3-37 Once a proposed control has been determined and designed, process owners need to determine if the level of risk is acceptable and if the proposed control has introduced unintended consequences or new hazards. This is commonly referred to as “substitute risk.” Section 5.55(d) requires aviation organizations to evaluate whether the risk will be acceptable with the proposed safety risk control applied. The risk that remains is often referred to as “residual risk.” If it is not possible to completely remove risk from a process, the organization must determine whether the residual risk is acceptable to the organization.
3.4.6.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.4.6.4.1 In aviation organizations with a lower complexity or size, the risk control process could be a documented activity performed by the owner/manager (accountable executive) and/or other employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system analysis, hazard identification, risk analysis, and risk assessment. Aviation organizations on the higher end of the size or complexity spectrum may have the risk control process performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to design the risk controls. There would be interdepartmental coordination before the controls are implemented. After the control is approved, it is implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.
3.4.6.5 SRM Considerations for Small and Single-Individual Organizations.
SRM for single-individual organizations does not need to be overly complex.
In very small organizations, individuals across the organization should be aware of the organization’s biggest risks and what actions are in place to mitigate them.
3.4.6.5.1 SRM elements and their intended outcomes are the same regardless of the size and complexity of an organization. The breadth and degree of analysis is where a small organization or a single-individual organization will tailor the processes to the size, complexity, and operating environment.
3.4.6.5.2 Small organizations should consider how their service providers and contractors interact with the organization. Where are areas that risk could be introduced into the operations?
3.4.6.5.3 While there is no appreciable difference between the expected outcomes in a single-individual organization versus a larger organization, how you store,
3-38 communicate, and track aspects associated with risk management will vary based on the size and complexity of the organization. For example, tracking or storing SRM outputs could be accomplished by using worksheets that are completed manually, computer spreadsheets, or commercial software, such as WBAT.
3.4.6.5.4 In single-individual organizations, the accountable executive already has a good idea of the core risks and any control measures that can easily be applied. The accountable executive does not have to be or employ a risk specialist, as they will most likely know the risks in the organization already.
3.4.6.5.5 Consider whether the SRM processes and procedures developed are simple and work for the organization to actively look for safety issues. How does your organization identify safety issues, from occurrence or incident reports?
In a small organization, is hazard reporting encouraged? In a single-person organization, are you looking for and documenting hazards? Does the organization maintain a good reporting culture? As mentioned in § 5.21, a confidential reporting program is required for all organizations except single-pilot, sole-individual organizations. In small organizations, it is quite common for everyone to know everyone else’s business and could lead to a failure to report safety-related issues. Having a nonreprisal policy in place would encourage the reporting of hazards as employees would be assured their concerns are valued. Does the aviation organization have a hazard log and, more importantly, is it used?
3.4.6.5.6 Consider the process for identifying what could happen as a result of each safety issue and assessing the consequence and likelihood. Is there a risk assessment tool and is it used? Is it appropriate? Does the process determine acceptable risks? A risk matrix may be useful, but in a very small organization, it may not be necessary.
3.4.6.6 SRM Example. Flyslow Aviation initiates the SRM processes due to an employee report identifying a hazard: an uncalibrated tool issued to a technician. This was in response to a report sent through the safety assurance employee safety reporting system (§ 5.71(a)(7)).
3.4.6.6.1 The tool room process owner starts by conducting a system analysis (§ 5.53(b)) on the calibrated tool control process by identifying the various interfaces with the procedure. The process owner also looks for areas where a hazard might exist (§ 5.53(c)). Once potential areas where mistakes (hazards) could occur, the process owner conducts a risk assessment (§ 5.55(b)) using Flyslow Aviation’s risk matrix. By identifying the likelihood of uncalibrated tools being issued and the severity of a potential failure where uncalibrated tools were used, the process owner determines the risk is moderate due to the criticality of the tasks the technicians using the tools are completing. The process owner, remembering their training, uses a risk matrix to determine the potential risk of the uncalibrated tool being used. As risk is a composite of
3-39 likelihood and severity and since uncalibrated tools have been issued to technicians previously, the process owner considers this a likely occurrence.
