AC 120-92D

U .S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Safety Management Systems for Aviation Service Providers Date: 5/21/24 AC No: 120-92D Initiated by: AFS-900 Change:

This advisory circular (AC) provides information on implementing a Safety Management System (SMS) based on Title 14 of the Code of Federal Regulations (14 CFR) part 5 for aviation service providers operating or applying for a certificate or Letter of Authorization (LOA) to operate under 14 CFR part 91, § 91.147 o r part 121 or 135. This AC may also be used by aviation organizations interested in receiving Federal Aviation Administration (FAA) acknowledgement of their voluntary development and implementation of an SMS that meets part 5 requirements.

Additionally, part 5 provides organizations with a method to meet the International Civil Aviation Organization (ICAO) Annex 19, Safety Management, fra mework for an SMS “acceptable to the State.”

An SMS is an organization-wide, comprehensive, and preventive approach to ensuring system saf ety. An SMS includes a safety policy, promotion of a positive safety culture, formal methods for identifying hazards and mitigating risk, and assurance of the overall safety performance of aviation organizations. An SMS is intended to be designed and developed so the aviation organization’s employees are able to manage risks as a part of the operations and business decision-making processes. An SMS assists an aviation organization’s leadership, management teams, and employees in making effective and informed safety decisions.

Part 5 specifies a basic set of processes integral to an effective SMS but does not specify particular methods for implementing these processes. In other words, it defines what must be accomplished but not how it must be accomplished. This AC provides guidance on how an SMS may be developed to achieve the safety performance objectives outlined by an aviation organization. As is demonstrated by this AC, there is no one-size-fits-all method for complying with the requirements of part 5 or establishing a voluntary SMS. This is intentional because the FAA expects each organization to develop an SMS that works for their unique operation. This AC provides guidance regarding designing, developing, and implementing an SMS and the acceptable methods of compliance with the requirements of part 5 as well as developing a voluntary SMS. However, these methods are not the only means of complying with part 5 or implementing a voluntary SMS.

Hugh T homas for Lawrence Fields Executive Director, Flight Standards Service

ii

CONTENTS Paragraph Page

Chapter 1. Introduction1-1

1.1 Purpose of This Advisory Circular (AC)1-1

1.2 Audience1-1

1.3 Where You Can Find This AC1-2

1.4 What This AC Cancels1-2

1.5 Effective Date1-2

1.6 Implementation Strategies1-2

1.7 Contact Information1-2

1.8 Terminology1-2

1.9 AC Feedback Form1-2

Chapter 2. Safety Management System (SMS) Foundations2-1

2.1 SMS Fundamentals2-1

2.2 Conceptual Overview of Safety Assurance and SRM2-2

2.3 Safety Assurance and Interactions With SRM2-3

2.4 SRM2-4

2.5 Safety Culture and Safety Management2-5

2.6 Definitions2-6

Chapter 3. Safety Management System (SMS) Components Explained3-1

3.1 Overview of This Chapter3-1

3.2 Subpart A, General3-2

3.3 Subpart B, Safety Policy3-11

3.4 Subpart C, Safety Risk Management3-26

3.5 Subpart D, Safety Assurance3-43

3.6 Subpart E, Safety Promotion3-59

3.7

Subpart F, SMS Documentation and Recordkeeping3-63

Chapter 4. Implementation: Building A Safety Management System (SMS)4-1

4.1 Process Overview4-1

4.2 Building an SMS4-1

iii Chapter 5. Integrating Existing Safety Programs Into the Safety Management

System (SMS)5-1

5.1 Purpose of This Chapter5-1

5.2 Discussion of Individual Programs5-1

5.3 Use of Third-Party Providers to Assist in SMS Implementation and Maintenance5-4

Appendix A. SMS Cross-Reference From Part 5 to the ICAO FrameworkA-1

Appendix B. Sample Safety Risk Management (SRM) WorksheetsB-1

Appendix C. Guidance for Developing a Safety Policy and Code of Ethics StatementC-1

