3-17 §§ 119.65, 119.69, and 145.151 and might not appear on an organizational chart. Process owners, such as a battery shop manager or cargo manager, may have the technical expertise to manage the processes and procedures, and, if so, they would be able to accept risk in their functional area. A key element in the SRM process is to identify the levels of management with the authority to make risk decisions related to aviation safety. Thus, managers that have the authority to implement changes in systems and procedures should use the SMS processes in managing their area of operational responsibility. They are also responsible for ensuring the continuing operational safety of risk controls.
Through data collection methods and analytical processes in the safety assurance component, managers are able to determine that risk controls are effective and that their safety performance is acceptable. For example, the Director of Maintenance (DOM) is one of the managers accountable for SMS within their area of responsibility.
3.3.2.3.3 Em ployees. All employees should be aware of the organization’s safety policies as well as the processes, procedures, and tools relevant to their responsibilities. They need to know how the confidential employee reporting system works. Employees at all levels of the organization have a responsibility to report hazards, issues, and concerns related to aviation safety as well as to propose solutions and safety improvements. Employees have a duty and responsibility to follow an organization’s processes and procedures.
3.3.2.4 Im plementation Strategies. The method for meeting these requirements could vary greatly between different organizations. The numbers and relationships of personnel will be unique to each organization, and the organizational structure and accountability should be appropriate to the aviation organization.
3.3.2.4.1 Aviation organizations are required to define the duties and responsibilities of the accountable executive. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are defined in § 5.25.
3.3.2.4.2 Aviation organizations need to define the duties and responsibilities of management (process owners) in their areas of the operation.
3.3.2.4.3 All employee safety-related duties and responsibilities must be documented (where required). They could be located in the safety manual or in another organizational document. The SMS documentation should point to where the requirement is located if it is in a place other than the safety documentation.
3.3.2.4.4 A key element in the SRM process is to identify the levels of management with the authority to make risk decisions related to aviation safety. The positions identified must have the knowledge and skills to determine the acceptability of risk in their functional areas. Managers that have the authority
3-18 to implement changes in systems and procedures should use the SMS processes in managing risk in their area of operational responsibility.
3.3.2.4.5 Accountability for all employees directly involved in delivering the aviation organization’s product or service should be defined. Employees at all levels of the organization have a responsibility to report hazards, issues, and concerns as well as to propose solutions and safety improvements. Employees have a duty and responsibility to follow an organization’s processes and procedures.
3.3.2.4.6 In single-individual organizations, the personnel structure will be very simple and consist of the person in charge being the accountable executive, who is responsible for ensuring all required duties and activities are accomplished. In a small organization, other management personnel should be identified since they would have a role in how the organization is managed on a day-to-day basis.
3.3.2.5 Considerations for Small and Single-Individual Organizations. The following part 5 requirements are excepted for single-pilot organizations:
1. Section 5.23(a)(2): All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to:
(i) Hazard identification and safety risk assessment.
(ii) Assuring the effectiveness of safety risk controls.
(iii) Promoting safety as required in subpart E of this part.
(iv) Advising the accountable executive on the performance of the SMS and on any need for improvement.
2. Section 5.23(a)(3): Employees relative to the person’s safety performance.
3. Section 5.23(b): The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance.
3.3.2.5.1 In single-individual organizations, this structure will be very simple and consist of the sole individual being the accountable executive and assuming the various roles and responsibilities, which would normally be assigned to other members of management. The single individual would also be responsible for accepting all risks associated with the aviation organization’s products or services.
3.3.2.5.2 As their organizational duties change, which could happen many times during the day, the single individual could be said to be changing hats as their role changes as they manage the activities required in § 5.23.
3.3.3 D esignation and Responsibilities of Required Safety Management Personnel.
3.3.3.1 References. Section 5.25(a) and (b).
3-19
3.3.3.2 Part 5 Requirement.
§ 5.25, Designation and responsibilities of required safety management personnel.
(a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following:
(1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization.
(b) Responsibilities of the accountable executive. The accountable executive must accomplish the following:
(1) Ensure that the SMS is properly implemented and is performing across all pertinent areas.
(2) Develop and sign the safety policy.
(3) Communicate the safety policy throughout the person’s organization.
(4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person.
(5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75.
3.3.3.3 Discussion.
3.3.3.3.1 D esignation.
3.3.3.3.1.1 Section 5.25(a) requires the organization to identify an individual in the organization to be the accountable executive who holds the ultimate decision-making authority over the organization’s aviation-related operations. The accountable executive is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. A flowchart outlining a process for designating an accountable executive is available in Appendix E, Identifying the Accountable Executive.
