3-23 accountable executive to report on the safety performance of the operation and recommend any necessary improvements.
3.3.4.4 Implementation Strategies. These responsibilities may be carried by the accountable executive as defined in § 5.23(a)(1) or as collateral duties by managers referred to in § 5.23(a)(2), or the aviation organization could assign the tasks of supporting SMS functions to other management personnel.
3.3.4.5 Example. The following example demonstrates a way aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following is an example only and is not the only way the requirements could be met. For example, Flyslow Aviation has chosen to use an existing required management individual required under §§ 119.65, 119.69, or 145.151 and 145.153 to fulfill these responsibilities. As Flyslow Aviation grows and expands, they could establish a safety department with designated personnel assigned this requirement.
3.3.4.6 Considerations for Small and Single-Individual Organizations.
3.3.4.6.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.25(c): Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
3.3.4.6.2 In a single-pilot organization, the accountable executive would perform these designated duties as part of their duties under § 5.25. Effective communication of safety information is still important, even in a single-pilot or single-individual organization. The communication focus would be focused outside of the organization (i.e., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations.)
3-24
3.3.4.7 Safety Policy Example. Flyslow Aviation recognizes the key to a successful organization is open communication and strong leadership. They identify the accountable executive and management representatives (§ 5.23) and start working on the safety policy. While developing safety objectives (§ 5.21(a)(1)), management reviewed the organization’s performance indicators as well as reports from previous audits. Management then determined a reduction in uncalibrated tools being issued by the tool room would be an appropriate objective for the coming year. Management communicates the organization’s goal of reducing uncalibrated tool issuance by 20 percent by publishing an updated safety policy (§ 5.21(c) and (d)) and through employee meetings (§ 5.23). Management also develops processes and procedures describing how employees are expected to accomplish their duties and responsibilities under the SMS.
3.3.5 Coordination of Emergency Response Planning.
3.3.5.1 References. Section 5.27.
3.3.5.2 Part 5 Requirement.
§ 5.27, Coordination of emergency response planning.
Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
(c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.
3.3.5.3 Discussion. The aviation organization is required to develop an ERP. This may be a part of the safety policy documentation or a separate document. If it is a separate document, the safety policy should point to where the ERP is located.
3.3.5.3.1 The ERP should be developed, which ensures normal SMS functions and risk acceptance continues while key personnel are removed from their normal risk management positions. The plan should also address how the aviation organization will transition to normal operations after the emergency condition subsides.
3.3.5.3.2 The ERP should provide procedures for management decision making and action in an emergency. For the purposes of meeting this section, the aviation organization should develop an ERP that ensures normal SMS functions and risk acceptance continues when process owners are removed from their normal risk management positions. This also should be applied for vacations or other absences. A line of succession of management authority sufficient to respond to emergencies needs to be established and documented in the
3-25 position description so employees required to assume these duties are able to understand the additional duties and responsibilities. As proxies are identified to step into these roles, organizations must ensure they are trained and competent to perform the additional duties of SMS risk acceptance.
3.3.5.3.3 Coordination of ERPs with the ERPs of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous materials (HAZMAT) authorities. Many organizations already have ERPs that may be used to fulfill this requirement.
3.3.5.4 Implementation Strategies. Consider whether the ERP covers the likely emergencies and has been coordinated with other organizations that may be affected and with the emergency services. A small, noncomplex organization’s ERP might consist of a checklist of simple steps involving who to call when and what information to impart and a regularly updated list of contact details. When considering the ERP, succession planning must be considered. If a member of management is removed from their position to address an emergency, there should be another individual trained and competent to step into the position to ensure the organization continues to function as designed. This could even take place when the individual is away for other reasons. Common sense must prevail; processes need to be workable and tailored for the operation. In other words, do not over think it!
3.3.5.5 Considerations for Small and Single-Individual Organizations.
3.3.5.5.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.27: Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
3.3.5.5.2 Effective communication of safety information is important, even in a single-pilot organization. In an organization with a single pilot or single individual, the communication focus may be outside the organization
(e.g., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Interfacing with maintenance, fixed-based operators, and flight followers (if one is used) all
3-26 require communication so they are aware of the aviation organization’s activities. This will aid in scheduling support activities as well as having someone keep an eye out in case plans do not go as predicted. In a single-pilot or single-individual organization, this could be met by simply filing flight plans with air traffic control (ATC) or leaving an envelope with emergency contact information at the local Fixed-Base Operator (FBO) if the aircraft does not return on time.