Appendix D. Guidance for Developing a Compliance StatementD-1

Appendix E. Identifying the Accountable ExecutiveE-1

Appendix F. Safety AttributesF-1

Appendix G. Small Operator ImplementationG-1

Appendix H. References and Additional InformationH-1

Appendix I. Acronyms and AbbreviationsI-1

List of Figures

Figure 2-1. Safety Management Decision-Making Processes2-3

Figure 3-1 . Hazard Notification Process3-41

Figure B-1. Safety Risk Management Triggering Conditions and SummaryB-2

Figure B-2. S ystem AnalysisB-3

Figure B-3. H azard ListB-4

Figure B-4. R isk AnalysisB-5

Figure B-5 . Risk Analysis and Assessment SummaryB-6

Figure B-6. R isk ControlB-7

Figure B-7. Risk Control DocumentationB-8

Figure C-1. Sample Safety Policy and Code of Ethics StatementC-2

Figure E-1. A ccountable Executive Decision ProcessE-2

Figure E-2. V erifying the Accountable ExecutiveE-3

iv List of Tables

Table 3-1. Sample Risk Matrix3-34

Table A-1. Part 5 to ICAO SMS Framework Cross- ReferenceA-1

Table D-1 . Sample Compliance Statement for Aviation Organizations That Are

Required to Maintain a Manual SystemD-2

Table D-2 . Sample Compliance Statement for Aviation Organizations That Are

Not Required to Maintain a Manual SystemD-3

Table F-1 . Safety Attributes and Part 5 ReferenceF-6

Table G-1. Small Aviation Organization Implementation Strategies and ConsiderationsG-2

1-1 CHAPTER 1. INTRODUCTION

1.1 Purpose of This Advisory Circular (AC). This AC provides information to assist aviation organizations including but not limited to those regulated under Title 14 of the Code of Federal Regulations (14 CFR) parts 91, 121, 125, 133, 135, 137, 141, 142, 145, and 147 in developing a Safety Management System (SMS) that meets the regulatory requirements of 14 CFR part 5 or in developing a voluntary SMS. It describes an acceptable means, but not the only means, to implement and maintain an SMS.

Complying with part 5 assists organizations in meeting the SMS standards of the International Civil Aviation Organization (ICAO), as published in ICAO Annex 19, Safety Management.1 The contents of this document do not have the force and effect of law and are not meant to bind the public in any way, and the document is intended only to provide information to the public regarding existing requirements under the law or agency policies. This AC may also be used by aviation organizations interested in developing a voluntary SMS.

1 ICAO safety management standards require service providers of airplanes over 27,000 kilograms (kg) to include a Flight Data Analysis (FDA) program as part of their SMS. Part 5 does not require these programs. However, operators desiring to implement a flight operations quality assurance (FOQA) (the FAA equivalent to FDA) program on a voluntary basis can obtain FAA approval for these programs. For more information, refer to AC 120-82, Flight Operational Quality Assurance.

1.1.1 Int egration. An SMS is not meant to be a separate system built alongside or on top of other business systems. An SMS should be integrated into existing business structures to support system safety. A properly integrated SMS fosters a fundamental and sustainable change in how aviation organizations view and analyze data and information, how informed decisions are made, and how new operational and business methods are developed. An effective SMS can assist aviation organizations in meeting other regulatory requirements. However, aviation organizations that develop an SMS meeting part 5 requirements should remain aware that an SMS is not a substitute for compliance with other Federal regulations.

Note: It is not the intent or purpose of an SMS to override any existing regulatory stand ards or alter approval and acceptance processes that already apply to the aviation organization. SMS requirements are in addition to any existing statutory or regulatory obligations.

1.2 Audience. This AC is directed to the following aviation organizations operating under 14 CFR who are designing, developing, and implementing an SMS:

1. Existing and prospective Air Carrier Certificate holders and Letter of Authorization (LOA) holders to whom part 5 is applicable (part 91, § 91.147 and parts 121 and 135).

2. Other aviation organizations such as, but not limited to, parts 91, 125, 133, 137, 141, 142, 145, and 147 who m ay want a Federal Aviation Administration (FAA)-acknowledged voluntary SMS.

