3-35
3.4.5.3.2 Risk assessment is based on the process owners’ judgment, experience, and input. If the process owner determines the risk is acceptable, the SRM process would be complete at this point. The system may already be in operation or placed into operation and monitored in the safety assurance process. If the process owner decides the risk is not acceptable, the SRM process continues with the development of risk controls.
3.4.5.3.3 Risk assessments must include the levels of management with the authority to make risk acceptance decisions to decide what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispatching a flight that presents a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For large-scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance decisions will depend on the scope of the proposed change to the operation and the level of risk presented to the aviation organization.
3.4.5.3.4 It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard. The method utilized is not important, but the process owners must be knowledgeable on how to utilize the aviation organization’s documented processes and procedures.
3.4.5.3.5 The outputs of this process could be recorded on paper or via an electronic medium, such as a third-party software program or provider. One example is WBAT.
3.4.5.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.5.4.1 In a small or lower complexity aviation organization, risk assessments could be performed by the owner/manager (accountable executive) and/or other employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. While similar to a Flight Risk Assessment Tool (FRAT), the risk assessment required by § 5.55 is to determine if the residual and associated risks to the process are acceptable.
Quite often, a risk matrix is utilized to determine if any residual risk or substitute risk are acceptable to the aviation organization. A FRAT would be used to determine if conditions are acceptable for a specific flight to commence. It is important not to confuse the purpose of these two distinctly different tools and their application. Aviation organizations on the higher end of the size or complexity spectrum may coordinate their SRM processes across the divisional and geographic units of the organization to ensure
3-36 integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems.
3.4.5.4.2 Many organizations have standing committees made up of senior managers, who are the decisionmakers, supported by working groups of technical personnel. For example, the accountable executive could make organization-level decisions, and department managers could make the decisions for their process areas. A risk matrix may be useful to determine who in the organization makes the risk decision, whether the risk is acceptable, or what the priority is for mitigating risk.
3.4.6 S afety Risk Control .
3.4.6.1 References. Section 5.55(c) and (d).
3.4.6.2 Part 5 Requirement.
§ 5.55(c) and (d), Safety risk assessment and control.
Any person required to have an SMS under this part must:
(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.
(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.
3.4.6.3 Discussion. Aviation organizations must document their processes and procedures for how risk controls should be developed/designed to control identified hazards. The method used should be documented by the aviation organization, and process owners must be trained to produce consistent results. A typical risk control process is the acronym META, which stands for:
Mitigate the risk; Eliminate the risk; Transfer the risk; or Accept the risk.
While the method described here is an example, aviation organizations are encouraged to develop or implement any method that works for their organizational size and complexity.
3.4.6.3.1 After process owners understand the hazards and associated risks, if they determine that the risk is unacceptable, they must design risk controls to mitigate risks to an acceptable level by using a risk assessment process, as specified in § 5.55(b). Examples of where new risk controls may be applied include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any number of other system changes. In short, risk controls could include anything that would reduce the likelihood or severity of a potential incident/accident.
3.4.6.3.2 The aviation organization must develop procedures requiring a system analysis and hazard identification after the proposed risk control is developed.
3-37 Once a proposed control has been determined and designed, process owners need to determine if the level of risk is acceptable and if the proposed control has introduced unintended consequences or new hazards. This is commonly referred to as “substitute risk.” Section 5.55(d) requires aviation organizations to evaluate whether the risk will be acceptable with the proposed safety risk control applied. The risk that remains is often referred to as “residual risk.” If it is not possible to completely remove risk from a process, the organization must determine whether the residual risk is acceptable to the organization.
3.4.6.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.6.4.1 In aviation organizations with a lower complexity or size, the risk control process could be a documented activity performed by the owner/manager (accountable executive) and/or other employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk analysis, and risk assessment. Aviation organizations on the higher end of the size or complexity spectrum may have the risk control process performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to design the risk controls. There would be interdepartmental coordination before the controls are implemented. After the control is approved, it is implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.
3.4.6.5 SRM Considerations for Small and Single-Individual Organizations.
SRM for single-individual organizations does not need to be overly complex.
In very small organizations, individuals across the organization should be aware of the organization’s biggest risks and what actions are in place to mitigate them.