3.4 Subpart C, S afety Risk Management.
3.4.1 Applicability: Requirements to Apply SRM.
3.4.1.1 References. Section 5.51.
3.4.1.2 Part 5 Requirement.
§ 5.51, Applicability.
Any person required to have an SMS under this part must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.
3.4.1.3 Discussion. To know when an SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets that are directly related to the organization’s aviation safety activities. Examples of broad-based systems could include:
• Flight operations,
• Operational control (dispatch/flight following),
• Maintenance and inspection,
• Cabin safety,
• Ground handling and servicing,
• Cargo handling, and
• Training.
3.4.1.3.1 Within an aviation organization’s systems, there are subsystems related to aviation safety. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, component shops, deicing, fueling, aircraft fleet, ground operations, and HAZMAT training.
3-27
3.4.1.3.2 Under § 5.51, the SRM process is triggered when new systems or changes to existing systems related to aviation activities are being considered. For example, changes to operations could include the addition of new routes, opening or closing of line stations, addition or change of contractual arrangements for services, addition of new fleets or major modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS), or change in authorizations to a repair station’s ratings.
3.4.1.3.3 The SRM process is not triggered solely by major changes to a system; it is triggered by any aviation-safety-related revision of an existing system.
3.4.1.3.4 The SRM process is also triggered when any aviation-related change in the operating environment or ineffective risk controls are identified by the safety assurance processes.
3.4.1.3.5 Aviation organizations must document (where required) when the SRM processes are to be implemented based on the requirements in § 5.51. While it is not the intent to require the application of SRM processes and procedures to activities that are not related to the aviation operations, some aviation organizations may elect to add additional triggering events.
3.4.1.3.6 International Civil Aviation Organization (ICAO) Annex 19, Safety Management, requires hazard identification and SRM to be initiated using reactive and proactive methods. As discussed in § 5.51, proactive requirements are initiated when an organization implements new systems, revises existing systems, or develops operational procedures. The reactive trigger is hazards or ineffective risk controls identified through the organization’s safety assurance processes.
3.4.1.3.7 A question you might wonder is “Do I have to do SRM if I update a manual?”
The answer is yes; any change to existing processes or revision to existing systems (the manual is part of your aviation organization’s system) requires SRM to be initiated. Now, you might be thinking “Do I have to do the entire SRM process?” The answer to that question is that it depends. If you are just updating the organizational chart due to promotions and turnover, then probably not. You would describe the system and then assess it for hazards. If no hazards are identified by updating the organizational chart, then the process is complete. Depending on how the process is written, there could be a simple check mark that indicates no hazards identified on the organization’s SRM tracking document. For an example, see Appendix B, Sample Safety Risk Management (SRM) Worksheets, Figure B-1, Safety Risk Management Triggering Conditions and Summary.
3.4.2 S ystem Analysis .
3.4.2.1 References. Section 5.53(a) and (b).
3-28
3.4.2.2 Part 5 Requirement.
§ 5.53(a) and (b), System analysis and hazard identification.
(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system’s operating environment.
(3) An outline of the system’s processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
(5) The interfaces of the system.
3.4.2.3 Discussion. System analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by defining and analyzing the system. This can be as simple as creating a flowchart of the system or writing a short narrative to help the aviation organization understand the interfaces with the processes and procedures that are affected by the change.
3.4.2.3.1 Aviation organizations must document processes and procedures defining how the process owners will conduct a system analysis and hazard identification as part of their SRM analysis.
3.4.2.3.2 Documentation should provide sufficient procedural guidance to aid the process owners in defining the function and purpose of the system. When accomplishing this step, all interfaces with the various divisions, internal and external to the process being evaluated, need to be considered. Interfaces could be internal or external to the organization and the system being evaluated. An SMS must ensure an organization’s safety is not adversely affected by the products and services external organizations provide. Some examples of external interfaces could be maintenance providers, contract flight instructors and pilots, ground handlers, refuellers, and airport services.
In other words, if you are analyzing a change in engine inspection requirements, do not worry about analyzing the aircraft landing gear unless it is directly affected by the task being changed.
3.4.2.3.3 Good documentation provides sufficient guidance to aid the process owners in defining the personnel, equipment, and facilities necessary for safe operation of the equipment. It also ensures consistent results when different process owners perform SRM.