1-2

1.3 Where You Can Find This AC. You can find this AC on the FAA’s website at https://www.faa.gov/regulations_policies/advisory_circulars and the Dynamic Regulatory System (DRS) at https://drs.faa.gov.

1.4 What This AC Cancels. AC 120-92B, Safety Management Systems for Aviation Service Providers, dated January 8, 2015, is canceled.

1.5 Effective Date. The effective date of this AC is May 28, 2024.

1.6 Implementation Strategies. As a performance-based rule, part 5 describes a desired end state but does not generally prescribe the means for achieving that end state. Because aviation organizations range widely in complexity, each aviation organization implementing an SMS to comply with part 5 should tailor its SMS policies, methods, and procedures as needed. This concept is widely referred to as scalability. Although an aviation organization is free to adjust its means of achieving compliance with all sections of part 5, this scalability does not allow the aviation organization to set aside any sections of part 5. This AC will provide useful considerations and some examples of how an aviation organization may integrate new practical, economical, and effective SMS methods and procedures that complement their existing operations and processes while leveraging the policies, procedures, or methods already in place that comply with part 5.

1.7 Contact Information. For additional information or suggestions, contact the Safety Analysis and Promotion Division, Flight Standards Safety Management System (SMS) Program Office at 9-NATL-SMS-ProgramOffice@faa.gov.

1.8 Terminology. Throughout this AC, the term “aviation organization” is used. The FAA uses this term to mean the operator, service provider, certificate holder (CH), or other entity subject to or voluntarily complying with part 5 requirements.

1.9 AC Feedback Form. For your convenience, the AC Feedback Form is the last page of this AC. Note any deficiencies found, clarifications needed, or suggested improvements regarding the contents of this AC on the Feedback Form.

2-1 CHAPTER 2. SAFETY MANAGEMENT SYSTEM (SMS) FOUNDATIONS

2.1 SMS Fundamentals.

2.1.1 What is an SMS? An SMS is a formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. An SMS does not have to be an extensive, expensive, or sophisticated array of techniques to do what it is supposed to do. Rather, an SMS is built by structuring safety management around four components: safety policy, Safety Risk Management (SRM), safety assurance, and safety promotion. A brief description of these components is provided below.

2.1.2 S afety Policy . Safety policy is where an aviation organization sets objectives, assigns responsibilities, and sets standards for the organization and employees. It is also where management conveys its commitment to the safety performance of the organization to its employees. As SRM and safety assurance processes are developed, the aviation organization revisits the safety policy to ensure that the commitments in the policy are being realized and the standards are being upheld.

2.1.3 S afety Risk Management (SRM) . The SRM component provides a decision-making process for identifying hazards and mitigating risk based on a thorough understanding of the organization’s systems and their operating environment. SRM includes decision making regarding what level of safety risk is acceptable. The SRM component is the organization’s way of fulfilling its commitment to consider risk in their operations and to eliminate risk or reduce it to an acceptable level. In that sense, SRM is a design process and a way to incorporate risk controls into processes, products, and services or to redesign controls where existing ones are not meeting the organization’s expectations.

2.1.4 S afety Assurance. Safety a ssurance provides aviation organizations with the necessary processes to promote confidence that the system is meeting defined safety objectives and that implemented mitigations or existing risk controls are working. In safety assurance, the goal is to monitor what is going on and review what has happened to ensure safety objectives are being met. Thus, safety assurance requires monitoring and measuring safety performance of operational processes and continuously improving the level of safety performance. Strong safety assurance processes will yield information used to maintain the integrity of risk controls. Safety assurance processes are thus a means of assuring the safety performance of the organization, keeping it on track, and identifying needs for rethinking (or correcting) existing processes.

2.1.5 S afety Promotion . The last component, safety promotion, is designed to ensure that employees have a solid understanding regarding their safety responsibilities and the aviation organization’s safety policies and expectations, reporting procedures, and risk controls. Thus, training and communication are key areas of safety promotion.

2.1.6 S ummary . An SMS does not have to be large, complex, or expensive in order to add value. Active involvement of operational leaders, maintaining open lines of

2-2 communication up and down the aviation organization and among peers, staying vigilant in looking for new hazards and identifying associated risks, and ensuring that employees know that safety is an essential part of their job performance are key elements that can have a positive effect on the aviation organization’s SRM decisions.

