that process or system expectations continue to be met. In an SMS, the system’s requirements are based on assessment of risk in the organization’s operation or in the products that it produces, as discussed above. SA techniques, including internal auditing and evaluation, are used to determine if risk controls designed into the operator’s processes are being practiced and are performing as designed. If an operator already has a comprehensive IEP, it should be reviewed to ensure that it conforms to the SMS SA expectations.6
(2) Data Acquisition Process - Getting the facts.
(a) Continuous Monitoring. (Appendix 1, Process 3.1.1) Information for SA comes from a variety of sources, including continuous process monitoring of day-to-day activities and inputs from employees through employee reporting systems. While each of these types of information sources exists to some degree in every organization, the FAA SMS Framework formalizes requirements for each. Line managers are the technical experts in any organization and thus the most knowledgeable about the specific processes involved. Line managers of the operational departments should exercise their responsibility for monitoring these processes and periodically assessing the status of routine operations and risk controls.
Specifications for these and other related SA processes are left at a functional level, allowing individual organizations to tailor them to the scope and scale appropriate for their size and type of organization.
(b) Internal Audits by Operating Departments. (Appendix 1, Process 3.1.2) Top management has the ultimate responsibility and authority for the SMS; however, line managers of operational departments have the daily responsibility for quality control and for ensuring that the processes in their areas of responsibility function as designed. Thus, the primary responsibility for safety management rests with those who own the technical processes. It is here where hazards are most directly encountered, where deficiencies in processes contribute to risk, and where direct supervisory control and resource allocation can mitigate the risk to acceptable levels. Line managers exercise their responsibility through internal auditing of their process. The FAA SMS Framework specifies a responsibility for internal auditing of the operator’s productive processes. As with other requirements, the FAA SMS Framework’s auditing requirements are left at a functional level, allowing for a broad range of complexity, commensurate with the complexity of the organization.
(c) Internal Evaluation. (Appendix 1, Process 3.1.3) This function involves evaluation of the technical processes of the operator and the SMS-specific functions. Audits conducted for the purpose of this requirement must be conducted by people or organizations that are functionally independent of the technical process being evaluated. For example, a flight training department may be evaluated by a safety specialist, quality assurance department or another organization, as directed by top management, but may not be evaluated by personnel who are under the control of the flight training department. The internal evaluation function also requires evaluation of the safety management functions, policymaking, SRM, SA, and safety
6 The SA functions in the SMS Framework contained in Appendix 1 were derived almost directly from ISO 9000-2000, the international quality management standard and the IEP development guidance in AC 120-59.
Par 7 Page 13
promotion. These evaluations provide management officials with objective evidence with which to evaluate the SMS itself.
NOTE: The provisions of the FAA SMS Framework are not intended to duplicate the functions of a Continuing Analysis and Surveillance System (CASS) (required for operators under part 121 or part 135) or IEP. In fact, the FAA encourages an integrated approach where these programs are all part of a comprehensive SMS.
(d) External Audits. (Appendix 1, Process 3.1.4) External audits of the SMS may be conducted by the regulator (FAA), code-share partners, customer organizations, or other third parties selected by the operator. These audits not only provide a strong interface with the Safety Oversight System (SAS) but also a secondary assurance system. Organizations may elect to have third-party audits of their SMS from organizations such as the International Air Transport Association (IATA) or other consultant organizations. It is not the intent of an SMS to require the arrangement or purchase of external audits, especially by small operators. However, if external audits are conducted of the organization, the data collected should be used by the organization in their data acquisition process.
(e) Investigations. (Appendix 1, Process 3.1.5) Investigation of safety occurrences should have the objective of identifying systemic safety deficiencies (poor system design, failed controls, failed preventative/corrective actions, etc.) rather than assigning blame. It is not as important to identify who did it as it is to learn why it happened. System resilience can be much more effectively reinforced by removing systemic deficiencies than by removing individuals, who may only be caught in the human activity of making mistakes.
(f) Employee Reporting System. (Appendix 1, Process 3.1.6) The FAA SMS Framework specifies that the aviation service provider must provide for a means of employee communication that allows for timely submission of reports on safety deficiencies without fear of reprisal The main objective of an employee safety reporting and feedback system is to establish and maintain an environment in which employees can report hazards, issues and concerns, as well as occurrences, incidents, etc., and propose safety solutions and improvements.