3.4.6.6.2 Flyslow Aviation’s management, process owners, and employee representatives work together to develop risk controls (§ 5.55(c)) to prevent future issuance of uncalibrated tools to employees. Brainstorming identifies several methods they can use to enhance existing processes. These include a complete audit and verification of the online tool tracking software to ensure all information is entered correctly. A review of calibrated tool expiration dates will be accomplished at the start of each shift to ensure any tools that may have expired are removed from use. Signs will be designed and posted in the tool room reminding the technicians to double check the calibration dates on tools prior to use, and management will be provided with talking points to use during routine employee meetings to ensure everyone is aware of the need to verify the calibrated tool dates.
3.4.6.6.3 The aviation organization reviews the proposed risk controls and determines the revised procedure is acceptable before implementation (§ 5.55(d)).
3.4.7 H azard Notif ication.
3.4.7.1 References. Section 5.57.
3.4.7.2 Part 5 Requirement.
§ 5.57, Notification of hazards to interfacing persons.
If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.
3.4.7.3 Discussion. The SMS should be designed to work in parallel with other aviation organizations, with or without an SMS, to encourage hazard information sharing with one another when safety issues are identified through their respective SMS processes and procedures. This section requires aviation organizations to notify the organization responsible for addressing the hazard of its existence and need for mitigation to ensure that all potentially affected entities are made aware of issues so they can analyze the risks and take appropriate actions to address the hazard.
3.4.7.4 Implementation Strategies. Aviation organizations must provide hazard notifications to interfacing organizations that, to the best of their knowledge, could address a hazard or mitigate the hazard’s risk (§ 5.57). This requirement limits hazard notifications only to those interfacing organizations that contribute to the safety of the products or services you provide.
3-40
3.4.7.4.1 Per § 5.3, a hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards, and the report should only be provided to the interfacing organization you believe can best address the hazard or mitigate its risk. Section 5.57 does not require the reporting of concerns that are not hazards (e.g., commercial issues between companies) as the intent of § 5.57 is to facilitate timely sharing of safety information.
3.4.7.4.2 In single-individual organizations, to meet the requirement of § 5.97(a), it is recommended to retain outputs of your hazard information sharing for no less than 24 calendar months.
Figure 3-1. Hazard Notification Process Start:
Hazard Notification Process.
Complete for each identified hazard Step 1: Is there an that could address the extemal organization NO Hazard notification is not required Stop:
hazard or mitigate its risk?
YES Step 2: Does the external organization contribute to the NO Hazard notification is not required. Stop:
safety of the product or services you provide?
YES Step 3: Provide a notification of the hazard to the external organization. (Remove proprietary or confidential in formation)
3.4.7.4.3 Details for each step of the hazard notification process are:
Start: Complete the following steps for each hazard that is identified through your SRM processes.
Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer 3-41
3-42 is “yes,” go to step 2. If the answer is “no,” notification is not required for this hazard.
Note: This decision may occur at any time while the hazard is being assessed through the SRM steps (§§ 5.51, 5.53, and 5.55).
Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard.
Note: Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide.
Step 3: Provide a notification of the hazard to the external organization.
Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified or risk controls put in place to address the hazard). You may use a nondisclosure agreement or other contract if you determine that the hazard notification cannot be provided without disclosing confidential or proprietary information.
3.4.7.5 Hazard Notification Example. The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a Technical Standard Order (TSO) article manufacturer that is not required to have an SMS.
3.4.7.5.1 Flyslow Aviation received an employee report from a pilot stating that the aircraft flight management system (FMS) deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. Flyslow Aviation’s SMS classified this employee report as a hazard because the airport is surrounded by high-elevation terrain. Although this incident occurred during the daytime and in visual meteorological conditions (VMC), management determined that if the same issue occurred during a night landing or instrument meteorological conditions (IMC), the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident.
3.4.7.5.2 Flyslow Aviation followed its hazard notification process and decided that the aircraft manufacturer was the best organization to mitigate the risk (step 1).
Flyslow Aviation also decided that the aircraft manufacturer contributed to the safety of the services provided by Flyslow Aviation (step 2). Flyslow Aviation provided the following hazard notification to the aircraft manufacturer
3-43 (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
3.4.7.5.3 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the FMS database supplier was the best organization to mitigate the risk (step 1). The aircraft manufacturer also decided the FMS system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the FMS database supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
3.4.7.5.4 No further action under § 5.57 is required by either Flyslow Aviation or the aircraft manufacturer. Both organizations have met the § 5.57 hazard notification requirements in this example. Other regulatory notification requirements (such as part 121, § 121.703 or part 135, § 135.415) which require service difficulty reporting must still be complied with.