3.3.3.3.1.2 When identifying the accountable executive, it is very important t o select an individual in the organization who holds the ultimate decision-making authority over the aviation organization’s operations. This individual is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. The organizational job title is not important when making this determination but rather the individual’s
3-20 responsibility to ensure appropriate resources are available and to accept risk for and oversee the aviation product or service.
3.3.3.3.2 R esponsibilities. As the ultimate authority in the organization, the accountable executive is responsible for the proper functioning of the SMS. This entails, among other things, keeping an open line of communication with the designated management personnel, providing sufficient resources for the SMS to function properly, and being actively involved in the safety assurance component of the SMS.
3.3.3.3.2.1 If an aviation organization chooses to integrate the safety policy an d code of ethics statement into a compliance statement, the accountable executive must sign the compliance statement to meet the requirements of § 5.25(b)(2). One way the aviation organization could define accountability for the accountable executive is by listing the duties and responsibilities identified in § 5.25 in a position description. These may be located in the SMS safety policy documentation or in another organizational manual, such as a human resources manual. If the duties and responsibilities are documented elsewhere, the safety policy should point to the location where they can be located. Smaller organizations could point to the regulatory requirements in § 5.25(b).
3.3.3.3.2.2 The accountable executive should maintain open lines of communication with the designated management personnel to ensure any identified hazards or issues are effectively communicated throughout the organization. Communicating the safety policy and code of ethics could be through publication of the safety policy statement in documentation employees have access to. It could also include periodic meetings where organizational information concerning the safety policy is shared with employees by the accountable executive and management.
3.3.3.3.2.3 The accountable executive must regularly review the safety performance of the organization. There should be documentation to show that it has occurred. The term “regularly” is not defined to specify an interval. Reviews should occur frequently enough for issues within the organization’s processes and procedures to be identified and corrected in a timely manner. This will vary based on the aviation organization’s size, scope, and complexity.
3.3.3.3.2.4 The accountable executive should designate sufficient management personnel to provide support for essential SMS functions, such as performing analysis, assisting operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive.
3-21 Personnel designated to perform this function should be in positions in the organization of sufficient independence to have direct access to the accountable executive to report on the safety performance of the operation and ability to recommend any necessary improvements. These individuals should be highly knowledgeable on the SMS and able to assist the process owners and functional area managers in accomplishing their SMS duties and responsibilities. This is not to say the management personnel are expected to accept risk in the functional areas, as they may not be the most qualified. The organization is not expected to add employees to fill this position either. These tasks could be accomplished by existing management personnel.
3.3.3.4 Implementation Strategies. The accountable executive is responsible for ensuring that sufficient management personnel are clearly designated for ensuring the safety of operational and SMS processes. When management personnel are designated, consideration should be given to ensure they are properly trained and qualified to perform the duties required of the position.
3.3.3.4.1 In smaller organizations, the accountable executive may directly supervise operational processes. This individual may serve in multiple positions within the organization.
3.3.3.4.2 It is unlikely that small organizations will have the resources for a designated representative to monitor the effectiveness of the SMS as a full-time position.
A small organization may add the safety manager duties to an existing role
(e.g., operations manager). In a single-individual operation, these duties would be filled by the accountable executive.
3.3.3.5 Considerations for Small and Single-Individual Organizations.
Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.25(b)(3): Responsibilities of the accountable executive. The accountable executive must accomplish the following: Communicate the safety policy throughout the person’s organization.
3.3.4 D esignation of Management Personnel.
3.3.4.1 References. Sections 5.25(c), 119.65, 119.67, 145.151, and 145.153.
3-22
3.3.4.2 Part 5 Requirement.
§ 5.25(c), Designation of management personnel.
(c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
3.3.4.3 Discussion. This section requires that the organization ensure that sufficient management personnel are available to provide support for essential SMS functions, such as performing analysis, assisting operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive.
3.3.4.3.1 When reviewing the designated management personnel required in § 5.25(c), the term “coordinate” means the management representative will aid other management personnel in the implementation and integration of the SMS throughout the organization. This position is not expected to “own” the SMS in the organization as everyone has a role and responsibilities to ensure proper functioning of the SMS. The term “facilitate” means the management representative will aid other process owners in hazard analysis and risk assessment. As they may not be a process owner, they are not expected to make risk-based decisions. The term “monitor” means the management representative will aid other process owners in determining if risk controls are functioning as designed. The duties and responsibilities listed above should be left to the process owners.
3.3.4.3.2 The designated management representative is expected to communicate safety information throughout the organization. Per § 5.97(d), a record of this activity should be retained so it can be validated during audits.
