2-2 communication up and down the aviation organization and among peers, staying vigilant in looking for new hazards and identifying associated risks, and ensuring that employees know that safety is an essential part of their job performance are key elements that can have a positive effect on the aviation organization’s SRM decisions.
2.2 Conceptual Overview of Safety Assurance and SRM.
2.2.1 Graphical Overview of Safety Assurance and SRM Processes. Figure 2-1, Safety Management Decision-Making Processes, provides an expanded view of the principal processes of the SMS: safety assurance and SRM. In the discussion that follows, some key terms and concepts related to SMS processes will be introduced. A more detailed discussion of the SRM and safety assurance processes is presented below each regulatory requirement in Chapter 3, Safety Management System (SMS) Components Explained.
Because safety management is a decision-making process, SRM and safety assurance follow a structured set of processes outlined in Figure 2-1.
Figure 2-1. Safety Management Decision-Making Processes Performance Design Safety Safety Risk Assurance Management System System Monitoring Analysis § 5.71 (a) § 5.53(a) & (b) Data Hazard Acquisition Identification External Hazard § 5.71 (a) § 5.53(c) § 5.57 Analysis Risk of Data Analysis § 5.71(b) § 5.55(a) Risk Assessment System § 5.73(b) Assessment § 5.73(a) § 5.55(b) Corrective Risk § 5.55(đ) Action Control § 5.75 § 5.55(c)
2.3 Safety Assurance and Interactions With SRM.
2.3.1 Safety assurance processes monitor the day-to-day life cycle of system operations, (System Monitoring) with the designed risk controls in place. A variety of data sources (Data Acquisition), such as audits, investigations, and employee reporting, are utilized.
These will be further explained in Chapter 3. The safety assurance process involves 2-3
2-4 several steps. Once the data has been obtained, the process owner analyzes the data that will be used in decision making (Analysis of Data). The decision making can result in several possible outcomes (System Assessment). If the data and analysis indicate the processes, procedures, and integrated risk controls are functioning as intended, the result is satisfactory, and management can have confidence that organizational goals and safety objectives are being met.
2.3.2 If a negative result is identified, the organization should continue the analysis to determine if the shortfall is due to the controls not being used as intended (e.g., required training not accomplished, procedures not followed, or improper tools or equipment provided). If a negative result is identified and the system is being used as intended, the system is not producing the expected results. In the former case, action should be taken to correct the problem (Corrective Action). In the latter case, system design should be reconsidered using the path back to the SRM process.
2.3.3 The identification of a new hazard or ineffective risk control during the safety assurance process requires an organization to initiate the SRM process. For organizations transitioning into an SMS, the SRM process may initially be challenging if their operational systems have not been built using a risk management process because they may lack formal or well-understood risk controls.
2.3.4 Managers or process owners who are responsible for operational processes are also responsible for assuring that their process areas are performing as intended from an aviation safety standpoint.
2.4 SRM.
2.4.1 In SRM, the first step, System Analysis, is used to understand the processes and procedures being developed or revised or where new hazards or changes of the operational environment have been identified. The system analysis needs to consider the operating environment, the personnel involved in the operation, the equipment being used, any training needed, operational procedures, and interfaces with other processes or procedures. In most cases, hazard identification flows from this system analysis. Hazard identification requires process owners to ask questions such as:
1. What hazards exist in the operational environment?
2. What are the human factors (HF) issues of the operation (e.g., workload, distraction, fatigue, or system complexity)?
3. What are the limitations of the hardware, software, procedures, etc.?
2.4.2 Although Figure 2-1 above depicts these processes as distinctly defined components, they flow from one to the other in practice. For example, in a careful discussion of how a system currently works (System Analysis), hazards will often become evident. Thus, the Hazard Identification step has also been at least partially accomplished.
