3-29
3.4.2.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.2.4.1 The system analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers, such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them. Aviation organizations on the higher end of the spectrum of size or complexity may develop their system analysis at multiple organizational levels (e.g., corporate, division, or department) and be facilitated by the safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.2.4.2 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where the aviation organization will tailor the processes to their size, complexity, and operating environment.
3.4.2.4.3 Aviation organizations should consider how their service providers and contractors interact with the organization. Identify the areas where risk could be introduced into the operations.
3.4.2.5 System Analysis Example. Flyslow Aviation is considering the addition of a new aircraft (or a fleet of aircraft) for operations to meet organizational or corporate goals. Several organizational systems would be affected (e.g., flight operations, maintenance, station, ground, etc.). As part of the examination of the flight operations system, Flyslow Aviation needs to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, employee representation participation, and several other areas. This is a process normally done as part of business activities.
3.4.2.5.1 The system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to the fleet, Flyslow Aviation identifies the pilot training system as one of the affected systems and the need for additional activities and resources necessary for pilot training to operate the additional aircraft. These resources may include simulators, training curriculum, training aids, and instructors. A repair station might be adding a rating or changing from paper to digital manual systems and need to update their revision tracking process and training for employees.
3.4.2.5.2 Although Flyslow Aviation has to consider many systems and procedures when considering larger, systemic changes, simpler changes, such as a change in a single procedure (e.g., arming cabin doors prior to pushback), would only
3-30 have to consider the elements of the system that would be affected by the change. The system analysis process frequently includes representatives from management, safety staff, SMEs, employees, and representation groups
(e.g., pilots and mechanics) in workgroups, such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process.
3.4.2.5.3 Flyslow Aviation records the outputs of their system analysis in a simple recording medium, such as a worksheet or a notebook, a common desktop software, or a third-party software program or provider. One example is the Web-Based Application Tool (WBAT)6 (see Appendix H, References and Additional Information).
6 WBAT is a federally developed and funded software system that may be used to assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which supports the aviation organization’s implementation of SMS.
3.4.2.5.4 O utput s of the system analysis, which define the function and purpose of the system, the system’s operating environment, an outline of the system’s processes and procedures, and the personnel, equipment, and facilities necessary for the operation of the system, should be retained. Appendix B provides an example of a set of SRM worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBATs.
3.4.3 Hazard Identification.
3.4.3.1 References. Sections 5.23(a)(2)(i), 5.25(c)(2), and 5.53(c).
3.4.3.2 Part 5 Requirement.
§ 5.53(c), System analysis and hazard identification.
(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.
3.4.3.3 Discussion. The hazard identification process flows from the system analysis.
In hazard identification, the process owner would ask, “What could go wrong with the processes under typical or abnormal operational conditions that could cause an incident or an accident?”
3.4.3.3.1 Most often, the same individuals or groups conducting the system analysis process (safety committees, safety roundtables, etc.) would conduct hazard identification. Process owners use their experience, FAA requirements, manufacturers’ technical data, and knowledge of the operation to identify hazards. For example, a newly modified component of an aircraft cabin door
3-31 might require new arming and disarming procedures by flight attendants (F/A) and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. Hazards could include the effectiveness of new procedure training, employees missing training or failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc.
Although identification of every conceivable hazard is unlikely, process owners are expected to exercise due diligence in identifying hazards that could foreseeably lead to an aircraft incident or accident.
3.4.3.3.2 There are many risk assessment models available that may be used to identify hazards based on the system analysis. It is not a requirement that one specific model be integrated into the aviation organization’s documentation. The model or method used is the aviation organization’s choice. This will ensure process owners in the various divisions are performing the system analysis the same way. This leads to consistency within the organization.
3.4.3.3.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store, communicate, and track aspects associated with risk management may vary based on the size and complexity of the organization. For example, it may be accomplished by using worksheets completed manually, computer spreadsheets, or commercial software.
3.4.3.3.4 The output of hazard identification could be recorded in a simple recording medium, such as a spreadsheet, paper files, or a third-party software program or provider. One example is WBAT. The WBAT platform (maintained by Universal Technical Resource Services, Inc. (UTRS)) is a web-based system that supports all aspects of a complete SMS, including safety policy, SRM, safety assurance, safety promotion, and SMS recordkeeping and documentation. Any organization can utilize the WBAT platform to collect, process, and analyze safety reports, conduct audits, and identify and manage risk. Additional information is available in Appendix H. Outputs could consist of identified or potential hazards.
