Appendix 1 qq. Safety Risk Control. A characteristic of a system that reduces or mitigates (lessens) the potential undesirable effects of a hazard. Controls may include process design, equipment modification, work procedures, training or protective devices. Safety risk controls must be written in requirements language, measurable, and monitored to ensure effectiveness.
rr. Safety Risk Management (SRM). A formal process within the SMS that describes the system, identifies the hazards, assesses the risk, analyzes the risk, and controls the risk. The SRM process is embedded in the processes used to provide the product/service; it is not a separate/distinct process. SRM expectations are provided in the FAA SMS Framework, Component 2.0.
ss. Safety Promotion. A combination of safety culture, training, and data sharing activities that support the implementation and operation of an SMS in an organization. Safety promotion expectations are provided in this FAA SMS Framework, Component 4.0.
tt. Separate Aviation Maintenance Organizations. Are independent maintenance organizations such as, but not limited to, certificated repair stations, non-certificated repair facilities, and separate maintenance organizations. This does not include an air operator’s maintenance organization and is not intended to duplicate Component 1.0b(1)(a)(3) of an air operator’s organization.
uu. Service Provider. (Refer to definition for Organization above). The term service provider is interchangeable with the terms aviation service provider and organization within this document.
vv. Severity. The degree of loss or harm resulting from a hazard.
ww. Substitute Risk. A risk unintentionally created as a consequence of safety risk control(s).
xx. System. An integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, hardware, software, firmware, information, procedures, facilities, services, and other support facets.
yy. System Attributes. Refer to definition for attributes, above.
zz. Top Management. The person or group of people who direct and control an organization (ref. ISO 9000-2005 definition 3.2.7 - person or group of people who directs and controls an organization at the highest level). Top management translates the policy into goals, objectives and strategies, and projects a shared-vision of the future. It makes decisions that affect everyone in the organization, and is held entirely responsible for the success or failure of the enterprise. In many large organizations, this can be the Chief Executive Officer (CEO), chairman/chairwoman, president or the board of directors; in smaller organizations, this might be the owner of the company.
Appendix 1
5. SMS FRAMEWORK: FUNCTIONAL EXPECTATIONS.
5.1 FAA SMS FRAMEWORK STRUCTURE. The FAA SMS Framework is broken down into components, elements, and processes. The components and elements are based on the ICAO Framework. Elements in the SRM, SA, and Safety Promotion components are further broken down into processes.
5.2 FAA SMS FRAMEWORK EXPECTATIONS. This section describes expected characteristics of a robust SMS. They are considered functional expectations because they describe the what, not the how of each process. For example, the what of a deicing process is to prevent any aircraft from taking off with ice adhering to any critical control surface. The how of the de-icing process would include deicing equipment procedures, flight crew deicing procedures, hold over table activities, etc., and may be different between individual organizations. Organizations are expected to meet FAA SMS Framework expectations by developing processes to fit their unique business and management models.
5.3 FAA SMS FRAMEWORK ELEMENTS AND PROCESSES. FAA SMS Framework elements and processes are further defined in terms of performance objectives and design expectations:
a. Performance Objectives. Are the desired outcomes of the particular element or process under evaluation.
b. Design Expectations. Are the characteristics of the element or process that, if properly implemented, should provide the outcomes identified in the performance objectives.
COMPONENT 1.0 SAFETY POLICY AND OBJECTIVES.
a. Performance Objectives. The organization will develop and implement an integrated, comprehensive SMS for its entire organization and will incorporate a procedure to identify and maintain compliance with current safety-related legal, regulatory, and statutory requirements.
b. General Design Expectations.
