AC 120-92D

Advisory circular · Safety Management Systems for Aviation Service Providers

Approved
May 21, 2024
Last reviewed
August 22, 2024
This change
Revision C of this AC was canceled and did not publish. However, it was posted for public comment prior to being canceled, so this update was published as Revision D.
Cancels
AC120-92B Ed Update 1
Family
AC 120-92 · 5 versions
Revision
D
14 CFR parts
5, 91, 119
14 CFR sections
§ 91.147§ 119.8

Guidance, not mandatory unless a rule or AD requires it. DRS record last changed November 22, 2025.

Show pages 87–98

Appendix A A-11 Part 5 Section Text ICAO Framework Components and Elements § 5.73 Safety performance assessment.

§ 5.73(a)

(a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to:

3.2 § 5.73(a)(1) (1) Ensure compliance with the safety risk controls established by the person. 3.2 § 5.73(a)(2) (2) Evaluate the performance of the SMS. 3.2 § 5.73(a)(3)

(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls.

3.2 § 5.73(a)(4) (4) Identify changes in the operational environment that may introduce new hazards. 3.2 § 5.73(a)(5) (5) Identify new hazards. 3.2 § 5.73(b)

(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part.

3.2

§ 5.75 Continuous improvement.

§ 5.75 Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73.

3.3

Subpart E Safety Promotion 4.0

§ 5.91 Competencies and training.

§ 5.91 Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS.

4.1

Page 100Open in PDF

Appendix A A-12 Part 5 Section Text ICAO Framework Components and Elements

§ 5.93 Safety communication.

§ 5.93 Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum:

4.2 § 5.93(a)

(a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities.

4.2 § 5.93(b) (b) Conveys hazard information relevant to the employee’s responsibilities. 4.2 § 5.93(c) (c) Explains why safety actions have been taken. 4.2 § 5.93(d) (d) Explains why safety procedures are introduced or changed. 4.2

Subpart F SMS Documentation and Recordkeeping. 1.5

§ 5.95 SMS documentation. 1.5 § 5.95 Any person required to have an SMS under this part must develop and maintain the following SMS documentation:

1.5.1 § 5.95(a) (a) Safety policy. 1.5.1 § 5.95(b) (b) SMS processes and procedures. 1.5.1

§ 5.97 SMS records. 1.5 § 5.97 Any person required to have an SMS under this part must:

§ 5.97(a)

(a) Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation.

1.5.2 § 5.97(b)

(b) Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years.

1.5.2

Page 101Open in PDF

Appendix A A-13 Part 5 Section Text ICAO Framework Components and Elements § 5.97(c)

(c) Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person.

1.5.2 § 5.97(d)

(d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months.

1.5.2

Page 102Open in PDF

Appendix B B-1 APPENDIX B. SAMPLE SAFETY RISK MANAGEMENT (SRM) WORKSHEETS B.1 The sample worksheets in this appendix are provided to illustrate the Safety Risk Management (SRM) process and a possible way to develop and document the SRM processes required under 14 CFR part 5 subpart C. These worksheets are provided for illustrative purposes only. Aviation organizations may develop their own recordkeeping systems and should determine the amount and depth of documentation and recordkeeping that are needed to show compliance. Not all situations will require the same degree of detail.

Page 103Open in PDF

Appendix B B-2 Figure B-1. Safety Risk Management Triggering Conditions and Summary Note: Refer to part 5, § 5.51.

Title:

Reason for Risk Assessment Implementation of new systems Revision of existing systems Development of operational procedures Identification of hazards or ineffective risk controls through the safety assurance processes in part 5 subpart D

Brief Summary

Where signed below, the responsible manager/process owner has determined that no new hazards have been introduced by this change.

Name:

Signature:

Page 104Open in PDF

Appendix B B-3 Figure B-2. System Analysis Note: Refer to § 5.53(a) and (b ).

