3-25 position description so employees required to assume these duties are able to understand the additional duties and responsibilities. As proxies are identified to step into these roles, organizations must ensure they are trained and competent to perform the additional duties of SMS risk acceptance.
3.3.5.3.3 Coordination of ERPs with the ERPs of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous materials (HAZMAT) authorities. Many organizations already have ERPs that may be used to fulfill this requirement.
3.3.5.4 Implementation Strategies. Consider whether the ERP covers the likely emergencies and has been coordinated with other organizations that may be affected and with the emergency services. A small, noncomplex organization’s ERP might consist of a checklist of simple steps involving who to call when and what information to impart and a regularly updated list of contact details. When considering the ERP, succession planning must be considered. If a member of management is removed from their position to address an emergency, there should be another individual trained and competent to step into the position to ensure the organization continues to function as designed. This could even take place when the individual is away for other reasons. Common sense must prevail; processes need to be workable and tailored for the operation. In other words, do not over think it!
3.3.5.5 Considerations for Small and Single-Individual Organizations.
3.3.5.5.1 Single-pilot operations and single-individual organizations pose unique situations when implementing an SMS. As a result of these factors, the following regulatory section is excepted from the implementation requirements for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of aircraft:
Section 5.27: Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
3.3.5.5.2 Effective communication of safety information is important, even in a single-pilot organization. In an organization with a single pilot or single individual, the communication focus may be outside the organization
(e.g., regular communication with aviation system stakeholders, industry associations, clients, the FAA, and other organizations). Interfacing with maintenance, fixed-based operators, and flight followers (if one is used) all
3-26 require communication so they are aware of the aviation organization’s activities. This will aid in scheduling support activities as well as having someone keep an eye out in case plans do not go as predicted. In a single-pilot or single-individual organization, this could be met by simply filing flight plans with air traffic control (ATC) or leaving an envelope with emergency contact information at the local Fixed-Base Operator (FBO) if the aircraft does not return on time.
3.4 Subpart C, S afety Risk Management.
3.4.1 Applicability: Requirements to Apply SRM.
3.4.1.1 References. Section 5.51.
3.4.1.2 Part 5 Requirement.
§ 5.51, Applicability.
Any person required to have an SMS under this part must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.
3.4.1.3 Discussion. To know when an SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets that are directly related to the organization’s aviation safety activities. Examples of broad-based systems could include:
• Flight operations,
• Operational control (dispatch/flight following),
• Maintenance and inspection,
• Cabin safety,
• Ground handling and servicing,
• Cargo handling, and
• Training.
3.4.1.3.1 Within an aviation organization’s systems, there are subsystems related to aviation safety. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, component shops, deicing, fueling, aircraft fleet, ground operations, and HAZMAT training.
3-27
3.4.1.3.2 Under § 5.51, the SRM process is triggered when new systems or changes to existing systems related to aviation activities are being considered. For example, changes to operations could include the addition of new routes, opening or closing of line stations, addition or change of contractual arrangements for services, addition of new fleets or major modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS), or change in authorizations to a repair station’s ratings.
3.4.1.3.3 The SRM process is not triggered solely by major changes to a system; it is triggered by any aviation-safety-related revision of an existing system.
3.4.1.3.4 The SRM process is also triggered when any aviation-related change in the operating environment or ineffective risk controls are identified by the safety assurance processes.
3.4.1.3.5 Aviation organizations must document (where required) when the SRM processes are to be implemented based on the requirements in § 5.51. While it is not the intent to require the application of SRM processes and procedures to activities that are not related to the aviation operations, some aviation organizations may elect to add additional triggering events.
3.4.1.3.6 International Civil Aviation Organization (ICAO) Annex 19, Safety Management, requires hazard identification and SRM to be initiated using reactive and proactive methods. As discussed in § 5.51, proactive requirements are initiated when an organization implements new systems, revises existing systems, or develops operational procedures. The reactive trigger is hazards or ineffective risk controls identified through the organization’s safety assurance processes.
3.4.1.3.7 A question you might wonder is “Do I have to do SRM if I update a manual?”
The answer is yes; any change to existing processes or revision to existing systems (the manual is part of your aviation organization’s system) requires SRM to be initiated. Now, you might be thinking “Do I have to do the entire SRM process?” The answer to that question is that it depends. If you are just updating the organizational chart due to promotions and turnover, then probably not. You would describe the system and then assess it for hazards. If no hazards are identified by updating the organizational chart, then the process is complete. Depending on how the process is written, there could be a simple check mark that indicates no hazards identified on the organization’s SRM tracking document. For an example, see Appendix B, Sample Safety Risk Management (SRM) Worksheets, Figure B-1, Safety Risk Management Triggering Conditions and Summary.