3.4.6.5.1 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where a small organization or a single-individual organization will tailor the processes to the size, complexity, and operating environment.
3.4.6.5.2 Small organizations should consider how their service providers and contractors interact with the organization. Where are areas that risk could be introduced into the operations?
3.4.6.5.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store,
3-38 communicate, and track aspects associated with risk management will vary based on the size and complexity of the organization. For example, tracking or storing SRM outputs could be accomplished by using worksheets that are completed manually, computer spreadsheets, or commercial software, such as WBAT.
3.4.6.5.4 In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be or employ a risk specialist, as they will most likely know the risks in the organization already.
3.4.6.5.5 Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. How does your organization identify safety issues, from occurrence or incident reports?
In a small organization, is hazard reporting encouraged? In a single-person organization, are you looking for and documenting hazards? Does the organization maintain a good reporting culture? As mentioned in § 5.21, a confidential reporting program is required for all organizations except single-pilot, sole-individual organizations. In small organizations, it is quite common for everyone to know everyone else’s business and could lead to a failure to report safety-related issues. Having a nonreprisal policy in place would encourage the reporting of hazards as employees would be assured their concerns are valued. Does the aviation organization have a hazard log and, more importantly, is it used?
3.4.6.5.6 Consider the process for identifying what could happen as a result of each safety issue and assessing the consequence and likelihood. Is there a risk assessment tool and is it used? Is it appropriate? Does the process determine acceptable risks? A risk matrix may be useful, but in a very small organization, it may not be necessary.
3.4.6.6 SRM Example. Flyslow Aviation initiates the SRM processes due to an employee report identifying a hazard: an uncalibrated tool issued to a technician. This was in response to a report sent through the safety assurance employee safety reporting system (§ 5.71(a)(7)).
3.4.6.6.1 The tool room process owner starts by conducting a system analysis (§ 5.53(b)) on the calibrated tool control process by identifying the various interfaces with the procedure. The process owner also looks for areas where a hazard might exist (§ 5.53(c)). Once potential areas where mistakes (hazards) could occur, the process owner conducts a risk assessment (§ 5.55(b)) using Flyslow Aviation’s risk matrix. By identifying the likelihood of uncalibrated tools being issued and the severity of a potential failure where uncalibrated tools were used, the process owner determines the risk is moderate due to the criticality of the tasks the technicians using the tools are completing. The process owner, remembering their training, uses a risk matrix to determine the potential risk of the uncalibrated tool being used. As risk is a composite of
3-39 likelihood and severity and since uncalibrated tools have been issued to technicians previously, the process owner considers this a likely occurrence.
3.4.6.6.2 Flyslow Aviation’s management, process owners, and employee representatives work together to develop risk controls (§ 5.55(c)) to prevent future issuance of uncalibrated tools to employees. Brainstorming identifies several methods they can use to enhance existing processes. These include a complete audit and verification of the online tool tracking software to ensure all information is entered correctly. A review of calibrated tool expiration dates will be accomplished at the start of each shift to ensure any tools that may have expired are removed from use. Signs will be designed and posted in the tool room reminding the technicians to double check the calibration dates on tools prior to use, and management will be provided with talking points to use during routine employee meetings to ensure everyone is aware of the need to verify the calibrated tool dates.
3.4.6.6.3 The aviation organization reviews the proposed risk controls and determines the revised procedure is acceptable before implementation (§ 5.55(d)).
3.4.7 H azard Notif ication.
3.4.7.1 References. Section 5.57.
3.4.7.2 Part 5 Requirement.
§ 5.57, Notification of hazards to interfacing persons.
If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.
3.4.7.3 Discussion. The SMS should be designed to work in parallel with other aviation organizations, with or without an SMS, to encourage hazard information sharing with one another when safety issues are identified through their respective SMS processes and procedures. This section requires aviation organizations to notify the organization responsible for addressing the hazard of its existence and need for mitigation to ensure that all potentially affected entities are made aware of issues so they can analyze the risks and take appropriate actions to address the hazard.
3.4.7.4 Implementation Strategies. Aviation organizations must provide hazard notifications to interfacing organizations that, to the best of their knowledge, could address a hazard or mitigate the hazard’s risk (§ 5.57). This requirement limits hazard notifications only to those interfacing organizations that contribute to the safety of the products or services you provide.
