U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Safety Management Systems for Aviation Service Providers Date: 8/12/10 Initiated by: AFS-900 AC No: 120-92A Change:
1. PURPOSE. This advisory circular (AC) provides a Framework for Safety Management System (SMS) development by aviation service providers. It contains a uniform set of expectations that align with the structure and format of the International Civil Aviation Organization (ICAO) Framework; and Aviation Safety (AVS) policy in Federal Aviation Administration (FAA) Order VS 8000.367, AVS Safety Management System Requirements, Appendix B.
2. APPLICABILITY.
a. Developing an SMS. This AC applies to both certificated and non-certificated aviation service providers (and organizations) that desire to develop and implement an SMS. This AC is not mandatory and does not constitute a regulation. Development and implementation of an SMS is voluntary. While the FAA encourages each aviation service provider to develop and implement an SMS, these systems are not substitutes for compliance with Federal regulations and must be developed , implemented and maintained to comply with all legal, regulatory and statutory requirements applicable to the SMS. However, for aviation service providers that elect to voluntarily implement an SMS, the FAA views the objectives and expectations in Appendix 1 to this AC to be the minimum for a comprehensive and robust SMS.
NOTE: Within the context of this document, the term aviation service provider refers to any organization providing aviation services. The term includes certificated and non-certificated aviation organizations, air carriers, airlines, maintenance repair organizations, air taxi operators, single pilot operators, corporate flight departments, repair stations, pilot schools, approved training organizations that are exposed to safety risks during the provision of their services. This includes all entities involved in Unmanned Aircraft System activities. The term aviation service provider is interchangeable with the term service provider and organization within this document.
b. FAA SMS Framework. The FAA SMS Framework is written as a functional expectations document. It stresses what the organization must do to implement a robust SMS rather than how it will be accomplished. At the same time, the FAA SMS Framework needs to be applicable to a wide variety of types and sizes of operators. Therefore, it is designed to be scalable and allow operators to integrate safety management practices into their unique business models.
Page 2 Par 3
3. RELATED READING MATERIAL. The following references, current editions, may be of value to users of this AC, as they develop their SMS:
• Annex 6 to the Convention on International Civil Aviation, Part 1, International Commercial Air Transport, Aeroplanes (with amendment 33).
• International Civil Aviation Organization (ICAO) Document 9859, ICAO Safety Management Manual (SMM, Second Edition, 2009).
• FAA Order 8000.369, Safety Management System Guidance.
• FAA Order VS 8000.367, Aviation Safety (AVS) Safety Management System Requirements.
• AC 120-59, Air Carrier Internal Evaluation Programs (IEP).
• AC 120-66, Aviation Safety Action Programs (ASAP).
• AC 120-79, Developing and Implementing a Continuing Analysis and Surveillance System (CASS).
• AC 120-82, Flight Operational Quality Assurance (FOQA).
4. BACKGROUND. The modern aviation system is characterized by increasingly diverse and complex networks of business/governmental organizations as well as increasingly advanced aircraft and equipment. The rapidly changing aviation operational environment requires these organizations to adapt continuously to maintain their viability and relevance.
a. SMS and System Safety. Systems can be described in terms of integrated networks of people and other resources performing activities that accomplish some mission or goal in a prescribed environment. Management of the system’s activities involves planning, organizing, directing, and controlling these assets toward the organization’s goals. Several important characteristics of systems and their underlying process are known as process attributes or safety attributes1 when they are applied to safety related operational and support processes. These process attributes must have safety requirements built in to their design if they are to result in improved safety outcomes. The attributes include:
(1) Responsibility and authority for accomplishment of required activities,
(2) Procedures to provide clear instructions for the members of the organization to follow,
(3) Controls which provide organizational and supervisory controls on the activities involved in processes to ensure they produce the correct outputs,
1 These six characteristics of systems, responsibility, authority, procedures, controls, process measures, and interfaces, are called safety attributes in the FAA’s Air Transportation Oversight System (ATOS).
(4) Measures of both the processes and their products, and
(5) Interfaces are a critical aspect of system management; recognizing the important interrelationships between processes and activities within the company as well as with contractors, vendors, customers, and other organizations with which the company does business.
b. Safety Culture. The Human Aspect of Organizations. “An organization’s culture consists of its values, beliefs, legends, rituals, mission goals, performance measures, and sense of responsibility to its employees, customers, and the community.2” The principles or attributes discussed above, that make up the SMS functions, will not achieve their goals unless the people that comprise the organization function together in a manner that promotes safe operations. The organizational aspect that is related to safety is frequently called the safety culture. The safety culture consists of psychological (how people think and feel), behavioral (how people and groups act and perform), and organizational or systematic (the programs, procedures, and organization of the enterprise) elements. The organizational/systematic elements are the things that are most under management control, the other two elements being outcomes of those efforts and other influences. For this reason, the FAA SMS Framework in Appendix 1 of this AC includes requirements for policies that will provide the structure for the SMS and requirements for organizational functions. These functions include an effective employee safety reporting system and clear lines of communication both up and down the organizational chain regarding safety matters.