(1) Safety management will be included in the complete scope and life cycle of the organization’s systems including:
(a) For air operators:
1. Flight operations,
2. Operational control (dispatch/flight following),
3. Maintenance and inspection,
4. Cabin safety,
5. Ground handling and servicing, Page 10
Appendix 1
6. Cargo handling, and
7. Training.
(b) For separate aviation maintenance organizations:
1. Parts/materials,
2. Resource management (tools and equipment, personnel, and facilities),
3. Technical data,
4. Maintenance and inspection,
5. Quality control,
6. Records management,
7. Contract maintenance, and
8. Training.
(2) SMS processes will be:
(a) Documented,
(b) Monitored,
(c) Measured, and
(d) Analyzed.
(3) SMS outputs will be:
(a) Recorded,
(b) Monitored,
(c) Measured, and
(d) Analyzed.
(4) It is expected that:
(a) The organization will promote the growth of a positive safety culture (described under Component 4b);
(b) If the organization has a quality policy, top management will ensure that the quality policy is consistent with the SMS;
Appendix 1
(c) The SMS will include a means to comply with FAA policy, legal, regulatory and statutory requirements applicable to the SMS;
(d) The organization will establish and maintain a procedure to identify current FAA policy, legal, regulatory and statutory requirements applicable to the SMS;
(e) The organization will establish and maintain procedures with measurable criteria to accomplish the objectives of the safety policy11;
(f) The organization will establish and maintain supervisory and operational controls to ensure procedures are followed for safety-related operations and activities; and
(g) The organization will establish and maintain a safety management plan to describe how it will achieve its safety objectives.
ELEMENT 1.1 SAFETY POLICY.
a. Performance Objective. Top management will define the organization’s safety policy and convey its expectations, objectives, commitments, and accountabilities to its employees.
b. Design Expectations.
(1) Top management will define and sign the organization’s safety policy.
(2) The safety policy will:
(a) Include a commitment to implement and maintain the SMS;
(b) Include a commitment to continuously improve in the level of safety;
(c) Include a commitment to the management of safety risk;
(d) Include a commitment to comply with applicable regulatory requirements;
(e) Include a commitment to encourage employees to report safety issues without reprisal (as per Process 3.1.6);
(f) Establish clear standards for acceptable operational behavior for all employees;
(g) Provide management guidance for setting safety objectives;
(h) Provide management guidance for reviewing safety objectives;
(i) Be documented;
11 Measures are not expected for each procedural step. However, measures and criteria should be of sufficient depth and level of detail to ascertain and track accomplishment of objectives. Criteria and measures can be expressed in either quantitative or qualitative terms.
Appendix 1
(j) Be communicated with visible management endorsement to all employees and responsible parties;
(k) Be reviewed periodically to ensure it remains relevant and appropriate to the organization; and
(l) Identify responsibility and accountability of management and employees with respect to safety performance.
ELEMENT 1.2 MANAGEMENT COMMITMENT AND SAFETY ACCOUNTABILITIES.
a. Performance Objective. The organization will define, document, and communicate the safety roles, responsibilities, and authorities throughout its organization.
b. Design Expectations.
(1) Top management will have the ultimate responsibility for the SMS.
(2) Top management will provide resources essential to implement and maintain the SMS.
(3) Aviation safety-related positions, responsibilities, and authorities will be
(a) Defined,
(b) Documented, and
(c) Communicated throughout the organization.
(4) The organization will define levels of management that can make safety risk acceptance decisions as described in Component 2.0b(4)(c).
ELEMENT 1.3 KEY SAFETY PERSONNEL.
a. Performance Objective. The organization will appoint a management representative to manage, monitor, and coordinate the SMS processes.
b. Design Expectations.
(1) Top management will appoint a member of management who, irrespective of other responsibilities, will have responsibilities and authority that includes:
(a) Ensuring that processes needed for the SMS are established, implemented, and maintained;
(b) Report to top management on the performance of the SMS and the need for improvement; and Page 13
Appendix 1
(c) Ensure the promotion of awareness of safety expectations throughout the organization.