3.3.4.3.3 Designated management personnel are not necessarily subject matter experts (SME) in all areas of the aviation organization. Rather, they are personnel in a position to assist the process owners and management personnel with hazard identification and risk analysis, aid in communicating safety information throughout the organization, and monitor the effectiveness of safety risk controls.
3.3.4.3.4 Personnel designated to perform this function should be in positions in the organization with sufficient independence to have direct access to the
3-23 accountable executive to report on the safety performance of the operation and recommend any necessary improvements.
3.3.4.4 Implementation Strategies. These responsibilities may be carried by the accountable executive as defined in § 5.23(a)(1) or as collateral duties by managers referred to in § 5.23(a)(2), or the aviation organization could assign the tasks of supporting SMS functions to other management personnel.
3.3.4.5 Example. The following example demonstrates a way aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following is an example only and is not the only way the requirements could be met. For example, Flyslow Aviation has chosen to use an existing required management individual required under §§ 119.65, 119.69, or 145.151 and 145.153 to fulfill these responsibilities. As Flyslow Aviation grows and expands, they could establish a safety department with designated personnel assigned this requirement.
3.3.4.6 Considerations for Small and Single-Individual Organizations.
3.3.4.6.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.25(c): Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
3.3.4.6.2 In a single-pilot organization, the accountable executive would perform these designated duties as part of their duties under § 5.25. Effective communication of safety information is still important, even in a single-pilot or single-individual organization. The communication focus would be focused outside of the organization (i.e., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations.)
3-24
3.3.4.7 Safety Policy Example. Flyslow Aviation recognizes the key to a successful organization is open communication and strong leadership. They identify the accountable executive and management representatives (§ 5.23) and start working on the safety policy. While developing safety objectives (§ 5.21(a)(1)), management reviewed the organization’s performance indicators as well as reports from previous audits. Management then determined a reduction in uncalibrated tools being issued by the tool room would be an appropriate objective for the coming year. Management communicates the organization’s goal of reducing uncalibrated tool issuance by 20 percent by publishing an updated safety policy (§ 5.21(c) and (d)) and through employee meetings (§ 5.23). Management also develops processes and procedures describing how employees are expected to accomplish their duties and responsibilities under the SMS.
3.3.5 Coordination of Emergency Response Planning.
3.3.5.1 References. Section 5.27.
3.3.5.2 Part 5 Requirement.
§ 5.27, Coordination of emergency response planning.
Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
(c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.
3.3.5.3 Discussion. The aviation organization is required to develop an ERP. This may be a part of the safety policy documentation or a separate document. If it is a separate document, the safety policy should point to where the ERP is located.
3.3.5.3.1 The ERP should be developed, which ensures normal SMS functions and risk acceptance continues while key personnel are removed from their normal risk management positions. The plan should also address how the aviation organization will transition to normal operations after the emergency condition subsides.
3.3.5.3.2 The ERP should provide procedures for management decision making and action in an emergency. For the purposes of meeting this section, the aviation organization should develop an ERP that ensures normal SMS functions and risk acceptance continues when process owners are removed from their normal risk management positions. This also should be applied for vacations or other absences. A line of succession of management authority sufficient to respond to emergencies needs to be established and documented in the
3-25 position description so employees required to assume these duties are able to understand the additional duties and responsibilities. As proxies are identified to step into these roles, organizations must ensure they are trained and competent to perform the additional duties of SMS risk acceptance.
3.3.5.3.3 Coordination of ERPs with the ERPs of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous materials (HAZMAT) authorities. Many organizations already have ERPs that may be used to fulfill this requirement.
3.3.5.4 Implementation Strategies. Consider whether the ERP covers the likely emergencies and has been coordinated with other organizations that may be affected and with the emergency services. A small, noncomplex organization’s ERP might consist of a checklist of simple steps involving who to call when and what information to impart and a regularly updated list of contact details. When considering the ERP, succession planning must be considered. If a member of management is removed from their position to address an emergency, there should be another individual trained and competent to step into the position to ensure the organization continues to function as designed. This could even take place when the individual is away for other reasons. Common sense must prevail; processes need to be workable and tailored for the operation. In other words, do not over think it!
3.3.5.5 Considerations for Small and Single-Individual Organizations.
3.3.5.5.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.27: Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
3.3.5.5.2 Effective communication of safety information is important, even in a single-pilot organization. In an organization with a single pilot or single individual, the communication focus may be outside the organization
(e.g., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Interfacing with maintenance, fixed-based operators, and flight followers (if one is used) all
3-26 require communication so they are aware of the aviation organization’s activities. This will aid in scheduling support activities as well as having someone keep an eye out in case plans do not go as predicted. In a single-pilot or single-individual organization, this could be met by simply filing flight plans with air traffic control (ATC) or leaving an envelope with emergency contact information at the local Fixed-Base Operator (FBO) if the aircraft does not return on time.
