AC 120-92D

Advisory circular · Safety Management Systems for Aviation Service Providers

Approved
May 21, 2024
Last reviewed
August 22, 2024
This change
Revision C of this AC was canceled and did not publish. However, it was posted for public comment prior to being canceled, so this update was published as Revision D.
Cancels
AC120-92B Ed Update 1
Family
AC 120-92 · 5 versions
Revision
D
14 CFR parts
5, 91, 119
14 CFR sections
§ 91.147§ 119.8

Guidance, not mandatory unless a rule or AD requires it. DRS record last changed November 22, 2025.

Show pages 97–108
Page 109Open in PDF

Appendix B B-8 Figure B-7. Risk Control Documentation Note: Refer to part 5 subpart F.

System/Project:

Hazard Procedure Documentation H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 110Open in PDF

Appendix C C-1 APPENDIX C. GUIDANCE FOR DEVELOPING A SAFETY POLICY AND CODE OF

ETHICS STATEMENT C.1 Safety Policy Statement.

C.1.1 Many aviation organizations have developed a safety policy statement. The safety policy must contain the requirements in 14 CFR part 5, § 5.21 and be signed by the accountable executive (§§ 5.21(b) and 5.25(b)(2)). It could make sense to combine the code of ethics and a safety policy statement into a single document. References (“pointers”) to other manuals or documentation that provide guidance on how each requirement is met should be embedded in the safety policy statement. For example, the requirement for an emergency response plan (ERP) could be met by referring to a separate document or an appendix in a Repair Station Manual (RSM) or General Operations Manual (GOM). By pointing to where the information is located, it makes it easier for employees to find that material. A secondary benefit is it prevents duplication of documentation. It is important to remember the safety policy is unique to the aviation organization and should be developed to meet the unique and specific needs, operating profile, and structure of the aviation organization.

C.1.2 P art 5 list s the specific documentation requirements that must be included in the completed safety policy (§ 5.95). A safety policy statement is a document that states what the organization will do and how employees are expected to act. The SMS processes and procedures define actions employees will take to meet the safety policy requirements and measurable objectives (i.e., how they are to perform their SMS duties and responsibilities). A safety policy statement (if developed as a separate document) and safety policy processes and procedures are necessary when developing and maintaining an SMS for completeness.

C.2 C ode of Ethics.

C.2.1 Aviation organizations are required to develop a code of ethics for all employees, including management personnel and officers. The safety policy must include a code of ethics that specifies that safety is the organization’s highest priority and applies to all employees, including management personnel and officers. This requirement is in § 5.21(a)(7). A code of ethics defines the aviation organization’s standards of conduct that employees are expected to uphold. The code of ethics should be a concise statement that outlines values the aviation organization holds and maintains in the course of business. A code of ethics is a very high-level statement that gives employees at all levels of the organization a general idea of what types of behavior and decisions are acceptable and expected in the conduct of business. A code of ethics may be combined with a safety policy statement at the discretion of the aviation organization.

C.2.2 A safety policy and code of ethics statement should not be confused with the requirements of § 5.95, which requires aviation organizations to document their safety policy. All that needs to be documented in the safety policy and code of ethics statement is the aviation organization’s expectations.

Page 111Open in PDF

Appendix C C-2 C.3 Sample Statement. Figure C-1 is a sample safety policy and code of ethics statement.

Figure C-1. Sample Safety Policy and Code of Ethics Statement The Executive Management of [aviation organization’s name] recognizes that an effective Safety Management System (SMS) is vital to the success and longevity of the company. Therefore, the Executive Management is committed to maintaining a fully functional SMS and to the continuous improvement of safety throughout [aviation organization’s name]. This Safety Policy and Code of Ethics Statement applies to all employees in [aviation organization’s name] from the organization’s executive officers to line employees.

[Aviation organization’s name] believes the highest priority of our organization is ensuring the safety of our employees and customers. Every effort has been given to ensure this is always first and foremost in everything we do.