2.4.3 The process owner then conducts an analysis of the potential consequences of operation in the presence of the identified hazards (Risk Analysis). This culminates in an
2-5 assessment of the acceptability of operating with these hazards (Risk Assessment) or whether or not the risk of such operations can be eliminated or mitigated to an acceptable level (Risk Control). Operational managers or process owners2 must be the ones who are accountable for risk acceptance and mitigation decisions.
2 An organization may need to identify those personnel who “manage processes” but are not necessarily managers with a place on the organizational chart. Field experience has proven that the process owner terminology is necessary to allow aviation organizations to develop protocols that keep simple design change decisions at the level appropriate to the acceptance of risk.
2.4.4 After a system has been designed or revised using the SRM process, special attention should be given to the new or revised system using the safety assurance process. It should not be surprising to find at this time that there are still things that might not have been considered or that there are changes over time in the operational environment that require a return to SRM. Thus, the SRM and safety assurance processes operate in a continuous exchange.
2.5 Safety Culture and Safety Management. The culture of an organization is demonstrated through the organization’s values, traits, and behaviors. The term “safety culture” is used to describe those aspects of the organization’s culture relating to its safety performance. An organization that has a positive safety culture embraces open communication and continuous improvement. Management’s consistent attention, commitment, involvement, and visible leadership are essential in guiding an organization toward a positive safety culture. A positive safety culture matures as safety management skills are learned, practiced, and become second nature across the entire organization.
The following are practices and characteristics of organizations that foster a positive safety culture.
2.5.1 Open Reporting. Organizations should have policies and processes that foster open reporting while stressing the need for continuous diligence and professionalism.
Organizations should encourage disclosure of error without fear of reprisal (as long as the issue being reported was not caused through intentional misconduct or gross negligence) and should demand accountability on the part of employees and management alike. Part 5 requirements include provisions for aviation organizations to discuss hazard reporting in their safety policy (part 5, § 5.21(a)(4)) and in their safety assurance processes (§ 5.71(a)(7)).
2.5.2 Just Culture. The organization should engage in identification of systemic errors, implement preventative corrective action, and exhibit intolerance of undesirable behaviors, such as intentional misconduct or willful disregard for established procedures.
This is often referred to as a “just culture.” A just culture can be defined as a values-centered model of shared accountability, which will result in higher levels of confidence in safety outcomes at all levels of an organization. Organizations with a just culture encourage open communication that is nonretributive and encourages employees to admit mistakes so corrective actions can be implemented and potential hazards reduced. The following characteristics have an effect on an organization’s just culture.
2-6
2.5.2.1 Personnel Involvement. Involvement of personnel at all levels of an organization is critical to effective safety management. All employees who are directly involved with aviation safety play a key role in hazard identification and open communication.
2.5.2.2 Use of Information. Effective use of relevant information ensures informed management decision making.
2.5.2.3 Commitment to Risk Reduction. Management directly involves itself in identifying hazards and managing risk.
2.5.2.4 Vigilance. Processes that monitor ongoing operations and the environment increase effectiveness of risk controls and awareness of emerging hazards.
2.5.2.5 Flexibility. The organization uses information effectively to adjust and change to reduce risk and is willing to commit resources to making changes necessary to reduce risk.
2.5.2.6 Learning. The organization learns from its own failures and from those of allied and similar businesses. The organization uses acquired data to feed analysis processes and assess performance, the results of which yield information that can be acted on to improve safety.
2.5.2.7 Code of Ethics. A code of ethics is a set of principles designed to help aviation professionals conduct aviation operations honestly, with integrity, and with safe operations at the core of all decisions.
2.5.2.8 Safety Attributes. System safety attributes are the core characteristics that are integrated into all processes and procedures. For additional discussion, see Appendix F, Safety Attributes.
2.5.3 Management Involvement. An organization’s employees look to executive leadership to demonstrate their visible commitment to and involvement in safe operation while performing their daily work. SMS processes do not have to be expensive or sophisticated;
however, active personal involvement of operational leaders is essential. Effective safety management is accomplished by those individuals who “own” the processes in which risk resides. Safety cultures also cannot be “created” or “implemented” by management decree no matter how sincere their intentions. Every organization has a safety culture. It is embodied in the way the organization and its members approach safety in their jobs. If positive aspects of culture are to emerge, the organization’s senior management must set up the policies and processes that create a working environment that fosters safe behavior, and they should lead by example.