3-29
3.4.2.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.2.4.1 The system analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers, such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them. Aviation organizations on the higher end of the spectrum of size or complexity may develop their system analysis at multiple organizational levels (e.g., corporate, division, or department) and be facilitated by the safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.2.4.2 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where the aviation organization will tailor the processes to their size, complexity, and operating environment.
3.4.2.4.3 Aviation organizations should consider how their service providers and contractors interact with the organization. Identify the areas where risk could be introduced into the operations.
3.4.2.5 System Analysis Example. Flyslow Aviation is considering the addition of a new aircraft (or a fleet of aircraft) for operations to meet organizational or corporate goals. Several organizational systems would be affected (e.g., flight operations, maintenance, station, ground, etc.). As part of the examination of the flight operations system, Flyslow Aviation needs to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, employee representation participation, and several other areas. This is a process normally done as part of business activities.
3.4.2.5.1 The system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to the fleet, Flyslow Aviation identifies the pilot training system as one of the affected systems and the need for additional activities and resources necessary for pilot training to operate the additional aircraft. These resources may include simulators, training curriculum, training aids, and instructors. A repair station might be adding a rating or changing from paper to digital manual systems and need to update their revision tracking process and training for employees.
3.4.2.5.2 Although Flyslow Aviation has to consider many systems and procedures when considering larger, systemic changes, simpler changes, such as a change in a single procedure (e.g., arming cabin doors prior to pushback), would only
3-30 have to consider the elements of the system that would be affected by the change. The system analysis process frequently includes representatives from management, safety staff, SMEs, employees, and representation groups
(e.g., pilots and mechanics) in workgroups, such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process.
3.4.2.5.3 Flyslow Aviation records the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider. One example is the Web-Based Application Tool (WBAT)6 (see Appendix H, References and Additional Information).
6 WBAT is a federally developed and funded software system that may be used to assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which supports the aviation organization’s implementation of SMS.
3.4.2.5.4 O utput s of the system analysis, which define the function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, and the personnel, equipment, and facilities necessary for the operation of the system, should be retained. Appendix B provides an example of a set of SRM worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBATs.
3.4.3 Hazard Identification.
3.4.3.1 References. Sections 5.23(a)(2)(i), 5.25(c)(2), and 5.53(c).
3.4.3.2 Part 5 Requirement.
§ 5.53(c), System analysis and hazard identification.
(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.
3.4.3.3 Discussion. The hazard identification process flows from the system analysis.
In hazard identification, the process owner would ask, “What could go wrong with the processes under typical or abnormal operational conditions that could cause an incident or an accident?”
3.4.3.3.1 Most often, the same individuals or groups conducting the system analysis process (safety committees, safety roundtables, etc.) would conduct hazard identification. Process owners use their experience, FAA requirements, manufacturers’ technical data, and knowledge of the operation to identify hazards. For example, a newly modified component of an aircraft cabin door
3-31 might require new arming and disarming procedures by flight attendants (F/A) and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. Hazards could include the effectiveness of new procedure training, employees missing training or failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc.
Although identification of every conceivable hazard is unlikely, process owners are expected to exercise due diligence in identifying hazards that could foreseeably lead to an aircraft incident or accident.
3.4.3.3.2 There are many risk assessment models available that may be used to identify hazards based on the system analysis. It is not a requirement that one specific model be integrated into the aviation organization’s documentation. The model or method used is the aviation organization’s choice. This will ensure process owners in the various divisions are performing the system analysis the same way. This leads to consistency within the organization.
3.4.3.3.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management may vary based on the size and complexity of the organization. For example, it may be accomplished by using worksheets completed manually, computer spreadsheets, or commercial software.
3.4.3.3.4 The output of hazard identification could be recorded in a simple recording medium, such as a spreadsheet, paper files, or a third-party software program or provider. One example is WBAT. The WBAT platform (maintained by Universal Technical Resource Services, Inc. (UTRS)) is a web-based system that supports all aspects of a complete SMS, including safety policy, SRM, safety assurance, safety promotion, and SMS recordkeeping and documentation. Any organization can utilize the WBAT platform to collect, process, and analyze safety reports, conduct audits, and identify and manage risk. Additional information is available in Appendix H. Outputs could consist of identified or potential hazards.