5. THE FAA SMS FRAMEWORK: INTRODUCTION.
a. The Need for SMS.
(1) FAA Standardization. The FAA Associate Administrator for AVS is interested in developing an integrated functional SMS in which business and governmental roles and relationships are well defined, expectations are based upon sound systems engineering and system safety principles, and both regulators and regulated industries participate in a unified safety effort. The FAA SMS Framework in Appendix 1 provides the functional requirements to that end (development of aviation service provider’s SMS).
(2) ICAO SMS Requirements and the FAA. The ICAO, in a recent set of documents, manuals, and amendments3 for key annexes to the ICAO Conventions, has revamped its standards and recommended (SARP) practices to reflect a systems approach to safety management. This coincides with the FAA’s move toward a systems approach for oversight over the past several years. Because of the many diverse relationships between organizations and the above stated global nature of the aviation system, it is critical that the functions of an SMS be harmonized to the point that there is a common recognition of the meaning of SMS among all concerned, both domestically and internationally. Amendment 33 to ICAO Annex 6 introduced a
2 Manuele, Fred A. On the Practice of Safety. John Wiley & Sons, 2003, Hoboken, NJ.
3 International Civil Aviation Organization (ICAO) Document 9734, Safety Oversight Manual; ICAO Document 9859, Safety Management Manual, 2nd Edition, 2009; and ICAO Annex 6, Part 1 International Commercial Air Transport – Aeroplanes with Amendment 33.
Par 4 Page 3
12-element ICAO SMS Framework, which is reproduced below. The FAA SMS Framework in Appendix 1 is aligned with the ICAO SMS Framework; however the FAA SMS Framework provides additional details to facilitate a service provider’s implementation of an SMS.
TABLE 1. ICAO ANNEX 6, APPENDIX 7, FRAMEWORK FOR SAFETY
MANAGEMENT SYSTEMS
1. Safety policy and objectives
1.1 – Management commitment and responsibility
1.2 – Safety accountabilities
1.3 – Appointment of key safety personnel
1.4 – Coordination of emergency response planning
1.5 – SMS documentation
2. Safety risk management
2.1 – Hazard identification
2.2 – Safety risk assessment and mitigation
3. Safety assurance
3.1 – Safety performance monitoring and measurement
3.2 – The management of change
3.3 – Continuous improvement of the SMS
4. Safety promotion
4.1 – Training and education
4.2 – Safety communication
(3) Functional Expectations. The FAA SMS Framework (contained in Appendix 1 of this AC) is designed to provide definitive functional objectives and expectations that are compatible with auditing by the organization’s own personnel, regulators, or other third-party consultants. For this reason the FAA SMS Framework is described in a requirements-oriented tone (i.e., all the objectives and expectations stated are necessary for a functional, comprehensive, and robust SMS). To the maximum extent possible, each indexed statement defines a single expectation so that system auditors can easily use it.
b. Process Approach. As stated above, the FAA SMS Framework is written as a functional expectations document. It stresses what the organization must do rather than how it will be accomplished. This is important to the FAA and service providers alike. The FAA feels that each of the SMS processes detailed in the FAA SMS Framework is essential for a comprehensive SMS. At the same time, the FAA SMS Framework needs to be applicable to a wide variety of types and sizes of operators. This was a reason for using a similar scope, scale, and language to the International Organization for Standardization (ISO) standards, which also are designed for broad application. Therefore, the FAA SMS Framework is designed to be scalable to allow operators to integrate safety management practices into their unique business models. Operators are not expected to configure their systems in the format of the FAA SMS Framework or to duplicate existing programs that accomplish the same function. The FAA SMS Framework document in Appendix 1, attempts to balance flexibility of implementation and standardization of essential safety management processes.
Page 4 Par 5
c. Scalability. The SMS functions do not need to be extensive or complex to be effective.
Smaller organizations may use a paper log to document safety issues and a paper system or simple spreadsheet or word processor files to track them to resolution. Internal evaluation and management reviews may consist of periodic conferences between business owners or top management and other employees to review information and track progress toward resolution.