3.4.3.4 Im plementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on the aviation organization’s size or complexity. The following are examples only and are not the only ways the requirements could be met:
3.4.3.4.1 Hazard identification could be performed by the owner/manager (accountable executive) and/or another employee(s), often as part of the system analysis.
Aviation organizations on the higher end of the size or complexity spectrum may perform hazard identification at multiple organizational levels
(e.g., corporate, division, or department levels). It could be facilitated by a safety department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
3-32
3.4.4 Safety Risk Analysis.
3.4.4.1 References. Sections 5.25(c)(2) and 5.55(a).
3.4.4.2 Part 5 Requirement.
§ 5.55(a), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
3.4.4.3 Discussion. For each identified hazard, an aviation organization should define the potential for injury and damage that may result from an incident or accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, process owners need to define the likelihood of occurrence of an incident or accident and the severity of the injury or damage that may result from the aircraft incident or accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential consequence (accident or incident) related to the hazard.
3.4.4.3.1 The process owner conducting risk analysis also should consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, that could result in an incident or accident? Has the organization recently changed equipment that employees must use, the procedures for using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For example, if, in the process of a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that could lead to errors?
3.4.4.3.2 This is one reason why the system analysis is an essential foundational step in risk management. If the risk analysis is not based on a thorough understanding of the system, process owners may miss important details that could cause the system to fail. The knowledge gained in the system analysis and subsequent risk analysis will be used to develop a mitigating strategy. Risk controls will target the conditions the aviation organization thinks have caused or will cause an incident or accident and affect the severity or likelihood.
3.4.4.3.3 Risk analyses in operational contexts are often based on the expertise and expert judgment of the process owners but should also use data from the aviation organization’s own experience or from others in the industry where available. A review of accident statistics, failure data, error data (e.g., runway incursion reports or information from the National Aeronautics and Space
3-33 Administration’s (NASA) Aviation Safety Reporting System (ASRS)), or equipment reliability data may help in determining the likelihood.
3.4.4.3.4 The type of consequence (e.g., error, failure, accident, or incident) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often lead only to aircraft damage.
3.4.4.3.5 Aviation organizations should define a process for analyzing risk associated with the hazards identified in the system analysis. This can be accomplished utilizing a risk matrix that looks at severity and likelihood. Likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. A risk matrix may be qualitative or quantitative in nature or contain both types of scales. It is important to ensure that all process owners are trained in the use of the defined tool to ensure consistent results throughout the aviation organization. The important thing is do not try to over engineer the risk matrix or process for analyzing risk. Use what works best for your organization.
3.4.4.3.6 Organizations should not assume the worst possible outcome, loss of life, or destruction of property possible in an event when determining severity. The best estimate of severity should be based on reasonable expert judgment.
Severity and likelihood of various outcomes could be recorded in a simple recording medium, such as a notebook, basic desktop software, or third-party software program or provider (e.g., WBAT).
3.4.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.4.4.1 In smaller or lower complexity aviation organizations, risk analysis could be performed by the owner/manager (accountable executive) and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk assessment, and risk control. Aviation organizations on the higher end of the size or complexity spectrum may perform the risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The aviation organization might have standing committees of SMEs and stakeholders participating at various levels.
3.4.5 S afety Risk Assessment .
3.4.5.1 References. Section 5.55(b).
3-34
3.4.5.2 Part 5 Requirement.
§ 5.55(b), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
3.4.5.3 Discussion. Once the risk is analyzed, the process owner must determine whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides aviation organizations with a way to integrate the effect of severity of the outcome and the probability of occurrence. Aviation organizations are then able to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
3.4.5.3.1 If a risk matrix is used, the aviation organization should develop criteria for the severity and likelihood that are appropriate for their type of operations and their operational environment. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. Different types of aircraft operated, their operating environment, and their relative values would dictate different definitions of risk severity between aviation organizations.
Likewise, the method that the aviation organization uses to estimate likelihood will have an effect on how likelihood levels are defined. If the aviation organization prefers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Table 3-1 below depicts a sample risk matrix.
Table 3-1. Sample Risk Matrix Risk Likelihood Risk Severity Catastrophic Hazardous Major Minor Negligible Frequent High (red) High (red) High (red) Medium (yellow) Medium (yellow) Occasional High (red) High (red) Medium (yellow) Medium (yellow) Medium (yellow) Remote High (red) Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Improbable Medium (yellow) Medium (yellow) Medium (yellow) Low (green) Low (green) Extremely Improbable Low (green) Low (green) Low (green) Low (green) Low (green)
3-35
3.4.5.3.2 Risk assessment is based on the process owners’ judgment, experience, and input. If the process owner determines the risk is acceptable, the SRM process would be complete at this point. The system may already be in operation or placed into operation and monitored in the safety assurance process. If the process owner decides the risk is not acceptable, the SRM process continues with the development of risk controls.
