously, the process owner considers this a likely occurrence. G.3.5.2 Flyslow Aviation’s management, process owners, and employee representatives work together to develop risk controls (§ 5.55(c)) to prevent future issuance of uncalibrated tools to employees. Brainstorming identifies several methods they can use to enhance existing processes. These include a complete audit and verification of the online tool tracking software to ensure all information is entered correctly. A review of calibrated tool expiration dates will be accomplished at the start of each shift to ensure any tools that may have expired are removed from use. Signs will be designed and posted in the tool room reminding the technicians to double check the calibration dates on tools prior to use, and management will be provided with talking points to use during routine employee meetings to ensure everyone is aware of the need to verify the calibrated tool dates. G.3.5.3 The aviation organization reviews the proposed risk controls and determines the revised procedure is acceptable before implementation (§ 5.55(d)). G.3.6 H azard Notification Example . The following example demonstrates how hazard notification in accordance with § 5.57 should occur for a small operator. This issue is not related to the calibrated tool example described in other paragraphs. G.3.6.1 F lyslow Aviation received an employee report from a pilot stating that the aircraft flight management system (FMS) deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. Flyslow Aviation’s SMS classified this employee report as a hazard because the airport is surrounded by high-elevation terrain. Although this incident occurred during the daytime and in visual meteorological conditions (VMC), management determined that if the same issue occurred during a night landing or instrument meteorological conditions (IMC), the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident. G.3.6.2 Flyslow Aviation followed its hazard notification process and decided that the aircraft manufacturer was the best organization to mitigate the risk (step 1). Flyslow Aviation also decided that the aircraft manufacturer contributed to the safety of the services provided by Flyslow Aviation (step 2). Flyslow Aviation provided the following hazard notification to the aircraft manufacturer (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.” ### Page 141 Appendix G G-16 G.3.6.3 No further action under § 5.57 is required by Flyslow Aviation. The organization has met the § 5.57 hazard notification requirements in this example. G.3.7 S afety Assurance Example. Flyslow Aviation becomes aware of an uncalibrated tool being issued to a technician through their confidential employee reporting program (§ 5.71(a)(7)). During a review of the tool control program, the process owner recognized this could be a potential noncompliance with regulatory standards (§ 5.71(a)(6)) and uses the Voluntary Disclosure Reporting Program (VDRP) to notify Flyslow Aviation’s FAA Certificate Management Team (CMT) of the incident. G.3.7.1 A n investigation of the calibrated tool program is initiated as required by § 5.71(a)(3). Records of previous audits (§ 5.97(b)) were reviewed for any previous calibrated tool findings. It was noted during the records review and interviews with employees that the tool room changed from a manual calibrated tool tracking system to a computer-based tracking system since the previous audit occurred. G.3.7.2 Uncalibrated tools being issued to employees is identified as a new hazard (§ 5.73(c)). Flyslow Aviation initiates their SRM process as required by § 5.51(d). G.3.7.3 Once acceptable risk controls are developed and implemented using their SRM processes, Flyslow Aviation establishes a new objective to reduce the issuance of uncalibrated tools and adds a requirement to track calibrated tool control under § 5.73(a)(3) to ensure the developed risk controls are functioning as designed. The process owner regularly reviews the data acquired through their safety assurance monitoring processes and evaluates the effectiveness of the changes to the calibrated tool program. G.3.7.4 After a defined period of monitoring the tool tracking process, Flyslow Aviation determines the risk controls are working as designed as there have been no further instances of uncalibrated tools being issued to technicians. They close out the special audit and monitoring of this risk control for their calibrated tool program. G.3.8 S afety Promotion and SMS Documentation and Recordkeeping Example. In an effort to raise awareness of the calibrated tool issue and employee reporting, Flyslow Aviation’s management included discussions on these areas as a monthly topic during employee meetings (§ 5.23(2)(iii) and § 5.93). In addition, management posted signs and posters in the breakroom and work areas. Rosters of meeting attendees were retained as well as a copy of the agenda topics (§ 5.97(d)). Note 1: I n this example, § 5.91 would not be required as the training requirement addresses SMS processes and procedures. Calibrated tool usage, which is the subject of the training, is covered by other regulations and not the SMS. ### Page 142 Appendix G G-17 Note 2: Flyslow Aviation has control of the calibrated tool program and the associated hazards. If the hazard was under the control of an interfacing organization, then Flyslow Aviation would communicate the hazard under § 5.57. ### Page 143 Appendix H H-1 APPENDIX H. REFERENCES AND ADDITIONAL INFORMATION H.1 SMS-Related Resources. For additional information regarding SMSs, the following resources may prove helpful: H.1.1 FAA public SMS website: https://www.faa.gov/about/initiatives/sms/specifics_by_aviati on_industry_type. H.1.2 International Civil Aviation Organization (ICAO) Safety Management website: https://www.icao.int/safety/SafetyManagement/Pages/default.aspx. H.1.3 Transport Canada (TC) SMS website: https://tc.canada.ca/en/aviation/general- operatingflight-rules/aviation-safety-management/safety-management-systems-aviation. H.1.4 Australian Government Civil Aviation Safety Authority SMS website: https://www.casa.gov.au/operations-safety-and-travel/safety-management-systems. H.1.5 Civil Aviation Authority (CAA) of New