3-40
3.4.7.4.1 Per § 5.3, a hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards, and the report should only be provided to the interfacing organization you believe can best address the hazard or mitigate its risk. Section 5.57 does not require the reporting of concerns that are not hazards (e.g., commercial issues between companies) as the intent of § 5.57 is to facilitate timely sharing of safety information.
3.4.7.4.2 In single-individual organizations, to meet the requirement of § 5.97(a), it is recommended to retain outputs of your hazard information sharing for no less than 24 calendar months.
Figure 3-1. Hazard Notification Process Start:
Hazard Notification Process.
Complete for each identified hazard Step 1: Is there an that could address the extemal organization NO Hazard notification is not required Stop:
hazard or mitigate its risk?
YES Step 2: Does the external organization contribute to the NO Hazard notification is not required. Stop:
safety of the product or services you provide?
YES Step 3: Provide a notification of the hazard to the external organization. (Remove proprietary or confidential in formation)
3.4.7.4.3 Details for each step of the hazard notification process are:
Start: Complete the following steps for each hazard that is identified through your SRM processes.
Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer 3-41
3-42 is “yes,” go to step 2. If the answer is “no,” notification is not required for this hazard.
Note: This decision may occur at any time while the hazard is being assessed through the SRM steps (§§ 5.51, 5.53, and 5.55).
Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard.
Note: Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide.
Step 3: Provide a notification of the hazard to the external organization.
Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified or risk controls put in place to address the hazard). You may use a nondisclosure agreement or other contract if you determine that the hazard notification cannot be provided without disclosing confidential or proprietary information.
3.4.7.5 Hazard Notification Example. The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a Technical Standard Order (TSO) article manufacturer that is not required to have an SMS.
3.4.7.5.1 Flyslow Aviation received an employee report from a pilot stating that the aircraft flight management system (FMS) deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. Flyslow Aviation’s SMS classified this employee report as a hazard because the airport is surrounded by high-elevation terrain. Although this incident occurred during the daytime and in visual meteorological conditions (VMC), management determined that if the same issue occurred during a night landing or instrument meteorological conditions (IMC), the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident.
3.4.7.5.2 Flyslow Aviation followed its hazard notification process and decided that the aircraft manufacturer was the best organization to mitigate the risk (step 1).
Flyslow Aviation also decided that the aircraft manufacturer contributed to the safety of the services provided by Flyslow Aviation (step 2). Flyslow Aviation provided the following hazard notification to the aircraft manufacturer
3-43 (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
3.4.7.5.3 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the FMS database supplier was the best organization to mitigate the risk (step 1). The aircraft manufacturer also decided the FMS system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the FMS database supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
3.4.7.5.4 No further action under § 5.57 is required by either Flyslow Aviation or the aircraft manufacturer. Both organizations have met the § 5.57 hazard notification requirements in this example. Other regulatory notification requirements (such as part 121, § 121.703 or part 135, § 135.415) which require service difficulty reporting must still be complied with.
3.5 Subpa rt D , S afety Assurance.
3.5.1 Monitoring of Operational Processes.
3.5.1.1 References. Sections 5.71(a)(1), 121.703, 121.705, 135.415, 145.107(a)(4), and 145.211.
3.5.1.2 Part 5 Requirement.
§ 5.71(a)(1), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(1) Monitoring of operational processes.
3.5.1.3 Discussion. Managers/process owners may monitor operational processes on a day-to-day basis by directly supervising employee activities, monitoring pilot currency, monitoring minimum equipment list (MEL) status, reviewing pass down logs or Required Inspection Item (RII) status, and performing other supervisory actions. Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance (e.g., duty logs, crew reports, work cards, process sheets, and reports from the employee safety feedback system). This may include monitoring products and services from outside sources that are used in the aviation organization’s operations, such as teardown reports, oil consumption, delay and cancellation reports, and customer feedback forms.