3.4.5.3.3 Risk assessments must include the levels of management with the authority to make risk acceptance decisions to decide what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispatching a flight that presents a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For large-scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance decisions will depend on the scope of the proposed change to the operation and the level of risk presented to the aviation organization.
3.4.5.3.4 It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. The method utilized is not important, but the process owners must be knowledgeable on how to utilize the aviation organization’s documented processes and procedures.
3.4.5.3.5 The outputs of this process could be recorded on paper or via an electronic medium, such as a third-party software program or provider. One example is WBAT.
3.4.5.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.5.4.1 In a small or lower complexity aviation organization, risk assessments could be performed by the owner/manager (accountable executive) and/or other employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. While similar to a Flight Risk Assessment Tool (FRAT), the risk assessment required by § 5.55 is to determine if the residual and associated risks to the process are acceptable.
Quite often, a risk matrix is utilized to determine if any residual risk or substitute risk are acceptable to the aviation organization. A FRAT would be used to determine if conditions are acceptable for a specific flight to commence. It is important not to confuse the purpose of these two distinctly different tools and their application. Aviation organizations on the higher end of the size or complexity spectrum may coordinate their SRM processes across the divisional and geographic units of the organization to ensure
3-36 integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems.
3.4.5.4.2 Many organizations have standing committees made up of senior managers, who are the decisionmakers, supported by working groups of technical personnel. For example, the accountable executive could make organization-level decisions, and department managers could make the decisions for their process areas. A risk matrix may be useful to determine who in the organization makes the risk decision, whether the risk is acceptable, or what the priority is for mitigating risk.
3.4.6 S afety Risk Control .
3.4.6.1 References. Section 5.55(c) and (d).
3.4.6.2 Part 5 Requirement.
§ 5.55(c) and (d), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.
(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.
3.4.6.3 Discussion. Aviation organizations must document their processes and procedures for how risk controls should be developed/designed to control identified hazards. The method used should be documented by the aviation organization, and process owners must be trained to produce consistent results. A typical risk control process is the acronym META, which stands for:
Mitigate the risk; Eliminate the risk; Transfer the risk; or Accept the risk.
While the method described here is an example, aviation organizations are encouraged to develop or implement any method that works for their organizational size and complexity.
3.4.6.3.1 After process owners understand the hazards and associated risks, if they determine that the risk is unacceptable, they must design risk controls to mitigate risks to an acceptable level by using a risk assessment process, as specified in § 5.55(b). Examples of where new risk controls may be applied include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any number of other system changes. In short, risk controls could include anything that would reduce the likelihood or severity of a potential incident/accident.
3.4.6.3.2 The aviation organization must develop procedures requiring a system analysis and hazard identification after the proposed risk control is developed.
3-37 Once a proposed control has been determined and designed, process owners need to determine if the level of risk is acceptable and if the proposed control has introduced unintended consequences or new hazards. This is commonly referred to as “substitute risk.” Section 5.55(d) requires aviation organizations to evaluate whether the risk will be acceptable with the proposed safety risk control applied. The risk that remains is often referred to as “residual risk.” If it is not possible to completely remove risk from a process, the organization must determine whether the residual risk is acceptable to the organization.
3.4.6.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.6.4.1 In aviation organizations with a lower complexity or size, the risk control process could be a documented activity performed by the owner/manager (accountable executive) and/or other employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk analysis, and risk assessment. Aviation organizations on the higher end of the size or complexity spectrum may have the risk control process performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to design the risk controls. There would be interdepartmental coordination before the controls are implemented. After the control is approved, it is implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.
3.4.6.5 SRM Considerations for Small and Single-Individual Organizations.
SRM for single-individual organizations does not need to be overly complex.
In very small organizations, individuals across the organization should be aware of the organization’s biggest risks and what actions are in place to mitigate them.
3.4.6.5.1 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where a small organization or a single-individual organization will tailor the processes to the size, complexity, and operating environment.
3.4.6.5.2 Small organizations should consider how their service providers and contractors interact with the organization. Where are areas that risk could be introduced into the operations?