Employees must be encouraged by top management to use the employee reporting system without fear of reprisals. Data from the safety reporting and feedback system should be monitored to identify emerging hazards. Additionally, data collected in the safety reporting and feedback system should be included in all SMS analysis functions. Many certificated operators already have invested in ASAP. ASAP is a collaborative, reporting, analyses and problem solving effort among the FAA, operators, and employee unions. As mentioned earlier, this program is an example of a voluntary program that could be integrated into the SMS (providing it encompasses the entire organization), having a strong potential to contribute to SA and Safety Promotion.
(3) Analysis and Assessment. (Appendix 1, Processes 3.1.7 and 3.1.8) Audits and other information gathering activities are useful to management only if the information is provided in a meaningful form and conclusions are drawn to form a bottom-line assessment. Recall that a primary purpose of the SA process is to assess the continued effectiveness of risk controls put into place by the SRM process. Where significant deviations to existing controls are discovered, Page 14 Par 7
the FAA SMS Framework requires a structured, documented process for preventive and corrective action to place the controls back on track.
(4) Management of Change. (Appendix 1, Element 3.2) A management of change process should identify changes within the organization which may affect established processes, procedures, products, and services. Before implementing changes, a management of change process should describe the arrangements to ensure safety performance. The result of this process is the reduction in the safety risks resulting from changes in the provision of services by the organization. Management of change should consider the criticality of the system and activities, the stability of the system and operational environment and past performance of the system.
(5) Continuous Improvement. (Appendix 1, Element 3.3) The organization must continuously improve the effectiveness of the SMS and of safety risk controls through the use of the safety and quality policies, objectives, audit and evaluation results, analysis of data, corrective and preventive actions, and management reviews. As part of the SA function, the analysis and assessment functions must alert the organization to significant changes in the operating environment, possibly indicating a need for system change to maintain effective risk control. When this occurs, the results of the assessment start the SRM process, as depicted in Figure 3. One of Dr. James Reason’s principles of organizational safety culture is that of a learning culture.7 The information in reports, audits, investigations, and other data sources is not useful if the organization does not learn from it. The FAA SMS Framework requires an analysis process, a preventive/corrective action process, and a path to the SRM process for the development of new safety controls, as environments change and new hazards are identified. It further requires that the organization provide training and information about risk controls and lessons learned.
(a) Corrective Action and Followup. (Appendix 1, Process 3.3.1) The SA process should include procedures that ensure that corrective actions are developed, documented, and tracked in response to findings of audits and evaluations, and to verify their timely and effective implementation. Organizational responsibility for the development and implementation of corrective actions should reside with the operational departments cited in audit and evaluation findings. If new hazards are discovered, the SRM process should be employed to determine if new risk controls should be developed.
(b) Management Review. (Appendix 1, Process 3.3.2) Top management should conduct regular reviews of the SMS, including outputs of SRM, SA, and lessons learned.
Management reviews should include assessing the performance and effectiveness of an organization’s operational processes and the need for improvements.
e. Safety Promotion. (Appendix 1, Component 4). Top Management has the responsibility to promote the growth of a positive safety culture. The effectiveness of an SMS program is in direct proportion to the commitment and dedication put forth by top management. Management must provide adequate employee education and training to promote safety awareness and regularly communicate safety policy, goals, objectives, standards, and performance throughout
7 Reason. Managing the Risks of Organizational Accidents.
Par 7 Page 15
Page 16 Par 7
the organization. Additionally, management must provide a safety information system that provides an accessible, efficient means to retrieve safety information.