3-44
3.5.1.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.1.4.1 In small or lower complexity organizations, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel
(e.g., accountable executive) who are directly involved in the day-to-day operations. For example, regularly reviewing (e.g., weekly, monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of monitoring and could be conducted during the normal course of duties. Some aviation organizations might utilize the line managers and departmental or key management personnel to observe and review day-to-day activity, noting work task inconsistencies and potential safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit (LOSA) programs may also be sources of information to monitor operations. Aviation organizations on the higher end of the spectrum of size or complexity may involve multiple levels of management, safety professionals, functional area managers (such as the DO, DOM, Chief Inspector, and Chief Pilot), trained auditors/analysts, and teams/groups of line managers in the monitoring of operational processes.
Operational processes may need to be coordinated across adjacent work function boundaries, so effective monitoring may also need to be coordinated.
3.5.2 Monitoring of Operational Environment.
3.5.2.1 References. Section 5.71(a)(2).
3.5.2.2 Part 5 Requirement.
§ 5.71(a)(2), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(2) Monitoring of the operational environment to detect changes.
3.5.2.3 Discussion.
3.5.2.3.1 Aviation organizations need to understand their operating environment so they are able to monitor it for changes. Procedures should include how the operating environment will be monitored and who will do the monitoring.
Organizational descriptions developed and annotated in operations specifications (OpSpecs) or system analysis developed under § 5.53 establish the context for monitoring the operational environment of the aviation organization. Once the scope of the operational environment is defined, this
3-45 section requires monitoring to assess changes that could impact aviation safety.
3.5.2.3.2 Processes used will vary based on the size and complexity of the organization and the aviation service the organization provides or supports. Monitoring of the operational environment involves practices that are similar to those of monitoring operational processes. For example, seasonal weather conditions may require aviation organizations to change their scheduling, routes, and aircraft utilization.
3.5.2.4 Considerations for Small and Single-Individual Organizations. Small or single-individual organizations might keep a log tracking operational issues or deviations from existing processes and procedures. This information could be used to detect changes in the operating environment. Information sharing with other organizations could also provide input to changing operational environments.
3.5.3 A uditing of Operational Processes and Systems.
3.5.3.1 References. Sections 5.23(a)(2)(ii), 5.71(a)(3), 145.205(a), and 145.215.
3.5.3.2 Part 5 Requirement.
§ 5.71(a)(3), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(3) Auditing of operational processes and systems.
3.5.3.3 Discussion.
3.5.3.3.1 Audits are a means of collecting data to confirm whether or not actual practices are being followed within a department. Audits typically involve the operational management and process owners responsible for the system(s) being audited. Organizations should develop procedures for auditing that describe the audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits. Auditors should not audit their own work but may audit the work of others around them in the same department. Audit procedures should include the responsibilities and expectations for planning and conducting audits, reporting the results of audits, and maintaining records of audit results and include processes for auditing contractors and vendors, as necessary. These audits should include monitoring risk controls to ensure they are performing as designed and no new hazards have been introduced into the system.
3-46
3.5.3.3.2 The results of audits can be recorded in paper format (e.g., a common logbook-style binder) or in electronic media (e.g., a desktop spreadsheet program or a program such as WBAT).
3.5.3.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.3.4.1 In smaller or lower complexity aviation organizations, the auditing process could be carried out periodically by the accountable executive/owner, key management person, or a trained employee as a collateral duty. Audits may also be carried out as a subfunction of normal business processes. For example, comparisons of deferred maintenance logs and repair part receipts are a form of safety auditing that are probably already accomplished routinely.
Aviation organizations on the higher end of the spectrum of size or complexity may utilize divisional auditors to conduct the auditing processes.
These aviation organizations may already have safety and safety/quality auditors who perform this function.
3.5.3.5 Considerations for Small and Single-Individual Organizations. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures.
3.5.4 Evaluation of SMS and Operational Processes and Systems.
3.5.4.1 References. Sections 5.25(c)(3) and 5.71(a)(4).
3.5.4.2 Part 5 Requirement.
§ 5.71(a)(4), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(4) Evaluations of the SMS and operational processes and systems.
3.5.4.3 Discussion. An evaluation is typically an independent review of the organization’s processes, procedures, and systems. The evaluation process builds on the concepts of audit and inspection. Evaluations are internal oversight tools that provide the accountable executive with a snapshot of the safety performance of the aviation organization’s operational processes, systems, and SMS processes. The evaluation should include all available data about the organization, including information from the audits conducted by the operational management and/or process owners.