The Executive Management of [aviation organization’s name] has established specific safety-related objectives and periodically publishes and distributes to all employees those objectives and plans.

Specific objectives are located in the [state location of objectives] for regular employee review.

These safety objectives are monitored, measured, and tracked to ensure overall corporate safety objectives are met. All employees and individuals in the company have the responsibility to perform their duties and activities in the safest practical manner.

[Aviation organization’s name] Accountable Executive is committed to providing the necessary financial, personnel, and other resources to maintain a fully functional SMS.

[Aviation organization’s name] Executive Management recognizes that open communication is critical to our success and is dedicated to maintaining a confidential employee reporting system for reporting all hazards, accidents, incidents, and safety issues without fear of reprisal. [Aviation organization’s name] encourages all employees to provide suggestions on how to improve processes and procedures as well as how to reduce workplace hazards they encounter during the course of their duties. Specific reporting procedures are located in the [state location of procedures].

Activities involving intentional disregard for FAA regulations and company policies and procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary action. [State location of unacceptable behaviors and disciplinary actions].

As a component of the SMS, [aviation organization’s name] Executive Management is committed to maintaining and periodically exercising an emergency response plan that provides for the safe transition from normal to emergency operations. [State location of emergency response plan].

[Aviation organization’s name] Executive Management will convey this expectation to all employees through postings, the intranet site, the company newsletter, and any other means to ensure all employees are aware of the company’s SMS, their duties and responsibilities, and our safety policy.

This Safety Policy and Code of Ethics Statement will be periodically reviewed by Executive Management to ensure it remains relevant and appropriate to the company.

[Signed], Accountable Executive [Additional management personnel optional]

Page 112Open in PDF

Appendix D D-1 APPENDIX D. GUIDANCE FOR DEVELOPING A COMPLIANCE STATEMENT D.1 Compliance Statement. The purpose of a compliance statement is to ensure aviation organizations adequately address the applicable sections of 14 CFR part 5 during the development and implementation of an SMS. The compliance statement must list all part 5 sections and subsections that apply to the aviation organization’s operation. Next to each part 5 requirement (section and subsection), the applicant/aviation organization must provide a specific reference to a manual or other document, if required, and may provide a brief narrative description that describes how they will comply with each section or subsection. This statement also serves as a master index to the aviation organization’s documentation system to expedite the FAA’s oversight of the SMS. Aviation organizations are encouraged to maintain and routinely update their compliance statement, which is a living document, as changes are made to their SMS.

D.2 How to Prepare a Compliance Statement.8 Preparation of the compliance statement benefits the aviation organization by systematically ensuring all applicable regulatory aspects are appropriately addressed during the SMS acceptance and oversight process. It can also serve as a master index to the aviation organization’s system documentation.

8 Refer to AC 120-49, Parts 121 and 135 Certification.

D.2.1 To develop a compliance statement:

1. List all applicable sections contained in part 5.

2. Next to each subparagraph, provide a specific reference to a manual or other document where the method of compliance is documented. Aviation organizations not required to maintain a manual system are encouraged to provide a brief narrative description of how compliance with each regulation will be met; however, this description is not required.

3. The location of each reference should be as specific as possible and should contain the name of the manual, chapter, section, and paragraph number(s). Using manual page numbers in a compliance statement may produce inaccurate reference locations due to repagination problems. There may be multiple references for one requirement found within one manual, or there may be multiple reference locations found in several different manuals. It is not acceptable to enter references such as “ABC Airlines will comply with this requirement,” “ABC Airlines understands this regulation and will comply,” or “Noted.”

4. The compliance statement is an important document during certification and the SMS oversight process. After the SMS is determined to be acceptable to the Administrator, the compliance statement should be kept current in the aviation organization/applicant’s system.

D.2.2 The following tables are examples of formats that may be used to present the list of specific requirements and subparts, including all subparagraphs.