ELEMENT 1.4 EMERGENCY PREPAREDNESS AND RESPONSE.
a. Performance Objective. The organization will develop and implement procedures that it will follow in the event of an accident or incident or operational emergency to mitigate the effects of these events.
b. Design Expectations. The organization will establish procedures to:
(1) Identify hazards that have potential for accidents and incidents;
(2) Coordinate and plan the organization’s response to accidents, incidents or operational emergencies; and
(3) Execute periodic exercises of the organization’s response.
ELEMENT 1.5 SMS DOCUMENTATION AND RECORDS.
a. Performance Objectives. The organization will have documented safety policies, objectives, procedures, a document/record management process and a safety management plan that meet organizational safety expectations and objectives.
b. Design Expectations.
(1) The organization will establish and maintain information, in paper or electronic form, to describe:
(a) Safety policies;
(b) Safety objectives;
(c) SMS expectations;
(d) Safety procedures and processes;
(e) Accountabilities, responsibilities and authorities for safety-related procedures and processes;
(f) Interactions/interfaces between the safety-related procedures and processes; and
(g) SMS outputs.
(2) The organization will maintain their safety management plan in accordance with the objectives and expectations contained within this element (1.5).
(3) Documentation Management.
Appendix 1
(a) Documentation will be:
1. Legible,
2. Dated (with dates of revisions),
3. Readily identifiable,
4. Maintained in an orderly manner, and
5. Retained for a specified period of time as determined by the organization.
(b) The organization will establish and maintain procedures for controlling all documents required by this FAA SMS Framework to ensure that:
1. They can be located; and
2. They are periodically:
a. Reviewed,
b. Revised as needed, and
c. Approved for adequacy by authorized personnel.
(c) The current versions of relevant documents are available at all locations where essential SMS operations are performed; and
(d) Obsolete documents are promptly removed from all points of use or otherwise assured against unintended use.
(4) Records Management.
(a) The organization will establish and maintain procedures to:
1. Identify,
2. Maintain, and
3. Dispose of their SMS records.
(b) SMS records will be:
1. Legible,
2. Identifiable, and
3. Traceable to the activity involved.
Appendix 1
(c) SMS records will be maintained in such a way that they are:
1. Readily retrievable and;
2. Protected against:
a. Damage,
b. Deterioration, or
c. Loss.
(d) Records retention times will be documented.
COMPONENT 2.0 SAFETY RISK MANAGEMENT (SRM).
a. Performance Objective. The organization will develop processes to understand the critical characteristics of its systems and operational environment and apply this knowledge to identify hazards, analyze and assess risk and design risk controls.
b. General Design Expectations.
(1) SRM will, at a minimum, include the following processes:
(a) System description and task analysis,
(b) Hazard identification,
(c) Safety risk analysis,
(d) Safety risk assessment, and
(e) Safety risk control and mitigation.
(2) The SRM process will be applied to:
(a) Initial designs of systems, organizations, and/or products;
(b) The development of operational procedures;
(c) Hazards that are identified in the SA functions (described in Component 3.0b;
and
(d) Planned changes to operational processes.
(3) The organization will establish feedback loops between assurance functions described in Component 3.0 to evaluate the effectiveness of safety risk controls.
(4) The organization will define a risk acceptance process that:
Appendix 1
(a) Defines acceptable and unacceptable levels of safety risk.
(b) Describes:
1. Severity levels, and
2. Likelihood levels.
(c) Defines specific levels of management that can make safety risk acceptance decisions prescribed in accordance with Element 1.2b(3).
(d) Defines acceptable risk for hazards that will exist in the short-term while safety risk control/mitigation plans are developed and implemented.
ELEMENT 2.1 HAZARD IDENTIFICATION AND ANALYSIS.
a. Performance Objective. The organization will develop and maintain a process that ensures that hazards in operations are identified. Hazards will be identified from the analysis of critical design and performance factors, processes, and activities in sufficient detail to determine associated level of risk and risk acceptability.
b. Design Expectations. The organization will implement processes to accomplish the objectives and expectations for Processes 2.1.1 thru 2.1.2, below.