2.6 Definitions. The following definitions are used throughout this AC.
2.6.1 Compliance Statement. A document developed by an aviation organization that states how the organization complies with part 5. For specific information on developing a
2-7 compliance statement, see Appendix D, Guidance for Developing a Compliance Statement.
2.6.2 De c laration of Compliance. A document submitted to the FAA that declares the aviation organization has developed and implemented an SMS in compliance with part 5 whether required by regulation or implemented voluntarily.
2.6.3 H azard . A condition or an object that could foreseeably cause or contribute to an incident or aircraft accident as defined in Title 49 of the Code of Federal Regulations (49 CFR) part 830, § 830.2.
2.6.4 Person. The term “person” is defined in 14 CFR part 1, § 1.1 as “an individual, firm, partnership, corporation, company, association, joint-stock association, or governmental entity. It includes a trustee, receiver, assignee, or similar representative of any of them.”
This definition includes certificate holders (CH), service providers, or other types of individuals or business entities and is used throughout 14 CFR. For the purposes of part 5, the term “person” can be used to refer to an individual or to an aviation organization.
2.6.5 P rocess Owner . The individual responsible for ensuring that one or more process areas are performing as intended from an aviation safety standpoint.
2.6.6 Ri sk . The composite of predicted severity and likelihood of the potential effect of a hazard.
2.6.7 R isk Control . A means to reduce or eliminate the effects of hazards.
2.6.8 Safety Assurance. Processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.
2.6.9 S afety Management System (SMS) . The formal, top-down, organization-wide approach to managing safety risk and ensuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.
2.6.10 S afety Objective . A measurable goal or desirable outcome related to safety.
2.6.11 Safety Performance. Realized or actual safety accomplishment relative to the organization’s safety objectives.
2.6.12 S afety Policy . The person’s documented commitment to safety, which defines their safety objectives and the accountabilities and responsibilities of its employees in regard to safety.
2.6.13 S afety Promotion. A combination of training and communication of safety information to support the implementation and operation of an SMS in an organization.
2-8
2.6.14 Safety Risk Management (SRM). A process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk.
2.6.15 S ystem Safety . The application of technical and managerial skills to the systematic, forward-looking identification and control of hazards throughout the life cycle of a project, program, or activity. The primary objective of system safety is accident prevention.
3-1 CHAPTER 3. SAFETY MANAGEMENT SYSTEM (SMS) COMPONENTS
EXPLAINED
3.1 Overview of This Chapter. SMS requirements are organized around the four components of safety management. These components are broken down into subparts of 14 CFR part 5 (e.g., Part 5 Subpart B, Safety Pol icy). This chapter contains a description of each SMS requirement contained in part 5. After the title of each requirement, where appropriate, the following information is provided.
3.1.1 References. This pa ragraph contains references for part 5. Where applicable, other related regulatory requirements are provided for cross-reference purposes. These other regulatory references are hyperlinked for ease of access.
3.1.2 Regulatory Text Box. A copy of the part 5 regulatory tex t for reference. The discussions in this chapter apply equally to aviation organizations subject to part 5 requirements and those seeking to implement a voluntary SMS.
Note 1: T he word “person” in the regulatory text box typically refers to the aviation organization. When a specific individual is required to be identified, the regulatory language will use the term “individual.”
Note 2: This AC does not include guidance on part 5 regulations applicable only to type certificate holders (TCH) and licensees and production certificate holders (CH) under 14 CFR part 21. For info rmation applicable to a ircraft certification products and service providers, refer to AC 21-58, Safety Management Systems for Part 21 Type and Production Certificate Holders.
3.1.3 Discussion. A more detailed plain language explanation of the process as it relates to the SMS. It includes some examples, when appropriate, and offers optional recommended design characteristics.