3.4.3.4 Im plementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on the aviation organization’s size or complexity. The following are examples only and are not the only ways the requirements could be met:
3.4.3.4.1 Hazard identification could be performed by the owner/manager (accountable executive) and/or another employee(s), often as part of the system analysis.
Aviation organizations on the higher end of the size or complexity spectrum may perform hazard identification at multiple organizational levels
(e.g., corporate, division, or department levels). It could be facilitated by a safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3-32
3.4.4 Safety Risk Analysis.
3.4.4.1 References. Sections 5.25(c)(2) and 5.55(a).
3.4.4.2 Part 5 Requirement.
§ 5.55(a), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
3.4.4.3 Discussion. For each identified hazard, an aviation organization should define the potential for injury and damage that may result from an incident or accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, process owners need to define the likelihood of occurrence of an incident or accident and the severity of the injury or damage that may result from the aircraft incident or accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential consequence (accident or incident) related to the hazard.
3.4.4.3.1 The process owner conducting risk analysis also should consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, that could result in an incident or accident? Has the organization recently changed equipment that employees must use, the procedures for using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For example, if, in the process of a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that could lead to errors?
3.4.4.3.2 This is one reason why the system analysis is an essential foundational step in risk management. If the risk analysis is not based on a thorough understanding of the system, process owners may miss important details that could cause the system to fail. The knowledge gained in the system analysis and subsequent risk analysis will be used to develop a mitigating strategy. Risk controls will target the conditions the aviation organization thinks have caused or will cause an incident or accident and affect the severity or likelihood.
3.4.4.3.3 Risk analyses in operational contexts are often based on the expertise and expert judgment of the process owners but should also use data from the aviation organization’s own experience or from others in the industry where available. A review of accident statistics, failure data, error data (e.g., runway incursion reports or information from the National Aeronautics and Space
3-33 Administration’s (NASA) Aviation Safety Reporting System (ASRS)), or equipment reliability data may help in determining the likelihood.
3.4.4.3.4 The type of consequence (e.g., error, failure, accident, or incident) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often lead only to aircraft damage.
3.4.4.3.5 Aviation organizations should define a process for analyzing risk associated with the hazards identified in the system analysis. This can be accomplished utilizing a risk matrix that looks at severity and likelihood. Likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. A risk matrix may be qualitative or quantitative in nature or contain both types of scales. It is important to ensure that all process owners are trained in the use of the defined tool to ensure consistent results throughout the aviation organization. The important thing is do not try to over engineer the risk matrix or process for analyzing risk. Use what works best for your organization.
3.4.4.3.6 Organizations should not assume the worst possible outcome, loss of life, or destruction of property possible in an event when determining severity. The best estimate of severity should be based on reasonable expert judgment.
Severity and likelihood of various outcomes could be recorded in a simple recording medium, such as a notebook, basic desktop software, or third-party software program or provider (e.g., WBAT).
3.4.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.4.4.1 In smaller or lower complexity aviation organizations, risk analysis could be performed by the owner/manager (accountable executive) and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk assessment, and risk control. Aviation organizations on the higher end of the size or complexity spectrum may perform the risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The aviation organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.5 S afety Risk Assessment .
3.4.5.1 References. Section 5.55(b).
3-34
3.4.5.2 Part 5 Requirement.
§ 5.55(b), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
3.4.5.3 Discussion. Once the risk is analyzed, the process owner must determine whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides aviation organizations with a way to integrate the effect of severity of the outcome and the probability of occurrence. Aviation organizations are then able to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
3.4.5.3.1 If a risk matrix is used, the aviation organization should develop criteria for the severity and likelihood that are appropriate for their type of operations and their operational environment. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. Different types of aircraft operated, their operating environment, and their relative values would dictate different definitions of risk severity between aviation organizations.
Likewise, the method that the aviation organization uses to estimate likelihood will have an effect on how likelihood levels are defined. If the aviation organization prefers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Table 3-1 below depicts a sample risk matrix.
Table 3-1. Sample Risk Matrix Risk Likelihood Risk Severity Catastrophic Hazardous Major Minor Negligible Frequent High (red) High (red) High (red) Medium (yellow) Medium (yellow) Occasional High (red) High (red) Medium (yellow) Medium (yellow) Medium (yellow) Remote High (red) Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Improbable Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Low (green) Extremely Improbable Low (green) Low (green) Low (green) Low (green) Low (green)