3.4 Subpart C, S afety Risk Management.
3.4.1 Applicability: Requirements to Apply SRM.
3.4.1.1 References. Section 5.51.
3.4.1.2 Part 5 Requirement.
§ 5.51, Applicability.
Any person required to have an SMS under this part must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.
3.4.1.3 Discussion. To know when an SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets that are directly related to the organization’s aviation safety activities. Examples of broad-based systems could include:
• Flight operations,
• Operational control (dispatch/flight following),
• Maintenance and inspection,
• Cabin safety,
• Ground handling and servicing,
• Cargo handling, and
• Training.
3.4.1.3.1 Within an aviation organization’s systems, there are subsystems related to aviation safety. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, component shops, deicing, fueling, aircraft fleet, ground operations, and HAZMAT training.
3-27
3.4.1.3.2 Under § 5.51, the SRM process is triggered when new systems or changes to existing systems related to aviation activities are being considered. For example, changes to operations could include the addition of new routes, opening or closing of line stations, addition or change of contractual arrangements for services, addition of new fleets or major modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS), or change in authorizations to a repair station’s ratings.
3.4.1.3.3 The SRM process is not triggered solely by major changes to a system; it is triggered by any aviation-safety-related revision of an existing system.
3.4.1.3.4 The SRM process is also triggered when any aviation-related change in the operating environment or ineffective risk controls are identified by the safety assurance processes.
3.4.1.3.5 Aviation organizations must document (where required) when the SRM processes are to be implemented based on the requirements in § 5.51. While it is not the intent to require the application of SRM processes and procedures to activities that are not related to the aviation operations, some aviation organizations may elect to add additional triggering events.
3.4.1.3.6 International Civil Aviation Organization (ICAO) Annex 19, Safety Management, requires hazard identification and SRM to be initiated using reactive and proactive methods. As discussed in § 5.51, proactive requirements are initiated when an organization implements new systems, revises existing systems, or develops operational procedures. The reactive trigger is hazards or ineffective risk controls identified through the organization’s safety assurance processes.
3.4.1.3.7 A question you might wonder is “Do I have to do SRM if I update a manual?”
The answer is yes; any change to existing processes or revision to existing systems (the manual is part of your aviation organization’s system) requires SRM to be initiated. Now, you might be thinking “Do I have to do the entire SRM process?” The answer to that question is that it depends. If you are just updating the organizational chart due to promotions and turnover, then probably not. You would describe the system and then assess it for hazards. If no hazards are identified by updating the organizational chart, then the process is complete. Depending on how the process is written, there could be a simple check mark that indicates no hazards identified on the organization’s SRM tracking document. For an example, see Appendix B, Sample Safety Risk Management (SRM) Worksheets, Figure B-1, Safety Risk Management Triggering Conditions and Summary.
3.4.2 S ystem Analysis .
3.4.2.1 References. Section 5.53(a) and (b).
3-28
3.4.2.2 Part 5 Requirement.
§ 5.53(a) and (b), System analysis and hazard identification.
(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system’s operating environment.
(3) An outline of the system’s processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
(5) The interfaces of the system.
3.4.2.3 Discussion. System analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by defining and analyzing the system. This can be as simple as creating a flowchart of the system or writing a short narrative to help the aviation organization understand the interfaces with the processes and procedures that are affected by the change.
3.4.2.3.1 Aviation organizations must document processes and procedures defining how the process owners will conduct a system analysis and hazard identification as part of their SRM analysis.
3.4.2.3.2 Documentation should provide sufficient procedural guidance to aid the process owners in defining the function and purpose of the system. When accomplishing this step, all interfaces with the various divisions, internal and external to the process being evaluated, need to be considered. Interfaces could be internal or external to the organization and the system being evaluated. An SMS must ensure an organization’s safety is not adversely affected by the products and services external organizations provide. Some examples of external interfaces could be maintenance providers, contract flight instructors and pilots, ground handlers, refuellers, and airport services.
In other words, if you are analyzing a change in engine inspection requirements, do not worry about analyzing the aircraft landing gear unless it is directly affected by the task being changed.
3.4.2.3.3 Good documentation provides sufficient guidance to aid the process owners in defining the personnel, equipment, and facilities necessary for safe operation of the equipment. It also ensures consistent results when different process owners perform SRM.