(1) Safety Cultures. (Appendix 1, Component 4.0) A safety effort cannot succeed by mandate only or strict implementation of policy. Where individual attitudes are concerned, organizational cultures set by top management establishes the tone that enhances the performance and efficiency of the entire SMS. Cultures consist of psychological (how people think and feel), behavioral (how people and groups act and perform) and organizational (the programs, procedures, and organization of the enterprise) elements. An organization’s culture consists of the values, beliefs, mission, goals, and sense of responsibility held by the organization’s members. The culture fills in the blank spaces in the organization’s policies, procedures, and processes and provides a sense of purpose to safety efforts. Dr. James Reason, and other organizational system safety theorists, stresses the need for a reporting culture as an important aspect of safety culture. The organization must do what it can to cultivate the willingness of its members to contribute to the organization’s safety efforts. Dr. Reason further stresses the need for a just culture, where employees have the confidence that, while they will be held accountable for their actions, the organization will treat them fairly.8
(2) Competencies and Training. (Appendix 1, Processes 4.1.1 and 4.1.2) There are process expectations in the Safety Promotion component (4.0) of the FAA SMS Framework to ensure employees, throughout the organization, are trained and competent on their safety-related job functions. Additionally, it is important for all employees to know how to report safety concerns and know that it is their responsibility to do so.
(3) Communication and Awareness. (Appendix 1, Element 4.2) Top Management should communicate the outputs of its SMS to its employees, and should provide its oversight organization access to SMS outputs in accordance with established agreements and disclosure programs. The processes specified in the Safety Policy, SRM, SA, and Safety Promotion components of the SMS provide the structure for the organizations processes. However, the organization must also set in place processes that allow for open communication among employees and the organization’s management. The aviation service provider must make every effort to communicate its goals and objectives, as well as the current status of the organization’s activities and significant events. Likewise, the organization must supply a means of upward communication in an environment of collaboration, trust, and respect.
8. CONTACT. For additional information or suggestions, please contact the Flight Standards Service, SMS Program Office, AFS-920, at (703) 661-0516.
ORIGINAL SIGNED by /s/ John W. McGraw for
John M. Allen Director, Flight Standards Service
8 Reason. Managing the Risks of Organizational Accidents.
Appendix 1
CONTENTS Paragraph Page APPENDIX 1. AVIATION SERVICE PROVIDER SAFETY MANAGEMENT SYSTEM
FRAMEWORK: FUNCTIONAL EXPECTATIONS (26 pages)3
1. Purpose of This Appendix3
2. Scope and Applicability3
3. References3
4. Definitions4
5. SMS Framework: Functional Expectations10
5.1 Structure10
5.2 Expectations10
5.3 Elements and Processes10
Component 1.0 Safety Policy and Objectives10
Element 1.1 Safety Policy12
Element 1.2 Management Commitment and Safety Accountabilities13
Element 1.3 Key Safety Personnel13
Element 1.4 Emergency Preparedness and Response14
Element 1.5 SMS Documentation and Records14
Component 2.0 Safety Risk Management (SRM)16
Element 2.1 Hazard Identification and Analysis17
Process 2.1.1 System Description and Task Analysis17
Process 2.1.2 Identify Hazards17
Element 2.2 Risk Assessment and Control18
Process 2.2.1 Analyze Safety Risk18
Process 2.2.2 Assess Safety Risk19
Process 2.2.3 Control/Mitigate Safety Risk19
Component 3.0 Safety Assurance19
Element 3.1 Safety Performance Monitoring and Measurement20
Process 3.1.1 Continuous Monitoring20
Process 3.1.2 Internal Audits by Operational Departments20
Process 3.1.3 Internal Evaluation22
Process 3.1.4 External Auditing of the SMS23
Process 3.1.5 Investigation23
Process 3.1.6 Employee Reporting and Feedback System23
Process 3.1.7 Analysis of Data24
Process 3.1.8 System Assessment24
Element 3.2 Management of Change25
Element 3.3 Continuousw Improvement25
Process 3.3.1 Preventive/Corrective Action26
Process 3.3.2 Management Review26
Component 4.0 Safety Promotion27
Appendix 1
Element 4.1 Competencies and Training27
Process 4.1.1 Personnel Expectations (Competence)28
Process 4.1.2 Training28
Element 4.2 Communication and Awareness28
Appendix 1 APPENDIX 1. AVIATION SERVICE PROVIDER SAFETY MANAGEMENT SYSTEM FRAMEWORK: FUNCTIONAL EXPECTATIONS
1. PURPOSE OF THIS APPENDIX. To provide standardization and a uniform set of expectations (basic functional expectations) for SMS development by aviation service providers.