2.2 Conceptual Overview of Safety Assurance and SRM.

2.2.1 Graphical Overview of Safety Assurance and SRM Processes. Figure 2-1, Safety Management Decision-Making Processes, provides an expanded view of the principal processes of the SMS: safety assurance and SRM. In the discussion that follows, some key terms and concepts related to SMS processes will be introduced. A more detailed discussion of the SRM and safety assurance processes is presented below each regulatory requirement in Chapter 3, Safety Management System (SMS) Components Explained.

Because safety management is a decision-making process, SRM and safety assurance follow a structured set of processes outlined in Figure 2-1.

Figure 2-1. Safety Management Decision-Making Processes Performance Design Safety Safety Risk Assurance Management System System Monitoring Analysis § 5.71 (a) § 5.53(a) & (b) Data Hazard Acquisition Identification External Hazard § 5.71 (a) § 5.53(c) § 5.57 Analysis Risk of Data Analysis § 5.71(b) § 5.55(a) Risk Assessment System § 5.73(b) Assessment § 5.73(a) § 5.55(b) Corrective Risk § 5.55(đ) Action Control § 5.75 § 5.55(c)

2.3 Safety Assurance and Interactions With SRM.

2.3.1 Safety assurance processes monitor the day-to-day life cycle of system operations, (System Monitoring) with the designed risk controls in place. A variety of data sources (Data Acquisition), such as audits, investigations, and employee reporting, are utilized.

These will be further explained in Chapter 3. The safety assurance process involves 2-3

2-4 several steps. Once the data has been obtained, the process owner analyzes the data that will be used in decision making (Analysis of Data). The decision making can result in several possible outcomes (System Assessment). If the data and analysis indicate the processes, procedures, and integrated risk controls are functioning as intended, the result is satisfactory, and management can have confidence that organizational goals and safety objectives are being met.

2.3.2 If a negative result is identified, the organization should continue the analysis to determine if the shortfall is due to the controls not being used as intended (e.g., required training not accomplished, procedures not followed, or improper tools or equipment provided). If a negative result is identified and the system is being used as intended, the system is not producing the expected results. In the former case, action should be taken to correct the problem (Corrective Action). In the latter case, system design should be reconsidered using the path back to the SRM process.

2.3.3 The identification of a new hazard or ineffective risk control during the safety assurance process requires an organization to initiate the SRM process. For organizations transitioning into an SMS, the SRM process may initially be challenging if their operational systems have not been built using a risk management process because they may lack formal or well-understood risk controls.

2.3.4 Managers or process owners who are responsible for operational processes are also responsible for assuring that their process areas are performing as intended from an aviation safety standpoint.

2.4 SRM.

2.4.1 In SRM, the first step, System Analysis, is used to understand the processes and procedures being developed or revised or where new hazards or changes of the operational environment have been identified. The system analysis needs to consider the operating environment, the personnel involved in the operation, the equipment being used, any training needed, operational procedures, and interfaces with other processes or procedures. In most cases, hazard identification flows from this system analysis. Hazard identification requires process owners to ask questions such as:

1. What hazards exist in the operational environment?

2. What are the human factors (HF) issues of the operation (e.g., workload, distraction, fatigue, or system complexity)?

3. What are the limitations of the hardware, software, procedures, etc.?

2.4.2 Although Figure 2-1 above depicts these processes as distinctly defined components, they flow from one to the other in practice. For example, in a careful discussion of how a system currently works (System Analysis), hazards will often become evident. Thus, the Hazard Identification step has also been at least partially accomplished.

2.4.3 The process owner then conducts an analysis of the potential consequences of operation in the presence of the identified hazards (Risk Analysis). This culminates in an

2-5 assessment of the acceptability of operating with these hazards (Risk Assessment) or whether or not the risk of such operations can be eliminated or mitigated to an acceptable level (Risk Control). Operational managers or process owners2 must be the ones who are accountable for risk acceptance and mitigation decisions.