3.4.2 S ystem Analysis .
3.4.2.1 References. Section 5.53(a) and (b).
3-28
3.4.2.2 Part 5 Requirement.
§ 5.53(a) and (b), System analysis and hazard identification.
(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system’s operating environment.
(3) An outline of the system’s processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
(5) The interfaces of the system.
3.4.2.3 Discussion. System analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by defining and analyzing the system. This can be as simple as creating a flowchart of the system or writing a short narrative to help the aviation organization understand the interfaces with the processes and procedures that are affected by the change.
3.4.2.3.1 Aviation organizations must document processes and procedures defining how the process owners will conduct a system analysis and hazard identification as part of their SRM analysis.
3.4.2.3.2 Documentation should provide sufficient procedural guidance to aid the process owners in defining the function and purpose of the system. When accomplishing this step, all interfaces with the various divisions, internal and external to the process being evaluated, need to be considered. Interfaces could be internal or external to the organization and the system being evaluated. An SMS must ensure an organization’s safety is not adversely affected by the products and services external organizations provide. Some examples of external interfaces could be maintenance providers, contract flight instructors and pilots, ground handlers, refuellers, and airport services.
In other words, if you are analyzing a change in engine inspection requirements, do not worry about analyzing the aircraft landing gear unless it is directly affected by the task being changed.
3.4.2.3.3 Good documentation provides sufficient guidance to aid the process owners in defining the personnel, equipment, and facilities necessary for safe operation of the equipment. It also ensures consistent results when different process owners perform SRM.
3-29
3.4.2.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.2.4.1 The system analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers, such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them. Aviation organizations on the higher end of the spectrum of size or complexity may develop their system analysis at multiple organizational levels (e.g., corporate, division, or department) and be facilitated by the safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.2.4.2 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where the aviation organization will tailor the processes to their size, complexity, and operating environment.
3.4.2.4.3 Aviation organizations should consider how their service providers and contractors interact with the organization. Identify the areas where risk could be introduced into the operations.
3.4.2.5 System Analysis Example. Flyslow Aviation is considering the addition of a new aircraft (or a fleet of aircraft) for operations to meet organizational or corporate goals. Several organizational systems would be affected (e.g., flight operations, maintenance, station, ground, etc.). As part of the examination of the flight operations system, Flyslow Aviation needs to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, employee representation participation, and several other areas. This is a process normally done as part of business activities.
3.4.2.5.1 The system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to the fleet, Flyslow Aviation identifies the pilot training system as one of the affected systems and the need for additional activities and resources necessary for pilot training to operate the additional aircraft. These resources may include simulators, training curriculum, training aids, and instructors. A repair station might be adding a rating or changing from paper to digital manual systems and need to update their revision tracking process and training for employees.
3.4.2.5.2 Although Flyslow Aviation has to consider many systems and procedures when considering larger, systemic changes, simpler changes, such as a change in a single procedure (e.g., arming cabin doors prior to pushback), would only
3-30 have to consider the elements of the system that would be affected by the change. The system analysis process frequently includes representatives from management, safety staff, SMEs, employees, and representation groups
(e.g., pilots and mechanics) in workgroups, such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process.
3.4.2.5.3 Flyslow Aviation records the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider. One example is the Web-Based Application Tool (WBAT)6 (see Appendix H, References and Additional Information).
6 WBAT is a federally developed and funded software system that may be used to assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which supports the aviation organization’s implementation of SMS.
3.4.2.5.4 O utput s of the system analysis, which define the function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, and the personnel, equipment, and facilities necessary for the operation of the system, should be retained. Appendix B provides an example of a set of SRM worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBATs.
3.4.3 Hazard Identification.
3.4.3.1 References. Sections 5.23(a)(2)(i), 5.25(c)(2), and 5.53(c).
3.4.3.2 Part 5 Requirement.
§ 5.53(c), System analysis and hazard identification.
(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.
3.4.3.3 Discussion. The hazard identification process flows from the system analysis.
In hazard identification, the process owner would ask, “What could go wrong with the processes under typical or abnormal operational conditions that could cause an incident or an accident?”