3.5 Subpa rt D , S afety Assurance.
3.5.1 Monitoring of Operational Processes.
3.5.1.1 References. Sections 5.71(a)(1), 121.703, 121.705, 135.415, 145.107(a)(4), and 145.211.
3.5.1.2 Part 5 Requirement.
§ 5.71(a)(1), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(1) Monitoring of operational processes.
3.5.1.3 Discussion. Managers/process owners may monitor operational processes on a day-to-day basis by directly supervising employee activities, monitoring pilot currency, monitoring minimum equipment list (MEL) status, reviewing pass down logs or Required Inspection Item (RII) status, and performing other supervisory actions. Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance (e.g., duty logs, crew reports, work cards, process sheets, and reports from the employee safety feedback system). This may include monitoring products and services from outside sources that are used in the aviation organization’s operations, such as teardown reports, oil consumption, delay and cancellation reports, and customer feedback forms.
3-44
3.5.1.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.1.4.1 In small or lower complexity organizations, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel
(e.g., accountable executive) who are directly involved in the day-to-day operations. For example, regularly reviewing (e.g., weekly, monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of monitoring and could be conducted during the normal course of duties. Some aviation organizations might utilize the line managers and departmental or key management personnel to observe and review day-to-day activity, noting work task inconsistencies and potential safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit (LOSA) programs may also be sources of information to monitor operations. Aviation organizations on the higher end of the spectrum of size or complexity may involve multiple levels of management, safety professionals, functional area managers (such as the DO, DOM, Chief Inspector, and Chief Pilot), trained auditors/analysts, and teams/groups of line managers in the monitoring of operational processes.
Operational processes may need to be coordinated across adjacent work function boundaries, so effective monitoring may also need to be coordinated.
3.5.2 Monitoring of Operational Environment.
3.5.2.1 References. Section 5.71(a)(2).
3.5.2.2 Part 5 Requirement.
§ 5.71(a)(2), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(2) Monitoring of the operational environment to detect changes.
3.5.2.3 Discussion.
3.5.2.3.1 Aviation organizations need to understand their operating environment so they are able to monitor it for changes. Procedures should include how the operating environment will be monitored and who will do the monitoring.
Organizational descriptions developed and annotated in operations specifications (OpSpecs) or system analysis developed under § 5.53 establish the context for monitoring the operational environment of the aviation organization. Once the scope of the operational environment is defined, this
3-45 section requires monitoring to assess changes that could impact aviation safety.
3.5.2.3.2 Processes used will vary based on the size and complexity of the organization and the aviation service the organization provides or supports. Monitoring of the operational environment involves practices that are similar to those of monitoring operational processes. For example, seasonal weather conditions may require aviation organizations to change their scheduling, routes, and aircraft utilization.
3.5.2.4 Considerations for Small and Single-Individual Organizations. Small or single-individual organizations might keep a log tracking operational issues or deviations from existing processes and procedures. This information could be used to detect changes in the operating environment. Information sharing with other organizations could also provide input to changing operational environments.
3.5.3 A uditing of Operational Processes and Systems.
3.5.3.1 References. Sections 5.23(a)(2)(ii), 5.71(a)(3), 145.205(a), and 145.215.
3.5.3.2 Part 5 Requirement.
§ 5.71(a)(3), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(3) Auditing of operational processes and systems.
3.5.3.3 Discussion.
3.5.3.3.1 Audits are a means of collecting data to confirm whether or not actual practices are being followed within a department. Audits typically involve the operational management and process owners responsible for the system(s) being audited. Organizations should develop procedures for auditing that describe the audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits. Auditors should not audit their own work but may audit the work of others around them in the same department. Audit procedures should include the responsibilities and expectations for planning and conducting audits, reporting the results of audits, and maintaining records of audit results and include processes for auditing contractors and vendors, as necessary. These audits should include monitoring risk controls to ensure they are performing as designed and no new hazards have been introduced into the system.
3-46
3.5.3.3.2 The results of audits can be recorded in paper format (e.g., a common logbook-style binder) or in electronic media (e.g., a desktop spreadsheet program or a program such as WBAT).
3.5.3.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.3.4.1 In smaller or lower complexity aviation organizations, the auditing process could be carried out periodically by the accountable executive/owner, key management person, or a trained employee as a collateral duty. Audits may also be carried out as a subfunction of normal business processes. For example, comparisons of deferred maintenance logs and repair part receipts are a form of safety auditing that are probably already accomplished routinely.
Aviation organizations on the higher end of the spectrum of size or complexity may utilize divisional auditors to conduct the auditing processes.