Zealand SMS website: https://www.aviation.govt.nz/safety/sms-safety-management-systems/. H.1.6 Web-Based Application Tool (WBAT). WBAT (maintained by Universal Technical Resource Services, Inc. (UTRS)) provides service providers with a secure, fully customizable system that promotes safety and accountability across five employee groups. UTRS developed WBAT with funding from the FAA and will deliver free onsite training and electronic support to certificate holders (CH). The UTRS point of contact (POC) can be reached at info@wbatsafety.com. H.2 Code of Federal Regulations (CFR). Title 14 CFR Part 5, Safety Management Systems, and other current regulations are available online at https://www.ecfr.gov. H.3 FAA Resources. H.3.1 FAA Website. The FAA website is at https://www.faa.gov. H.3.2 Dynamic Regulatory System (DRS). DRS is located at https://drs.faa.gov and contains: • FAA Order 8900.1, Volume 10, Safety Assurance System Policy and Procedures. • FAA Order 8900.1, Volume 17, Safety Management System. H.4 Related Reading Material. Current editions of the following documents may be helpful in developing an SMS. H.4.1 A dvisory Circulars (AC) . The following ACs are available on the FAA website and in DRS: ### Page 144 Appendix H H-2 • AC 00-58, Voluntary Disclosure Reporting Program. • AC 21-58, Safety Management Systems for Part 21 Type and Production Certificate Holders. • AC 120-48, Communication and Coordination Between Flightcrew Members and Flight Attendants. • AC 120-49, Parts 121 and 135 Certification. • AC 120-59, Internal Evaluation Programs. • AC 120-66, Aviation Safety Action Program. • AC 120-79, Developing and Implementing an Air Carrier Continuing Analysis and Surveillance System. • AC 120-82, Flight Operational Quality Assurance. • AC 120-115, Maintainer Fatigue Risk Management. • AC 150/5200-37, Safety Management Systems for Airports . H.4.2 FAA Orders. The following orders are available on the FAA website and in DRS: • FAA Order VS 8000.367, AVS Safet y Management System (AVSSMS) Requirements. • F AA Order 8000.369, Safety Management System. • FAA Order 8000.377, Flight Standards Safety Management System (FSSMS) Requirements. H.4.3 ICAO Resources. The following resources are available on the ICAO website at https://www.icao.int/publications/Pages/default.aspx: • Annex 6, Operation of Aircraft, P art I, International Commercial Air Transport – Aeroplanes. • A nnex 8, Airworthiness of Aircraft. • Annex 19, Safety Management. • Document 9859, Safety Management Manual. ### Page 145 Appendix I I-1 APPENDIX I. ACRONYMS AND ABBREVIATIONS 14 CFR Title 14 of the Code of Federal Regulations 49 CFR Title 49 of the Code of Federal Regulations AC Advisory Circular AD Airworthiness Directive AFM Aircraft Flight Manual APU Auxiliary Power Unit AQP Advanced Qualification Program ASAP Aviation Safety Action Program ASRS Aviation Safety Reporting System ATC Air Traffic Control BOD Board of Directors CAA Civil Aviation Authority CAMP Continuous Airworthiness Maintenance Program CASS Continuing Analysis and Surveillance System CEO Chief Executive Officer CFIT Controlled Flight Into Terrain CFO Chief Financial Officer CH Certificate Holder CMO Certificate Management Office CMT Certificate Management Team CPM Certification Project Manager DO Director of Operations DOD Department of Defense DOM Director of Maintenance DOS Director of Safety DRS Dynamic Regulatory System ERP Emergency Response Plan ETOPS Extended Operations F/A Flight Attendant FAA Federal Aviation Administration ### Page 146 Appendix I I-2 FBO Fixed-Base Operator FDA Flight Data Analysis FMS Flight Management System FOM Flight Operations Manual FOQA Flight Operations Quality Assurance FRAT Flight Risk Assessment Tool GOM General Operations Manual HAZMAT Hazardous Materials HF Human Factor ICAO International Civil Aviation Organization IEP Internal Evaluation Program IMC Instrument Meteorological Conditions InFO Information for Operators LOA Letter of Authorization LOSA Line Operations Safety Audit MEL Minimum Equipment List NASA National Aeronautics and Space Administration NTSB National Transportation Safety Board OpSpec Operations Specification PD Pilot Deviation POC Point of Contact RCA Root Cause Analysis RII Required Inspection Item RNAV Area Navigation RSM Repair Station Manual SAFO Safety Alert For Operators SB Service Bulletin SDR Service Difficulty Report SM ICG Safety Management International Collaboration Group SME Subject Matter Expert SMS Safety Management System SMSVP Safety Management System Voluntary Program ### Page 147 Appendix I I-3 SPA Safety Performance Assessment SRM Safety Risk Management TC Transport Canada TCH Type Certificate Holder TSO Technical Standard Order UTRS Universal Technical Resource Services, Inc. VDRP Voluntary Disclosure Reporting Program VMC Visual Meteorological Conditions W&B Weight and Balance WBAT Web-Based Application Tool ### Page 148 Advisory Circular Feedback Form If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by contacting the Safety Analysis and Promotion Division at 9-AVS-AFS900-Directives@faa.gov or the Flight Standards Directives Management Officer at 9-AWA-AFB-120-Directives@faa.gov. Subject: AC 120-92D, Safety Management Systems for Aviation Service Providers Date: _____________________ Please check all appropriate line items: An e rror ( proc edural or typographical) has been noted in paragraph ____________ on page _______. Recommend paragraph _____________ on page __________ be changed as follows: ______________________________________________________________________ ______________________________________________________________________ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.) ______________________________________________________________________ ______________________________________________________________________ Other comments: ______________________________________________________________________ ______________________________________________________________________ I would like to discuss the above. Please contact me. Submitted by: Date: ______________________ --- From OpenAirDocs.org, an independent open copy of FAA data. Only the Federal Register edition on govinfo.gov is the official legal text of an AD.