2 An organization may need to identify those personnel who “manage processes” but are not necessarily managers with a place on the organizational chart. Field experience has proven that the process owner terminology is necessary to allow aviation organizations to develop protocols that keep simple design change decisions at the level appropriate to the acceptance of risk.

2.4.4 After a system has been designed or revised using the SRM process, special attention should be given to the new or revised system using the safety assurance process. It should not be surprising to find at this time that there are still things that might not have been considered or that there are changes over time in the operational environment that require a return to SRM. Thus, the SRM and safety assurance processes operate in a continuous exchange.

2.5 Safety Culture and Safety Management. The culture of an organization is demonstrated through the organization’s values, traits, and behaviors. The term “safety culture” is used to describe those aspects of the organization’s culture relating to its safety performance. An organization that has a positive safety culture embraces open communication and continuous improvement. Management’s consistent attention, commitment, involvement, and visible leadership are essential in guiding an organization toward a positive safety culture. A positive safety culture matures as safety management skills are learned, practiced, and become second nature across the entire organization.

The following are practices and characteristics of organizations that foster a positive safety culture.

2.5.1 Open Reporting. Organizations should have policies and processes that foster open reporting while stressing the need for continuous diligence and professionalism.

Organizations should encourage disclosure of error without fear of reprisal (as long as the issue being reported was not caused through intentional misconduct or gross negligence) and should demand accountability on the part of employees and management alike. Part 5 requirements include provisions for aviation organizations to discuss hazard reporting in their safety policy (part 5, § 5.21(a)(4)) and in their safety assurance processes (§ 5.71(a)(7)).

2.5.2 Just Culture. The organization should engage in identification of systemic errors, implement preventative corrective action, and exhibit intolerance of undesirable behaviors, such as intentional misconduct or willful disregard for established procedures.

This is often referred to as a “just culture.” A just culture can be defined as a values-centered model of shared accountability, which will result in higher levels of confidence in safety outcomes at all levels of an organization. Organizations with a just culture encourage open communication that is nonretributive and encourages employees to admit mistakes so corrective actions can be implemented and potential hazards reduced. The following characteristics have an effect on an organization’s just culture.

2-6

2.5.2.1 Personnel Involvement. Involvement of personnel at all levels of an organization is critical to effective safety management. All employees who are directly involved with aviation safety play a key role in hazard identification and open communication.

2.5.2.2 Use of Information. Effective use of relevant information ensures informed management decision making.

2.5.2.3 Commitment to Risk Reduction. Management directly involves itself in identifying hazards and managing risk.

2.5.2.4 Vigilance. Processes that monitor ongoing operations and the environment increase effectiveness of risk controls and awareness of emerging hazards.

2.5.2.5 Flexibility. The organization uses information effectively to adjust and change to reduce risk and is willing to commit resources to making changes necessary to reduce risk.

2.5.2.6 Learning. The organization learns from its own failures and from those of allied and similar businesses. The organization uses acquired data to feed analysis processes and assess performance, the results of which yield information that can be acted on to improve safety.

2.5.2.7 Code of Ethics. A code of ethics is a set of principles designed to help aviation professionals conduct aviation operations honestly, with integrity, and with safe operations at the core of all decisions.

2.5.2.8 Safety Attributes. System safety attributes are the core characteristics that are integrated into all processes and procedures. For additional discussion, see Appendix F, Safety Attributes.

2.5.3 Management Involvement. An organization’s employees look to executive leadership to demonstrate their visible commitment to and involvement in safe operation while performing their daily work. SMS processes do not have to be expensive or sophisticated;

however, active personal involvement of operational leaders is essential. Effective safety management is accomplished by those individuals who “own” the processes in which risk resides. Safety cultures also cannot be “created” or “implemented” by management decree no matter how sincere their intentions. Every organization has a safety culture. It is embodied in the way the organization and its members approach safety in their jobs. If positive aspects of culture are to emerge, the organization’s senior management must set up the policies and processes that create a working environment that fosters safe behavior, and they should lead by example.

2.6 Definitions. The following definitions are used throughout this AC.

2.6.1 Compliance Statement. A document developed by an aviation organization that states how the organization complies with part 5. For specific information on developing a