This can be done whether the organization operates under Title 14 of the Federal Code of Regulations (14 CFR) parts 91, 121, 133, and 135, public use, etc. A larger organization may need more sophisticated resources such as web-based data systems and trained safety personnel to manage the details and a more formal committee system to accomplish the same functions.
While sophisticated process development tools and methods are available, simple brainstorming sessions with managers, supervisors, and other employees are often most effective. In smaller organizations, the president, Chief Executive Officer (CEO) or owner may elect to conduct internal audits and internal evaluation functions themselves, in conjunction with the management review function. Likewise, in very small organizations the owner/operator may elect to conduct internal audits, continuous monitoring, document reviews, safety risk analysis/assessment and training review either personally or in conjunction with co-owners, managers, supervisors, or employees.
6. FOUR COMPONENTS (PILLARS) OF SAFETY MANAGEMENT. The FAA SMS Framework is organized around four building blocks of safety management. These four components or pillars are essential for a safety-oriented management system. They come directly from the SMS principles discussed earlier.
a. Policy. All management systems must define policies, procedures, and organizational structures to accomplish their goals. Component 1 in the FAA SMS Framework outlines expectations for these elements, which in turn provide the foundations for SMS functional elements.
b. Safety Risk Management (SRM). A formal system of hazard identification and SRM (Component 2) is essential in controlling risk to acceptable levels. The SRM function of the SMS is based upon the system safety process model that is used in FAA Order VS 8000.367, Appendix B.
c. Safety Assurance (SA). Once SRM controls (sometimes termed mitigations) are identified and operational, the operator must ensure the controls continue to be effective in a changing environment. The SA function (Component 3) provides for this, using system safety and quality management concepts and processes.
NOTE: Figure 1, shows how the SRM and SA functions relate to one another. The SRM function (design) provides for initial identification of hazards and assessment of risk. Organizational risk controls are developed and once they are determined to be capable of bringing the risk to an acceptable level, they are employed operationally. The SA function (performance) takes over at this point to ensure that the risk controls are being practiced and they continue to achieve their intended objectives. The SA function also provides for assessment of the need for new controls because of changes in the operational environment.
Par 5 Page 5
d. Safety Promotion. Finally, the operator must promote safety as a core value with practices that support a sound safety culture. Component 4 provides guidance for setting up these functions.
FIGURE 1. SAFETY RISK MANAGEMENT AND SAFETY ASSURANCE PROCESSES SRM SA Design Performance Risk Assessment System Assessment System Description (Analysis) System Operation Data Acquisition
Hazard Description And Context Specific Information Analysis Assessment Action: Problem Resolution Identification Risk Analysis Analysis Risk Control Corrective
7. THE FAA SMS FRAMEWORK.
a. General Organization of the FAA SMS Framework. The FAA SMS Framework aligns with the structure and format of ICAO Annex 6 to the Convention on International Civil Aviation, Operation of Aircraft and the ICAO SMS Framework contained in Document 9859, Chapter 8; incorporates the requirements of FAA Order VS 8000.367 and follows the principles of a Quality Management System (QMS) in accordance with ISO standards. The first part of the SMS functional expectations included as Appendix 1 follows the general organization of ISO 9000-2000 and ISO 14001. The first three sections describe scope and applicability, references, and definitions. The fourth section addresses each of the four components of SMS, as described Page 6 Par 6
below. The components are further defined in terms of elements and processes, each containing respective performance objectives and design expectations:
(1) Performance Objectives are the desired outcomes of the particular element or process under evaluation.
(2) Design Expectations are the characteristics of the element or process that, if properly implemented, should provide the outcomes identified in the performance objectives.
b. Policy. Setting the Foundation (Appendix 1, Component 1.0).
(1) Importance of Top Management Involvement. (Appendix 1, Component 1.0, Element 1.1 and 1.2) The FAA SMS Framework specifies that top management is primarily responsible for safety management. Managers must plan, organize, direct, and control employees’ activities and allocate resources to make safety controls effective. A key factor in both quality and safety management is top management’s personal and material involvement in quality and safety activities. The FAA SMS Framework also specifies that top management must clearly delineate safety responsibilities throughout the organization. While it is true that top management must take overall responsibility for safe operations, it is also true that all members of the organization must know their responsibilities and be both empowered and involved with respect to safety.
(2) The Three R’s of Safety Management: Roles, Responsibilities, and Relationships.