Responsible Manager/Process Owner:

Authority for Implementation and Risk Acceptance:

Function and Purpose of the System or Change:

Description of Operating Environment

Personnel

Equipment

Facilities

Internal Interfaces

External Interfaces

Page 105Open in PDF

Appendix B B-4 Figure B-3. Hazard List Note: Refer to §§ 5.23(a)(1) and 5.53(c).

System/Project:

Responsible Manager/Process Owner:

Hazard Potential Consequence(s) H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 106Open in PDF

Appendix B B-5 Figure B-4. Risk Analysis Note: Refer to § 5.55(a).

Pre-Control Post-Control Hazard Potential Consequences Severity Likelihood Substitute Risk? Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 107Open in PDF

Appendix B B-6 Figure B-5. Risk Analysis and Assessment Summary Note: Refer to §§ 5.23(b) and 5.55(b).

Acceptance Authority (Sign Here and Initial Appropriate Columns):

Pre-Control Accept? Post-Control Accept?

Hazard Potential Consequences Severity Likelihood Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 108Open in PDF

Appendix B B-7 Figure B-6. Risk Control Note: Refer to § 5.55(c) and (d).

System/Project:

Responsible Manager/Process Owner:

Hazard Control Substitute Risk Residual Risk H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 109Open in PDF

Appendix B B-8 Figure B-7. Risk Control Documentation Note: Refer to part 5 subpart F.

System/Project:

Hazard Procedure Documentation H1 H2 H3 H4 H5 H6 H7 H8 H9 H10

Page 110Open in PDF

Appendix C C-1 APPENDIX C. GUIDANCE FOR DEVELOPING A SAFETY POLICY AND CODE OF

ETHICS STATEMENT C.1 Safety Policy Statement.

C.1.1 Many aviation organizations have developed a safety policy statement. The safety policy must contain the requirements in 14 CFR part 5, § 5.21 and be signed by the accountable executive (§§ 5.21(b) and 5.25(b)(2)). It could make sense to combine the code of ethics and a safety policy statement into a single document. References (“pointers”) to other manuals or documentation that provide guidance on how each requirement is met should be embedded in the safety policy statement. For example, the requirement for an emergency response plan (ERP) could be met by referring to a separate document or an appendix in a Repair Station Manual (RSM) or General Operations Manual (GOM). By pointing to where the information is located, it makes it easier for employees to find that material. A secondary benefit is it prevents duplication of documentation. It is important to remember the safety policy is unique to the aviation organization and should be developed to meet the unique and specific needs, operating profile, and structure of the aviation organization.

C.1.2 P art 5 list s the specific documentation requirements that must be included in the completed safety policy (§ 5.95). A safety policy statement is a document that states what the organization will do and how employees are expected to act. The SMS processes and procedures define actions employees will take to meet the safety policy requirements and measurable objectives (i.e., how they are to perform their SMS duties and responsibilities). A safety policy statement (if developed as a separate document) and safety policy processes and procedures are necessary when developing and maintaining an SMS for completeness.

C.2 C ode of Ethics.

C.2.1 Aviation organizations are required to develop a code of ethics for all employees, including management personnel and officers. The safety policy must include a code of ethics that specifies that safety is the organization’s highest priority and applies to all employees, including management personnel and officers. This requirement is in § 5.21(a)(7). A code of ethics defines the aviation organization’s standards of conduct that employees are expected to uphold. The code of ethics should be a concise statement that outlines values the aviation organization holds and maintains in the course of business. A code of ethics is a very high-level statement that gives employees at all levels of the organization a general idea of what types of behavior and decisions are acceptable and expected in the conduct of business. A code of ethics may be combined with a safety policy statement at the discretion of the aviation organization.

C.2.2 A safety policy and code of ethics statement should not be confused with the requirements of § 5.95, which requires aviation organizations to document their safety policy. All that needs to be documented in the safety policy and code of ethics statement is the aviation organization’s expectations.