3.4.3.3.1 Most often, the same individuals or groups conducting the system analysis process (safety committees, safety roundtables, etc.) would conduct hazard identification. Process owners use their experience, FAA requirements, manufacturers’ technical data, and knowledge of the operation to identify hazards. For example, a newly modified component of an aircraft cabin door
3-31 might require new arming and disarming procedures by flight attendants (F/A) and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. Hazards could include the effectiveness of new procedure training, employees missing training or failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc.
Although identification of every conceivable hazard is unlikely, process owners are expected to exercise due diligence in identifying hazards that could foreseeably lead to an aircraft incident or accident.
3.4.3.3.2 There are many risk assessment models available that may be used to identify hazards based on the system analysis. It is not a requirement that one specific model be integrated into the aviation organization’s documentation. The model or method used is the aviation organization’s choice. This will ensure process owners in the various divisions are performing the system analysis the same way. This leads to consistency within the organization.
3.4.3.3.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management may vary based on the size and complexity of the organization. For example, it may be accomplished by using worksheets completed manually, computer spreadsheets, or commercial software.
3.4.3.3.4 The output of hazard identification could be recorded in a simple recording medium, such as a spreadsheet, paper files, or a third-party software program or provider. One example is WBAT. The WBAT platform (maintained by Universal Technical Resource Services, Inc. (UTRS)) is a web-based system that supports all aspects of a complete SMS, including safety policy, SRM, safety assurance, safety promotion, and SMS recordkeeping and documentation. Any organization can utilize the WBAT platform to collect, process, and analyze safety reports, conduct audits, and identify and manage risk. Additional information is available in Appendix H. Outputs could consist of identified or potential hazards.
3.4.3.4 Im plementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on the aviation organization’s size or complexity. The following are examples only and are not the only ways the requirements could be met:
3.4.3.4.1 Hazard identification could be performed by the owner/manager (accountable executive) and/or another employee(s), often as part of the system analysis.
Aviation organizations on the higher end of the size or complexity spectrum may perform hazard identification at multiple organizational levels
(e.g., corporate, division, or department levels). It could be facilitated by a safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3-32
3.4.4 Safety Risk Analysis.
3.4.4.1 References. Sections 5.25(c)(2) and 5.55(a).
3.4.4.2 Part 5 Requirement.
§ 5.55(a), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
3.4.4.3 Discussion. For each identified hazard, an aviation organization should define the potential for injury and damage that may result from an incident or accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, process owners need to define the likelihood of occurrence of an incident or accident and the severity of the injury or damage that may result from the aircraft incident or accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential consequence (accident or incident) related to the hazard.
3.4.4.3.1 The process owner conducting risk analysis also should consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, that could result in an incident or accident? Has the organization recently changed equipment that employees must use, the procedures for using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For example, if, in the process of a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that could lead to errors?
3.4.4.3.2 This is one reason why the system analysis is an essential foundational step in risk management. If the risk analysis is not based on a thorough understanding of the system, process owners may miss important details that could cause the system to fail. The knowledge gained in the system analysis and subsequent risk analysis will be used to develop a mitigating strategy. Risk controls will target the conditions the aviation organization thinks have caused or will cause an incident or accident and affect the severity or likelihood.
3.4.4.3.3 Risk analyses in operational contexts are often based on the expertise and expert judgment of the process owners but should also use data from the aviation organization’s own experience or from others in the industry where available. A review of accident statistics, failure data, error data (e.g., runway incursion reports or information from the National Aeronautics and Space
3-33 Administration’s (NASA) Aviation Safety Reporting System (ASRS)), or equipment reliability data may help in determining the likelihood.
3.4.4.3.4 The type of consequence (e.g., error, failure, accident, or incident) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often lead only to aircraft damage.
3.4.4.3.5 Aviation organizations should define a process for analyzing risk associated with the hazards identified in the system analysis. This can be accomplished utilizing a risk matrix that looks at severity and likelihood. Likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. A risk matrix may be qualitative or quantitative in nature or contain both types of scales. It is important to ensure that all process owners are trained in the use of the defined tool to ensure consistent results throughout the aviation organization. The important thing is do not try to over engineer the risk matrix or process for analyzing risk. Use what works best for your organization.
3.4.4.3.6 Organizations should not assume the worst possible outcome, loss of life, or destruction of property possible in an event when determining severity. The best estimate of severity should be based on reasonable expert judgment.
Severity and likelihood of various outcomes could be recorded in a simple recording medium, such as a notebook, basic desktop software, or third-party software program or provider (e.g., WBAT).