There is a relationship between the productive processes of the aviation service provider as well as the joint protective processes of the regulator (FAA oversight) and the aviation service provider’s SMS (SMS SA). On the production side, the operator has a role to provide a useful service or product. On the protection side (operator’s SMS), they have a role to provide a safe service or product. The FAA’s oversight role is to assure that the operator lives up to it statutory safety responsibilities. One of the principal roles of the oversight system is to establish risk controls in the form of regulations, standards, and policies. It follows that regulatory compliance, in a manner that accomplishes the regulations’ safety objectives, is also part of the aviation service provider’s role in safety management. It is the objective of the SMS concept to combine system safety based oversight systems and operator’s SMS’s into a cooperative, professional relationship, within the context of those roles.
(3) Procedures and Controls. (Appendix 1, Component 1.0) Two key attributes of systems are procedures and controls. Policies must be translated into procedures in order for them to be applied and organizational controls must be in place to ensure that critical steps are accomplished as designed. Organizations must develop, document, and maintain procedures to carry out their safety policies and objectives. Moreover, supervisory controls must be used to monitor the accomplishment of the procedures and ensure that employees understand their safety roles.
(4) Safety and Quality: Striking a Balance. (Appendix 1, Component 1.0) As discussed above, the FAA SMS Framework uses quality management principles, but it is the expectation that operators will manage their system based on an objective assessment of safety risk, at the same level as customer satisfaction with products or other conventional commercial goals. The Par 7 Page 7
management of process quality, with emphasis on characteristics of those processes that affect safety, is an important aspect of safety management. The FAA SMS Framework specifies that the aviation service provider should prescribe both safety and quality policies. The coverage of quality policies is limited in scope to quality in support of safety, although operators are encouraged to integrate their management systems as much as feasible. Safety objectives should be predominant where conflicts are identified.
c. SRM. Setting Expectations for Safety Management (Appendix 1, Component 2.0). The SRM process is used to examine the operational functions of the company and their operational environment to identify hazards and to analyze associated risk. The intent of the SRM process is to focus on the areas of greatest risk from a safety perspective, taking into account complexity, operational scope, etc.
NOTE: The SRM flow diagram (Figure 2, on the following page) includes the FAA SMS Framework element/process numbers and other notes to help the reader visualize the FAA SMS Framework in terms of a process flow (with interfaces, i.e., inputs and outputs), and understand the component/element/process expectations.
Page 8 Par 7
FIGURE 2. SAFETY RISK MANAGEMENT PROCESS FLOW
2.1 Hazard Identification & Analysis Start
(1) System Description and Task Analysis. (Appendix 1, Process 2.1.1) SRM begins with system design. This is true whether the system in question is a physical system, such as an aircraft, or an organizational system such as an operator, maintenance, or training establishment.
These systems consist of the organizational structures, processes, and procedures, as well as the
2.2 Risk Assessment & Control Outputs: To Safety Assurance, 3.0 b (1)
(b) Evaluate Controls
(2.2.3, Control/ Mitigate Safety Risk) Inputs: Safety Risk Management, 2.0 b
(2) (c) Hazards identified from Safety Assurance functions 3.0 b (1) (a), and from Safety Assurance, 3.1.8 b (3) Inputs: Safety Risk Management, 2.0 b (2) (a), (b) & (d) System Description & Task Analysis Hazard New System System Change New Operational Procedure Identification
(2.1.2)
Risk Analysis
(2.2.1) Risk Assessment
(2.2.2) Risk Control
(2.2.3) Par 7 Page 9
people, equipment, and facilities used to accomplish the organization’s mission. The system or task descriptions should completely explain the interactions among the organization (facilities, hardware, software, people, etc.) and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. While systems should be documented, no particular format is required. System documentation would normally include the operator’s manual system,4 checklists, organizational charts, and personnel position descriptions. A suggested functional breakdown of operational and support processes for air operators includes:
(a) Flight operations;
(b) Dispatch/flight following;
(c) Maintenance and inspection;
(d) Cabin safety;
(e) Ground handling and servicing
(f) Cargo handling; and
(g) Training.
NOTE: Long and excessively detailed system or task descriptions are not necessary, provided they are sufficiently detailed to perform hazard and risk analyses.
(2) Hazard Identification. (Appendix 1, Process 2.1.2) Hazards in the system and its operating environment must be identified, documented, and controlled. It also requires that the analysis process used to define hazards consider all components of the system, based on the system description detailed above. The key question to ask during analysis of the system and its operation is what if? As with system and task descriptions, judgment is required to determine the adequate level of detail. While identification of every conceivable hazard would be unlikely, aviation service providers are expected to exercise due diligence in identifying significant and reasonably foreseeable hazards related to their operations.