3.1.4 Implementation Strategies.
3.1.4.1 A short discussion, where applicable, of potential methods different-sized aviation organizations could use to meet the pertinent SMS requirements that could be scaled to the size and complexity of their organization. The Safety Management International Collaboration Group (SM ICG) SMS for Small Organizations3 document defines a small organization as one with between 5 and 20 staff and a very small organization as one with less than 5 staff. The FAA has not defined these organizations because an SMS is designed to be adaptable based on the size and complexity of the organization. So, it is possible for an organization to be very small but highly complex, and a large organization could be low complexity based on the aviation activity they are involved with.
3 SM ICG guidance documents can be downloaded from https://skybrary.aero/enhancing-s afety/sm-icg-safetymanagement-products.
3-2
3.1.4.2 Aviation organizations are each unique, not only in organizational structure and the equipment operated and maintained but also in management structure and, very often, in management style. Therefore, a one-size-fits-all approach to scaling the aviation organization’s response to each section of part 5 is not advisable. This AC stresses the importance of recognizing aviation organizations have different operational environments and different levels of resources. Less complex organizations could use simple methods for conducting the processes within the SMS. More complex organizations may require more detailed processes within the SMS.
3.1.4.3 For organizations that have only a single pilot or technician and perhaps minimal support staff to carry out daily responsibilities, this AC suggests utilizing a commonsense approach to SMS implementation and maintenance.
In the case of a single-pilot operator, that single pilot could be the one to develop, implement, and use the SMS processes. At medium and large organizations, the complexity and departmentalization of duties may require that more personnel be involved in the SMS. Regardless of the organization’s size, many aviation organizations will find their existing processes and procedures can serve as the foundation for portions of their SMS. Integration of these existing processes should be used as much as practical.
Note: Implementation strategy discussions are for illustration only and neither impose requirements nor mandate specific resource allocation by an aviation organization. Aviation organizations should integrate methods and procedures that best fit their organizational structure and that leverage processes and procedures already in place to the greatest extent possible.
3.1.5 C onsiderations for Small and Single -Individual Organizations. Where appropriate, additional guidance and recommendations are provided for small and single-individual organizations.
3.1.6 Example. Throughout this chapter, w e will use fictional aviation service provider Flyslow Aviation as an example of how a typical organization could integrate part 5 requirements into their operations.
3.2 Subpa rt A , G eneral.
3.2.1 Applicability: Who Is Required to Implement an SMS.
3.2.1.1 References. Section 5.1 and 14 CFR part 91, § 91.147 and part 119, § 119.8.
3-3
3.2.1.2 Part 5 Requirement.
§ 5.1, Applicability.
This part applies to all of the following:
(a) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 121 of this chapter.
(b) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 135 of this chapter.
(c) Any person that holds or applies for a Letter of Authorization issued under § 91.147 of this chapter.
3.2.1.3 Discussion. SMSs should be applied to the aviation operational processes of the organization. For example, the aviation operational processes in a typical aviation organization may include:
• Flight operations,
• Operational control (dispatch/flight following),
• Maintenance and inspection,
• Parts receiving inspections,
• Calibrated tooling procedures,
• Cabin safety,
• Ground handling and servicing,
• Cargo handling,
• Training, and
• Recordkeeping.
Note: Information concerning implementation planning for aviation organizations wanting to develop an SMS under part 5 is outlined in greater detail in Chapter 4, Implementation: Building a Safety Management System (SMS).
3.2.2 Definitions.
3.2.2.1 References. Section 5.3.
3.2.2.2 Part 5 Requirement.
§ 5.3, Definitions.
Hazard means a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident, as defined in 49 CFR 830.2.
Risk means the composite of predicted severity and likelihood of the potential effect of a hazard.
3-4 Risk control means a means to reduce or eliminate the effects of hazards.
Safety assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.
Safety Management System (SMS) means the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.