These aviation organizations may already have safety and safety/quality auditors who perform this function.
3.5.3.5 Considerations for Small and Single-Individual Organizations. A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures.
3.5.4 Evaluation of SMS and Operational Processes and Systems.
3.5.4.1 References. Sections 5.25(c)(3) and 5.71(a)(4).
3.5.4.2 Part 5 Requirement.
§ 5.71(a)(4), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(4) Evaluations of the SMS and operational processes and systems.
3.5.4.3 Discussion. An evaluation is typically an independent review of the organization’s processes, procedures, and systems. The evaluation process builds on the concepts of audit and inspection. Evaluations are internal oversight tools that provide the accountable executive with a snapshot of the safety performance of the aviation organization’s operational processes, systems, and SMS processes. The evaluation should include all available data about the organization, including information from the audits conducted by the operational management and/or process owners.
3-47
3.5.4.3.1 Evaluations performed at planned intervals help the aviation organization’s management determine if its safety management methods and practices are meeting the safety objectives and expectations documented in the safety policy. Evaluation planning should consider the safety criticality of the processes that are being evaluated and the results from previous evaluations.
The scope, content, and frequency of evaluations should be based on the organization’s need for information to assess the health of operational processes and the SMS. Aviation organizations also need to define criteria for selecting evaluators.
3.5.4.3.2 The results of evaluations can be recorded in a paper or electronic medium, such as in a common logbook-style binder, an electronic file folder, or a secure email account.
3.5.4.4 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.4.4.1 In a small organization, the evaluation process could be carried out periodically by the accountable executive/owner. In larger organizations, evaluations could be performed by a key management person or designated employees as a collateral duty. The process could be accomplished by the Director of Safety (DOS) or the safety department on a monthly, quarterly, or other periodic basis, as determined by the information needs of the accountable executive or other senior management decisionmakers.
3.5.4.4.2 Aviation organizations on the higher end of the spectrum of size or complexity may accomplish evaluations by utilizing a safety department or an Internal Evaluation Program (IEP) office on a quarterly, annual, or other periodic basis, as determined by the information needs of the accountable executive or other senior management decisionmakers. Many part 121 and some part 135 organizations have IEPs, and their outputs can be integrated into the SMS. Analysis of evaluations is typically performed by a safety department. The resulting data would be acted on by the appropriate operational department with the safety department managing the data and assisting the responsible process owners in resolving identified issues. Most large organizations have standing management committees that consider results of evaluations and any corrective action needed.
3.5.4.5 Considerations for Small and Single-Individual Organizations.
A single-individual organization should review their records on a defined interval to look for trends in operational performance that could identify ineffective processes and procedures.
3-48
3.5.5 Investigation of Incidents and Accidents.
3.5.5.1 References. Section 5.71(a)(5).
3.5.5.2 Part 5 Requirement.
§ 5.71(a)(5), Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(5) Investigations of incidents and accidents.
3.5.5.3 Discussion. Investigations should be treated as an opportunity for organizational learning to prevent a repeat of errors and/or change organizational processes so that mistakes do not recur.
3.5.5.3.1 Aviation organizations need to define the types of incidents and accidents that require investigations. Part 5 only requires incidents and accidents that directly affect the aviation product or service be investigated.
3.5.5.3.2 Processes used will vary based on the size and complexity of the organization and aviation service the organization provides or supports. Investigations should focus on what went wrong rather than who caused the error and emphasize improvement of safety performance. To the extent permitted by law, the organization should include data, if available, from outside sources, such as the FAA or National Transportation Safety Board (NTSB) investigations.
3.5.5.3.3 Implementation Strategies. The following examples demonstrate ways aviation organizations might choose to implement this requirement based on where the aviation organization may fall on the spectrum of size or complexity. The following are examples only and are not the only ways the requirements could be met.
3.5.5.3.4 In smaller or less complex aviation organizations, investigations can be conducted by the accountable executive or assigned employees. Investigations can be conducted by a safety department with additional assigned line personnel providing technical expertise. Aviation organizations on the higher end of the spectrum of size or complexity may have safety teams with specialized disciplines conduct the investigations. The results of investigations can be recorded in paper or electronic medium (e.g., in a common logbook-style binder, an electronic file folder, or other electronic system, such as WBAT or another suitable system).
3.5.5.4 Considerations for Small and Single-Individual Organizations.
Investigation is a necessary activity within any SMS, regardless of the