(3) Risk Analysis and Assessment. (Appendix 1, Process 2.2.1 and 2.2.2) The risk analysis and risk assessment components of the FAA SMS Framework use a conventional breakdown of risk by its two components: likelihood of occurrence of an injurious mishap and severity of the mishap related to an identified hazard, should it occur. A common tool for risk decisionmaking and acceptance is a risk matrix similar to those in the U.S. Military Standard (MIL STD 882) and the ICAO Safety Management Manual (SMM)5. Appendix 3 shows a model, example, and discussion of safety risk matrices. Operators should develop a matrix that
4 While SMS manuals are not required, operators and agencies may find them to be a practical means of documenting their policies and procedures.
5 The ICAO SMM is Document 9859 and is available at:
http://www.icao.int/anb/safetymanagement/Documents.html Page 10 Par 7
best represents their operational environment. Separate matrices with different risk acceptance criteria may also be developed for long-term versus short-term operations.
(4) Controlling Risk. (Appendix 1, Process 2.2.3) After hazards and risk are fully understood from the preceding steps, risk controls must be designed and implemented. These may be additional or changed procedures, new supervisory controls, addition of organizational hardware, or software aids, changes to training, additional, or modified equipment, changes to staffing arrangements, or any of a number of other system changes.
(a) Residual and Substitute Risk. (Appendix 1, Process 2.2.3) Residual risk is the risk remaining after mitigation has been completed. Often this is a multistep process, continuing until risk has been mitigated down to an acceptable level necessary put the system/process into operation (or continue operation). It is seldom possible to entirely eliminate risk, even when highly effective controls are used. After these controls are designed but before the system is placed back on line, an assessment must be made of whether the controls are likely to be effective and/or if they introduce new hazards to the system. The latter condition, introduction of new hazards, is referred to as substitute risk, a situation where the cure is worse than the disease.
The loop seen in Figure 2 that returns back to the top of the diagram depicts the use of the preceding systems analysis, hazard identification, risk analysis, and risk assessment processes to determine if the modified system is acceptable.
(b) System Operation. (Appendix 1, Process 2.2.3) When the controls are acceptable, the system is placed into operation. The next process, SA, uses auditing, analysis, and review systems that are familiar from similar quality management systems. These processes are used to monitor the risk controls to ensure they continue to be implemented as designed and continue to be effective in a changing operational environment.
d. SA. Managing the Expectations (Appendix 1, Component 3.0). Black’s Law Dictionary, a popular legal reference, defines assurance as something that gives confidence. Therefore, SA might be defined as activities designed to gain confidence that risk controls established during SRM (Appendix 1, Component 2.0) continue to be effective. The SA function applies the activities of safety assurance and internal evaluation to ensure that risk controls, once designed, continue to conform to their expectations and that they continue to be effective in maintaining risk within acceptable levels. These assurance and evaluation functions also provide a basis for continuous improvement.
NOTE: The SA Process Flow diagram (Figure 3, on the following page) includes the FAA SMS Framework element/process numbers and other notes to help the reader visualize the FAA SMS Framework in terms of a process flow (with interfaces, i.e., inputs and outputs), and understand the component/element/process expectations.
Par 7 Page 11
FIGURE 3. SAFETY ASSURANCE PROCESS FLOW
(1) System Operation - Performance Monitoring and Measurement. Establishment of satisfactory risk controls through the SRM process allows a process or system to be put into, or continue operation. The SA process starts with a System Description which adds structure and helps map organizational responsibilities, functions and interfaces. SA processes concentrate on proving, through collection and analysis of objective evidence (i.e., documents, records, etc.), System Operation Data Acquisition Process Analysis System Assessment Corrective Action Inputs:
From SRM 2.2.2 b & 2.2.3 b (2) (b), into SA: 3.0 b (1) (b) Outputs: 3.1.8 System Assessment, b (3), into Safety Risk Management 2.0 b (2) (c) Note: Each data source should be traceable through Analysis (3.1.7, b (1)), Assessment (3.1.8, b (1)), and Corrective Action (3.3.1, b (1)), where necessary.
3.1.1 Continuous Monitoring
3.1.2 Internal Audits
3.1.3 Internal Evaluation
3.1.4 External Evaluation
3.1.5 Investigations
3.1.6 Employee Reporting
3.1.7 Analysis of Data
3.1.8 System Assessment
3.3.2 Management Review
3.1 Performance Monitor & Measure * *
3.3.1 Preventative/Corrective Action Page 12 Par 7