3.4.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.4.4.1 In smaller or lower complexity aviation organizations, risk analysis could be performed by the owner/manager (accountable executive) and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk assessment, and risk control. Aviation organizations on the higher end of the size or complexity spectrum may perform the risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The aviation organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.5 S afety Risk Assessment .
3.4.5.1 References. Section 5.55(b).
3-34
3.4.5.2 Part 5 Requirement.
§ 5.55(b), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
3.4.5.3 Discussion. Once the risk is analyzed, the process owner must determine whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides aviation organizations with a way to integrate the effect of severity of the outcome and the probability of occurrence. Aviation organizations are then able to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
3.4.5.3.1 If a risk matrix is used, the aviation organization should develop criteria for the severity and likelihood that are appropriate for their type of operations and their operational environment. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. Different types of aircraft operated, their operating environment, and their relative values would dictate different definitions of risk severity between aviation organizations.
Likewise, the method that the aviation organization uses to estimate likelihood will have an effect on how likelihood levels are defined. If the aviation organization prefers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Table 3-1 below depicts a sample risk matrix.
Table 3-1. Sample Risk Matrix Risk Likelihood Risk Severity Catastrophic Hazardous Major Minor Negligible Frequent High (red) High (red) High (red) Medium (yellow) Medium (yellow) Occasional High (red) High (red) Medium (yellow) Medium (yellow) Medium (yellow) Remote High (red) Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Improbable Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Low (green) Extremely Improbable Low (green) Low (green) Low (green) Low (green) Low (green)
3-35
3.4.5.3.2 Risk assessment is based on the process owners’ judgment, experience, and input. If the process owner determines the risk is acceptable, the SRM process would be complete at this point. The system may already be in operation or placed into operation and monitored in the safety assurance process. If the process owner decides the risk is not acceptable, the SRM process continues with the development of risk controls.
3.4.5.3.3 Risk assessments must include the levels of management with the authority to make risk acceptance decisions to decide what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispatching a flight that presents a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For large-scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance decisions will depend on the scope of the proposed change to the operation and the level of risk presented to the aviation organization.
3.4.5.3.4 It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. The method utilized is not important, but the process owners must be knowledgeable on how to utilize the aviation organization’s documented processes and procedures.
3.4.5.3.5 The outputs of this process could be recorded on paper or via an electronic medium, such as a third-party software program or provider. One example is WBAT.
3.4.5.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.5.4.1 In a small or lower complexity aviation organization, risk assessments could be performed by the owner/manager (accountable executive) and/or other employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. While similar to a Flight Risk Assessment Tool (FRAT), the risk assessment required by § 5.55 is to determine if the residual and associated risks to the process are acceptable.
Quite often, a risk matrix is utilized to determine if any residual risk or substitute risk are acceptable to the aviation organization. A FRAT would be used to determine if conditions are acceptable for a specific flight to commence. It is important not to confuse the purpose of these two distinctly different tools and their application. Aviation organizations on the higher end of the size or complexity spectrum may coordinate their SRM processes across the divisional and geographic units of the organization to ensure
3-36 integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems.
3.4.5.4.2 Many organizations have standing committees made up of senior managers, who are the decisionmakers, supported by working groups of technical personnel. For example, the accountable executive could make organization-level decisions, and department managers could make the decisions for their process areas. A risk matrix may be useful to determine who in the organization makes the risk decision, whether the risk is acceptable, or what the priority is for mitigating risk.
3.4.6 S afety Risk Control .
3.4.6.1 References. Section 5.55(c) and (d).
3.4.6.2 Part 5 Requirement.
§ 5.55(c) and (d), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.
(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.
3.4.6.3 Discussion. Aviation organizations must document their processes and procedures for how risk controls should be developed/designed to control identified hazards. The method used should be documented by the aviation organization, and process owners must be trained to produce consistent results. A typical risk control process is the acronym META, which stands for:
Mitigate the risk; Eliminate the risk; Transfer the risk; or Accept the risk.
While the method described here is an example, aviation organizations are encouraged to develop or implement any method that works for their organizational size and complexity.
3.4.6.3.1 After process owners understand the hazards and associated risks, if they determine that the risk is unacceptable, they must design risk controls to mitigate risks to an acceptable level by using a risk assessment process, as specified in § 5.55(b). Examples of where new risk controls may be applied include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any number of other system changes. In short, risk controls could include anything that would reduce the likelihood or severity of a potential incident/accident.
3.4.6.3.2 The aviation organization must develop procedures requiring a system analysis and hazard identification after the proposed risk control is developed.