2. SCOPE AND APPLICABILITY.
a. This FAA SMS Framework describes the expectations for an aviation service provider’s (see Note under Paragraph 2.a. Developing an SMS, in the main body of the AC) SMS in the air transportation system.
(1) This advisory circular (AC) is not mandatory and does not constitute a regulation.
Development and implementation of an SMS is voluntary. While the Federal Aviation Administration (FAA) encourages each aviation service provider to develop and implement an SMS, these systems are not substitutes for compliance with Federal regulations and all other certificate requirements, where applicable. However, for aviation service providers that elect to voluntarily implement an SMS, the FAA views the objectives and expectations in Appendix 1 to this AC to be the minimum for a comprehensive and robust SMS.
(2) This FAA SMS Framework is intended to address aviation safety related operational and support processes and activities that are related to aviation safety, not occupational safety, environmental protection, or customer service quality.
(3) The expectations of this FAA SMS Framework apply to SMSs developed and used by organizations that provide products and/or services in the air transportation system.
(4) Operators and service providers are responsible for the safety of services or products contracted to or purchased from other organizations.
b. While this document establishes the minimum acceptable expectations; oversight entities and service providers may establish more stringent requirements.
3. REFERENCES. This AC is in accordance with the following documents, current editions:
• Annex 6 to the Convention on International Civil Aviation, Part 1 International Commercial Air Transport – Aeroplanes with Amendment 33.
• International Civil Aviation Organization (ICAO) Document 9859, ICAO Safety Management Manual (SMM, 2nd Edition, 2009).
• FAA Order 8000.369, Safety Management System Guidance.
• FAA Order VS 8000.367, Aviation Safety (AVS) Safety Management System Requirements.
Appendix 1
4. DEFINITIONS.
a. Accident. An occurrence associated with the operation of an aircraft that takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage (Title 49 of the Code of Federal Regulations (49 CFR) § 830.2, Definitions).
b. Analysis. The conversion of data into information, to identify measures that predict safety related problems to allow risk-management decisionmaking, by the identification of trends, deficiencies and root causes. This involves the processes of identifying a question or issue to be addressed, modeling the issue, investigating model results, interpreting the results, and possibly making a recommendation. Analysis typically involves using scientific or mathematical methods for evaluation.
c. Assessment. The process of measuring or judging the value or level of something.
d. Attributes. System Attributes, are inherent characteristics of a system that apply to an effective SMS. While the six system attributes were first applied with Air Transportation Oversight System (ATOS) fielding, there are differences when applied to SMS, as discussed below:
(1) Responsibility. Who is accountable for management and overall quality of the process (planning, organizing, directing, controlling) and its ultimate accomplishment.
(2) Authority. Who can direct, control, or change the process, as well as who can make key decisions such as risk acceptance. This attribute also includes the concept of empowerment.
(3) Procedures. International Organization for Standardization (ISO)-9001-2000 defines “procedure” as “a specified way to carry out an activity or a process” – procedures translate the what in goals and objectives into how in practical activities (things people do). Procedures are simply documented activities to accomplish processes, e.g., a way to perform a process. The organization should specify their own procedures for accomplishing processes in the context of their unique operational environment, organizational structure, and management objectives.
(4) Controls. Controls are elements of the system, including hardware, software, special procedures, or procedural steps, and supervisory practices designed to keep processes on track to achieve their intended results. Organizational process controls are typically defined in terms of special procedures, supervisory and management practices, and processes. Many controls are inherent features of the FAA SMS Framework. Practices such as continuous monitoring, internal audits, internal evaluations, and management reviews (all parts of the Safety Assurance (SA) component) are identified as controls within the design expectations. Additionally, other practices such as documentation, process reviews, and data tracking are identified as controls within specific elements and processes.
(5) Process Measures. Ways to provide feedback to responsible parties that required actions are taking place, required outputs are being produced, and expected outcomes are being achieved. A basic principle of SA is that fundamental processes be measured so that Page 4
Appendix 1 management decisions can be data-driven. The general expectations for Component 1, policy, specify that SMS outputs be measured and analyzed. These measurements and analyses are accomplished in Component 3, SA. Outputs of each process should, therefore, be identified during component 3 activities. For example, these outputs should be the subjects of continuous monitoring, internal audits, and internal evaluation.