Page 113Open in PDF

Appendix D D-2 Table D-1. Sample Compliance Statement for Aviation Organizations That Are Required to Maintain a Manual System Section/ Subsection Text Reference § 5.21(a)

(a) Any person required to have an SMS under this part must have a safety policy that includes at least the following:

§ 5.21(a)(1) (1) The person’s safety objectives. Repair Station Manual (RSM), paragraph 2-37 § 5.21(a)(2) (2) The person’s commitment to fulfill the safety objectives. RSM introductory message § 5.21(a)(3)

(3) A clear statement about the provision of the necessary resources for the implementation of the SMS.

RSM introductory message § 5.21(a)(4)

(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.

RSM, paragraph 241;

Training Manual, Chapter 7 § 5.21(a)(5) (5) A policy that defines unacceptable behavior and conditions for disciplinary action. Human Resources Manual, Chapter 3, paragraph 3-17 § 5.21(a)(6)

(6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.

Emergency Response Manual § 5.21(a)(7)

(7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority.

Employee Handbook and displayed in workplace

Page 114Open in PDF

Appendix D D-3 Table D-2. Sample Compliance Statement for Aviation Organizations That Are Not Required to Maintain a Manual System Section/ Subsection Text Sample Verbiage § 5.21(a)

(a) Any person required to have an SMS under this part must have a safety policy that includes at least the following:

§ 5.21(a)(1)

(1) The person’s safety objectives. Our safety objectives are located in our company compliance statement and are updated annually or as required.

§ 5.21(a)(2)

(2) The person’s commitment to fulfill the safety objectives.

We will always operate at the highest levels to ensure the safety of our personnel and passengers.

§ 5.21(a)(3)

(3) A clear statement about the provision of the necessary resources for the implementation of the SMS.

We will ensure that resources are provided to ensure aircraft maintenance and pilot training are always maintained and in accordance with current regulations.

§ 5.21(a)(4)

(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.

We participate in the Community Aviation Safety Action Program (ASAP) and will report hazards and issues through their web portal.

§ 5.21(a)(5)

(5) A policy that defines unacceptable behavior and conditions for disciplinary action.

Drug and alcohol abuse are strictly forbidden in this company. Violations of this will result in termination.

§ 5.21(a)(6)

(6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.

We will provide a copy of the flight dispatch log in case of emergency so the route of flight will be known to emergency services.

§ 5.21(a)(7)

(7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority.

We have our code of ethics statement posted in the workplace.

Page 115Open in PDF

Appendix E E-1 APPENDIX E. IDENTIFYING THE ACCOUNTABLE EXECUTIVE E.1 To assist aviation organizations with selection of the accountable executive, Figure E-1, Accountable Executive Decision Process, and Figure E-2, Verifying the Accountable Executive, provide flowcharts with a series of questions. Figure E-1 identifies different organizational structures and how those structures may determine the accountable executive. These flowcharts cannot address all possible organizational structures. Any questions concerning the selection of the accountable executive should be addressed to the responsible Flight Standards office.

E.2 O nce the accountable executive is identified (see Figure E -1), the questions in Figure E-2 will assist in verifying that the individual in the selected position is the correct choice. All questions must receive a “yes” answer as they are validating the requirements of 14 CFR part 5, § 5.25(a). Should any of the quest ions result in a “no” answer, the selection process should be initiated again with the new candidate.

Page 116OCROpen in PDF

Appendix E Figure E-1. Accountable Executive Decision Process Start Accountable Executive Is the proprietorship? organization a sole YES Proprietor is the Accountable Executive. Confirm selection by answering the questions in Figure E-2.

Proprietor is the Accountable Executive.

Nominate a Confirm selection by Is the organization a partner as answering the partnership between YES Accountable questions in individuals? Executive. Figure E-2.

Nominated partner is the Accountable Executive NO Has the Board Confirm selection Is the organization appointed a CEO or Board of Directors? controlled by a YES equivalent to manage the organization? YES by answering the questions in Figure E-2.