3.4.6.5.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store,
3-38 communicate, and track aspects associated with risk management will vary based on the size and complexity of the organization. For example, tracking or storing SRM outputs could be accomplished by using worksheets that are completed manually, computer spreadsheets, or commercial software, such as WBAT.
3.4.6.5.4 In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be or employ a risk specialist, as they will most likely know the risks in the organization already.
3.4.6.5.5 Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. How does your organization identify safety issues, from occurrence or incident reports?
In a small organization, is hazard reporting encouraged? In a single-person organization, are you looking for and documenting hazards? Does the organization maintain a good reporting culture? As mentioned in § 5.21, a confidential reporting program is required for all organizations except single-pilot, sole-individual organizations. In small organizations, it is quite common for everyone to know everyone else’s business and could lead to a failure to report safety-related issues. Having a nonreprisal policy in place would encourage the reporting of hazards as employees would be assured their concerns are valued. Does the aviation organization have a hazard log and, more importantly, is it used?
3.4.6.5.6 Consider the process for identifying what could happen as a result of each safety issue and assessing the consequence and likelihood. Is there a risk assessment tool and is it used? Is it appropriate? Does the process determine acceptable risks? A risk matrix may be useful, but in a very small organization, it may not be necessary.
3.4.6.6 SRM Example. Flyslow Aviation initiates the SRM processes due to an employee report identifying a hazard: an uncalibrated tool issued to a technician. This was in response to a report sent through the safety assurance employee safety reporting system (§ 5.71(a)(7)).
3.4.6.6.1 The tool room process owner starts by conducting a system analysis (§ 5.53(b)) on the calibrated tool control process by identifying the various interfaces with the procedure. The process owner also looks for areas where a hazard might exist (§ 5.53(c)). Once potential areas where mistakes (hazards) could occur, the process owner conducts a risk assessment (§ 5.55(b)) using Flyslow Aviation’s risk matrix. By identifying the likelihood of uncalibrated tools being issued and the severity of a potential failure where uncalibrated tools were used, the process owner determines the risk is moderate due to the criticality of the tasks the technicians using the tools are completing. The process owner, remembering their training, uses a risk matrix to determine the potential risk of the uncalibrated tool being used. As risk is a composite of
3-39 likelihood and severity and since uncalibrated tools have been issued to technicians previously, the process owner considers this a likely occurrence.
3.4.6.6.2 Flyslow Aviation’s management, process owners, and employee representatives work together to develop risk controls (§ 5.55(c)) to prevent future issuance of uncalibrated tools to employees. Brainstorming identifies several methods they can use to enhance existing processes. These include a complete audit and verification of the online tool tracking software to ensure all information is entered correctly. A review of calibrated tool expiration dates will be accomplished at the start of each shift to ensure any tools that may have expired are removed from use. Signs will be designed and posted in the tool room reminding the technicians to double check the calibration dates on tools prior to use, and management will be provided with talking points to use during routine employee meetings to ensure everyone is aware of the need to verify the calibrated tool dates.
3.4.6.6.3 The aviation organization reviews the proposed risk controls and determines the revised procedure is acceptable before implementation (§ 5.55(d)).
3.4.7 H azard Notif ication.
3.4.7.1 References. Section 5.57.
3.4.7.2 Part 5 Requirement.
§ 5.57, Notification of hazards to interfacing persons.
If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.
3.4.7.3 Discussion. The SMS should be designed to work in parallel with other aviation organizations, with or without an SMS, to encourage hazard information sharing with one another when safety issues are identified through their respective SMS processes and procedures. This section requires aviation organizations to notify the organization responsible for addressing the hazard of its existence and need for mitigation to ensure that all potentially affected entities are made aware of issues so they can analyze the risks and take appropriate actions to address the hazard.
3.4.7.4 Implementation Strategies. Aviation organizations must provide hazard notifications to interfacing organizations that, to the best of their knowledge, could address a hazard or mitigate the hazard’s risk (§ 5.57). This requirement limits hazard notifications only to those interfacing organizations that contribute to the safety of the products or services you provide.
3-40
3.4.7.4.1 Per § 5.3, a hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards, and the report should only be provided to the interfacing organization you believe can best address the hazard or mitigate its risk. Section 5.57 does not require the reporting of concerns that are not hazards (e.g., commercial issues between companies) as the intent of § 5.57 is to facilitate timely sharing of safety information.
3.4.7.4.2 In single-individual organizations, to meet the requirement of § 5.97(a), it is recommended to retain outputs of your hazard information sharing for no less than 24 calendar months.