(6) Interfaces. This aspect includes examining such things as lines of authority between departments, lines of communication between employees, consistency of procedures, and clearly delineating lines of responsibility between organizations, work units, and employees. Interfaces are the inputs and outputs of a process.
e. Audit. Scheduled, formal reviews and verifications that evaluate whether an organization has complied with policy, standards, and/or contract requirements. An audit starts with the management and operations of the organization and then moves to the organization’s activities and products/services.
(1) Internal Audit. An audit conducted by, or on behalf of, the organization being audited, e.g., the flight training department audits the flight training department.
(2) External Audit. An audit conducted by an entity outside of the organization being audited, e.g., the flight operations department audits the flight training department.
f. Aviation Service Provider. Refer to definition for organization below. Aviation service provider is interchangeable with the terms service provider and organization within this document.
g. Aviation System. The functional operation or production system used by an organization to produce an aviation product or service (see subparagraphs p. and xx.).
h. Complete. Nothing has been omitted and what is stated is essential and appropriate to the level of detail.
i. Competency. An observable, measurable set [pattern] of skills, knowledge, abilities, behaviors, and other characteristics that an individual needs to perform work roles of occupational functions successfully. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. Competencies can help ensure that individual and team performances align with the organization’s mission and strategic direction.
j. Conformity. Fulfilling or complying with a requirement (refer to ISO 9001-2000); this includes but is not limited to complying with Federal aviation regulations. It also includes complying with company requirements, requirements of operator developed risk controls, or operator policies and procedures.
k. Continuous Monitoring. Uninterrupted (constant) watchfulness (checks, audits, etc) over a system.
Appendix 1
l. Corrective Action. Action to eliminate (remove) or mitigate (lessen) the cause or reduce the effects of a detected nonconformity or other undesirable (unwanted) situation.
m. Correct. Accurate without ambiguity or error in its attributes.
n. Documentation. Information or meaningful data and its supporting medium (e.g., paper, electronic, etc.). In this context, documentation is different from records because documentation is the written description of policies, processes, procedures, objectives, requirements, authorities, responsibilities, or work instructions; where as records are the evidence of results achieved or activities performed.
o. Evaluation. An independent review of company policies, procedures, and systems (refer to AC 120-59, current edition). If accomplished by the company itself, the evaluation should be done by a person or organization in the company other than the one performing the function being evaluated. The evaluation process builds on the concepts of auditing and inspection. An evaluation is an anticipatory process designed to identify and correct potential problems before they happen. An evaluation is synonymous with the term systems audit.
p. Function. A function consists of specific or discreet actions required by a system to achieve an objective (e.g. an operation that a system must perform in order to accomplish its mission, such as a maintenance action required to restore a system to operation). Such actions may be accomplished through the use of equipment, personnel, facilities, firmware, software, or a combination thereof. In a broader sense, the term function refers to what is expected to be incorporated into each system rather than how the system accomplishes its objective. This makes for a more performance-based system and allows for a broad range of techniques to be used to accomplish the performance objectives. This, in turn, maximizes scalability while preserving standardization of results across the aviation organization communities.
q. Hazard. Any existing or potential condition that can lead to injury, illness, or death;
damage to or loss of a system, equipment, or property; or damage to the environment (environmental issues are not within the scope of the SMS). A hazard is a condition that might cause (is a prerequisite to) an accident or incident.
r. Incident. An occurrence other than an accident, associated with the operation of an aircraft, which affects or could affect the safety of operations (49 CFR § 830.2, Definitions).
s. Lessons Learned. Knowledge or understanding gained by experience, which may be positive, such as a successful test or mission, or negative, such as a mishap or failure. Lessons learned should be developed from information obtained from inside and outside of the organization and/or industry.
t. Likelihood. The estimated probability or frequency, in quantitative or qualitative terms, of an occurrence related to the hazard.
u. Line Management. The management structure that operates (controls, supervises, etc) the operational activities and processes of the aviation system.