CEO is the Accountable Executive Chairman of the Board is the Accountable Executive What corporate position has the authority and the ultimate Who in the responsibility to expend corporate organization holds resources for aviation-related this position?

activities?

Confirm selection made, re-evaluate organization If a clear selection cannot be by answering the questions in YES Identified individual is the Accountable Executive.

and begin process again.

Figure E-2 E-2

Page 117OCROpen in PDF

Appendix E Figure E-2. Verifying the Accountable Executive Start Identify individual Select an other by name. candidate.

Does the individual have § 5.25(a)(1) final authority over the service provider's operations?

Does the individual control § 5.25(a)(2) the financial resources for the NO aviation organization's operation?

Does the individual control § 5.25(a)(3) the human resources for the aviation organization's operation?

Does the individual retain the the safety performance of the ultimate responsibility for NO § 5.25(a)(4) aviation organization's operations?

YES This individual is the Accountable Executive.

E-3

Page 118Open in PDF

Appendix F F-1 APPENDIX F. SAFETY ATTRIBUTES F.1 Safety Attributes. Safety attributes represent the core characteristics of any system that should be integrated into all processes and procedures. All aviation organizations use technical processes and procedures to provide their aviation product or service. However, some FAA regulations do not require certain operations to have manuals or documentation defining how they will operate. Even a “single-individual shop” follows an assortment of processes that may be undocumented to ensure the continued viability of the business. The extent to which the processes and procedures are described in writing is not as important as how effective they are in practice. As the complexity of an operation increases, the need for written procedures increases to ensure clear communication of organizational policies and priorities as well as a consistent and fair application of rules.

Aviation organizations communicate these processes to their personnel in various ways

(e.g., training curricula, employee briefings, new-hire discussions, etc.). Required records are generated using these organizationally developed processes. Processes scale the regulations to the scope and complexity of the operation. Processes also provide the balance between the economic and safety objectives of the organization.

F.1.1 For aviation organizations with an SMS, it is easy to assign specific “SMS requirements” to the related process attributes. That can be done because SMS required activities are just extensions of certain safety attributes. Therefore, by understanding the safety attributes, there will be a better understanding of SMS concepts. It is important to note these are safety attributes, and they will not fully evaluate an SMS.

F.1.2 Effective processes and procedures include provisions for the systematic identification, evaluation, and prevention or control of specific job hazards and potential hazards that may arise from foreseeable conditions.

F.1.3 Although compliance with FAA regulations is an important objective, effective processes and procedures look beyond the requirements of the regulations to address all hazards.

Aviation organizations should seek to prevent aviation-related injuries and illnesses whether or not compliance is at issue.

F.1.4 The key to compliance with FAA regulations lies in the reliability of the aviation organization’s processes.

F.1.5 One way to determine the effectiveness of an aviation organization’s processes is by looking for attributes that are embedded within good processes and procedures. Once the attributes are understood, these questions are relatively easy to apply. These common questions apply to those organizations that have an SMS as well as to aviation organizations that do not have an SMS.

F.1.6 Every process includes certain characteristics that support ongoing reliability over time.

That means every procedure and the associated processes should have these characteristics integrated into the process design and be updated when processes begin to fail due to changes in the organization’s operational environment.

Page 119Open in PDF

Appendix F F-2 F.2 Safety Attribute Application. The following is a discussion of the safety attributes.

There are seven safety attributes, and this discussion will start with those that are directly associated with the aviation organization’s employee groups. These are referred to as personnel-related attributes. They consist of responsibility, authority, and safety ownership. There are four safety attributes that are related to the technical processes.

These are referred to as process-related attributes. These consist of controls, procedures, interfaces, and process measurement.

F.2.1 These attributes can be further broken down into four categories based on their characteristics. These are:

1. Employee roles and responsibilities. These are responsibility, authority, and safety ownership. They are the same as the personnel-related attributes.