Safety objective means a measurable goal or desirable outcome related to safety.
Safety performance means realized or actual safety accomplishment relative to the organization’s safety objectives.
Safety policy means the person’s documented commitment to safety, which defines its safety objectives and the accountabilities and responsibilities of its employees in regards to safety.
Safety promotion means a combination of training and communication of safety information to support the implementation and operation of an SMS in an organization.
Safety Risk Management means a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk.
3.2.2.3 Discussion. These definitions apply to the use of these terms throughout part 5.
3.2.3 General Requirements.
3.2.3.1 References. Section 5.5.
3.2.3.2 Part 5 Requirement.
§ 5.5, General requirements.
(a) SMS components. An SMS under this part must be appropriate to the size, scope, and complexity of the person’s organization and include, at a minimum, all of the following components:
(1) Safety policy that meets the requirements of subpart B of this part.
(2) Safety risk management that meets the requirements of subpart C of this part.
(3) Safety assurance that meets the requirements of subpart D of this part.
(4) Safety promotion that meets the requirements of subpart E of this part.
(b) Continuing requirements. Any person required to develop and implement an SMS under this part must maintain the SMS in accordance with this part.
3.2.3.3 Discussion. Implementing an effective SMS requires an organization to fully understand its structure, processes, business arrangements, and interfaces that impact the Safety Risk Management (SRM) of aviation safety. While not regulatory, developing an organizational description should be the first step in SMS development. An organizational description is a summary of the organization’s processes, activities, and interfaces that need to be considered as a part of their SMS. It describes the aviation system, the interfaces within the organization, and the interfaces with external organizations that contribute to the safe delivery of aviation services. As organizations mature and grow, it is important to ensure the SMS continues to adapt and remain effective to changing requirements. Reviewing the organizational description and
3-5 interfaces that may have changed as well as updating operational processes and procedures ensures the aviation organization’s SMS continues to perform as designed.
3.2.4 R equirements for Domestic, Flag, and Supplemental Operations.
3.2.4.1 References. Sections 5.7 and 119.8.
3.2.4.2 Part 5 Requirement.
§ 5.7, Requirements for domestic, flag, and supplemental operations.
(a) Any person authorized to conduct operations under part 121 of this chapter that has an SMS acceptable to the FAA on or before May 28, 2024, must revise its SMS to meet the requirements of this part no later than May 28, 2025.
(b) Any person applying for authorization to conduct operations under part 121 of this chapter or with such application pending on or after May 28, 2024, must develop and implement an SMS that meets the requirements of this part.
(c) Any person required to develop and implement an SMS under this section must maintain the SMS as long as the person is authorized to conduct operations under part 121 of this chapter.
(d) Any person required to develop and implement an SMS under this section must make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part.
3.2.4.3 Discussion.
3.2.4.3.1 Title 14 CFR part 121 aviation organizations are required to meet updated part 5 requirements within 12 months of the effective date of this rule.
Part 121 operators are required to revise their SMS to meet the new requirements in § 5.3 (definitions) by updating the definition of “hazard” and in §§ 5.21(a)(7) (s afety policy code of ethics), 5.53(b)(5) (SR M interfaces),
5.57 (notification of hazards to interfacing persons), 5.71(a)(7) (employee confidential reporting system), 5.71(a)(8) (investigations of hazard notifications that have been received from external sources), and 5.97(d) (SMS records). Part 121 aviation organizations will provide any required revisions to their SMS processes in accordance with existing submission procedures.
3.2.4.3.2 N ew part 121 applicants must meet part 5 requirements as a part of the certification process as defined in the Air Operator and Air Agency Certification and Application Process in FAA Order 8900.1, Volume 2, Chapter 4, The Certification Process—Title 14 CFR Part 135.4 The certification project manager (CPM) will brief the new applicants on the SMS requirements during initial meetings. For guidance on preparing a compliance
4 Order 8900.1 is available online on the FAA’s Dynamic Regulatory System (DRS) at https://drs.faa.gov/.