Appendix 1
v. Nonconformity. Non-fulfillment of a requirement (refer to ISO 9000-2000). This could include but is not limited to, noncompliance with Federal regulations, company requirements, requirements of operator-developed risk controls or operator-specified policies and procedures.
w. Objective. The desired state or performance target of a process. Usually it is the final state of a process and contains the results and outputs used to obtain the desired state or performance target.
x. Operational Life Cycle. Period of time from implementation of a product/service until it is no longer in use.
y. Organization. Within the context of this document, the term organization refers to any organization providing aviation services. The term includes certificated and non-certificated aviation organizations, aviation service providers, air carriers, airlines, maintenance repair organizations, air taxi operators, corporate flight departments, repair stations, pilot schools, approved training organizations that are exposed to safety risks during the provision of their services. (Also see service provider below). The tern organization is interchangeable with the term aviation service provider and service provider within this document.
z. Outputs. The product or end result of an SMS process, which is able to be recorded, monitored, measured, and analyzed. Outputs are the minimum expectation for the product of each process area and the input for the next process area in succession. Each of the outputs of a process should have a method of measurement specified by the organization. Measures need not be quantitative where this is not practical; however, some method of providing objective evidence of the attainment of the expected output is necessary. A table of expected SMS process outputs is in Appendix 4.
aa. Oversight. A function performed by the FAA (or other regulator i.e., in an international country) that ensures that an aviation organization complies with and uses safety-related standards, requirements, regulations, and associated procedures. Safety oversight also works to assure that the acceptable level of safety risk is not exceeded in the air transportation system.
bb. Preventive Action. Preemptive action to eliminate or mitigate the potential cause or reduce the future effects of an identified or anticipated nonconformity or other undesirable situation.
cc. Procedure. Specified ways to carry out operational activities that translate the what (objectives) into how (practical activities).
dd. Process. A set of interrelated or interacting activities that transform inputs into outputs.
ee. Process Measures. Refer to definition for process measures under the attributes definition, above, i.e., a means of providing feedback to responsible parties that required actions are taking place, required outputs are being produced, and expected outcomes are being achieved.
ff. Product/Service. Anything that is offered or can be purchased that might satisfy a want or need in the air transportation system.
Appendix 1 gg. Records. Evidence of results achieved or activities performed (also see documentation above).
hh. Residual Safety Risk. The safety risk that exists after mitigation has been accomplished or all controls have been implemented or exhausted and verified. Only verified controls can be used for assessing residual safety risk.
ii. Risk. The composite of predicted severity (how bad) and likelihood (how probable) of the potential effect of a hazard in its worst credible (reasonable or believable) system state. The terms risk and safety risk are interchangeable for the purposes of this document.
jj. Risk Control. Steps taken to eliminate (remove) hazards or to mitigate (lessen) their effects by reducing the severity and/or likelihood of risk associated with those hazards.
kk. Safety Assurance (SA). A formal management process within the SMS that systematically provides confidence that an organization’s products/services meet or exceed safety requirements. SA expectations are provided in this FAA SMS Framework, Component
3.0.
ll. Safety Culture. The product of individual and group values, attitudes, competencies, and patterns of behavior that determine the commitment to, and the style and proficiency of, the organization’s management of safety. Organizations with a positive safety culture are characterized by communications founded on mutual trust, by shared perceptions of the importance of safety and by confidence in the efficacy of preventive measures.
mm. Safety Management System (SMS). The formal, top-down business-like approach to managing safety risk. It includes systematic procedures, practices, and policies for the management of safety (as described in this document it includes SRM, Safety Policy, SA, and Safety Promotion).
nn. Safety Objective.9 A goal or desirable outcome related to safety. Generally based on the organization’s safety policy, and specified for relevant functions and levels in the organization. Safety objectives are typically measurable.
oo. Safety Planning.10 Part of safety management focused on setting safety objectives and specifying needed operational processes and related resources to fulfill these objectives.
pp. Safety Risk. The composite of predicted severity (how bad) and likelihood (how probable) of the potential effect of a hazard in its worst credible (reasonable or believable) system state. The terms safety risk and risk are interchangeable for the purposes of this document.
9 Adapted from definition 3.2.5 in ISO 9000-2000 for quality objectives.
10 Adapted from definition 3.2.9 in ISO 9000-2000 for quality planning.