2. The design and application of system processes. These are controls and procedures attributes.

3. Internal and external supplier impacts on the system. This addresses the interfaces attribute.

4. System performance and monitoring. This is where the process measurement attribute is addressed.

F.2.2 By organizing the safety attributes by their characteristics, this may improve understanding of how the foundations of system safety rely on both human and technical process areas to improve safety in all processes and procedures.

F.3 Responsibility Attribute. The responsibility attribute is defined as “A clearly identified individual who is accountable for ensuring financial and human resources to ensure the safety and quality performance of the certificate holder.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) This attribute looks for “resource availability” that executive management allocates to support the aviation product or service. This could be adequate personnel and budgeting for facilities, parts, tooling, and any other resources required to ensure the success of the aviation organization. In aviation organizations with an SMS, this attribute is focused on the accountable executive and how they are ensuring the overall operational success of the aviation organization. In a non-SMS aviation organization, the responsibility attribute would be looking at the president, Chief Executive Officer (CEO), or owner or the individual ultimately responsible for the safe operations of the aviation activity.

F.3.1 In larger organizations, executive management o r business-tier managers are typically not technical process managers. Executive management (e.g., CEOs, Chief Financial Officers (CFO), Board of Directors (BOD), etc.) control the financial resources of the organization. The FAA’s position is that technical managers cannot maintain reliable technical processes unless executive management provides the human and financial support to do so. Once sufficient resources are distributed to the technical managers, they must appropriately apply those resources in a manner that supports the safety objectives of the aviation organization. In a less complex organization, the same individual could “wear multiple hats.” In these organizations, it is important to only look at the attribute

Page 120Open in PDF

Appendix F F-3 being evaluated and only consider the position being evaluated. As the individual’s active duties change, the attribute being evaluated will also change. This is very common in a single-individual organization.

F.4 Authority Attribute. As mentioned above, the authority attribute seeks to determine if technical-level managers are managing process risk. The authority attribute is defined as “A clearly identifiable, qualified, and knowledgeable individual who effectively plans, directs, and controls resources; changes procedures; and makes key determinations including safety risk acceptance decisions.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.)

F.4.1 Technical-level management constitutes required regulatory personnel, managers, and all assigned process owners (e.g., lead engineer, fleet coordinator, or other authoritative positions without a manager title on the organizational chart) who “manage” specific technical functions. The description of these positions has been simplified by referring to them as “process owners.” Process owners speak with authority on behalf of the aviation organization in their process areas and may set additional workforce expectations not documented in FAA-approved or FAA-accepted manuals.

F.4.2 Process owners are responsible for properly utilizing resources provided to them, for accepting risk within their process area, and for changing processes or procedures as operations change.

F.5 Safety Ownership Attribute. This process characteristic is considered a key indicator of safety performance as it relates to an employee’s understanding of their contribution to the aviation organization’s safety goals and objectives. The safety ownership attribute helps determine whether an aviation organization is proactively ensuring employees understand how their day-to-day work activities support safety objectives in the workplace.

F.5.1 The safety ownership attribute is defined as “An individual’s understanding of how their role contributes to the overall safety of the organization.” (Refer to Order 8900.1, Volume 10, Chapter 1, Section 4.) Over time, data collected concerning this attribute may aid in determining the safety culture of an organization. A declining safety culture could be considered an indicator of risk.

F.5.2 Safety in the workplace includes everyone, whether a direct hire employee or contract aviation organization that supports the aviation product or service.

F.5.3 Safety ownership provides some insight as to the aviation organization’s proactive pursuit of a positive safety culture. It is well known that organizational culture directly affects the organization’s outcomes. The presumption is that employees who can explain or demonstrate their role in supporting safety initiatives in their daily work activities actually do participate in those safety efforts. Those employees who cannot explain their job-related safety contributions may not be participating to the extent they could be. For an aviation organization to leverage the eyes and ears of all its employees in identifying hazards and disposing safety concerns, action should be taken to solicit and encourage