PROCESS 2.1.1 SYSTEM DESCRIPTION AND TASK ANALYSIS.
a. Performance Objective. The organization will analyze its systems, operations, and operational environment to gain an understanding of critical design and performance factors, processes, and activities to identify hazards.
b. Design Expectations.
(1) System descriptions and task analysis will be developed to the level of detail necessary to:
(a) Identify hazards,
(b) Develop operational procedures, and
(c) Develop and implement risk controls.
PROCESS 2.1.2 IDENTIFY HAZARDS.
a. Performance Objective. The organization will identify and document the hazards in its operations that are likely to cause death, serious physical harm, or damage to equipment or property in sufficient detail to determine associated level of risk and risk acceptability.
Appendix 1
b. Design Expectations.
(1) Hazards will be:
(a) Identified for the entire scope of the system, as defined in the system description12; and
(b) Documented.
(2) Hazard information will be:
(a) Tracked, and
(b) Managed throughout the entire SRM process.
ELEMENT 2.2 RISK ASSESSMENT AND CONTROL.
a. Performance Objective. The organization will develop and maintain a process that ensures analysis, assessment, and control of the safety risks in system operations.
b. Design Expectations. The organization will implement processes to accomplish the expectations for Processes 2.2.1 thru 2.2.3, below.
PROCESS 2.2.1 ANALYZE SAFETY RISK.
a. Performance Objective. The organization will determine and analyze the severity and likelihood of potential events associated with identified hazards, and will identify risk factors associated with unacceptable levels of severity or likelihood.
b. Design Expectations.
(1) The safety risk analysis process will include:
(a) Existing safety risk controls,
(b) Triggering mechanisms, and
(c) Safety risk of reasonably likely outcomes from the existence of a hazard, to include estimation of the13:
1. Likelihood, and
12 While it is recognized that identification of every conceivable hazard is impractical, organizations are expected to exercise due diligence in identifying and controlling significant and reasonably foreseeable hazards related to their operations.
13 Risk likelihood and severity may be expressed in quantitative or qualitative terms.
Appendix 1
2. Severity.
PROCESS 2.2.2 ASSESS SAFETY RISK.
a. Performance Objective. The organization will assess risk associated with each identified hazard and define risk acceptance procedures and levels of management that can make safety risk acceptance decisions.
b. Design Expectations. Each hazard will be assessed for its safety risk acceptability using the safety risk acceptance process described in Component 2.0b(4).
PROCESS 2.2.3 CONTROL/MITIGATE SAFETY RISK.
a. Performance Objective. The organization will design and implement a risk control for each identified hazard for which there is an unacceptable risk, to reduce risk to acceptable levels.
The potential for residual risk and substitute risk will be analyzed before implementing any risk controls.
b. Design Expectations.
(1) Safety control/mitigation plans will be defined for each hazard with unacceptable risk.
(2) Safety risk controls will be:
(a) Clearly described,
(b) Evaluated to ensure that the expectations have been met,
(c) Ready to be used in their intended operational environment, and documented.
(3) Substitute risk will be evaluated when creating safety risk controls/mitigations.
COMPONENT 3.0 SAFETY ASSURANCE.
a. Performance Objective. The organization will monitor, measure, and evaluate the performance and effectiveness of risk controls.
b. General Design Expectations.
(1) The organization will monitor their systems and operations to:
(a) Identify new hazards,
(b) Measure the effectiveness of safety risk controls,
(c) Ensure compliance with regulatory requirements applicable to the SMS, and Page 19
Appendix 1
(d) Ensure the SA function is based upon a comprehensive system description as described in Process 2.1.1.
(2) The organization will collect the data necessary to demonstrate the effectiveness of its:
(a) Operational processes, and
(b) The SMS.
ELEMENT 3.1 SAFETY PERFORMANCE MONITORING AND MEASUREMENT.
a. Performance Objective. The organization will develop and maintain a means to monitor, measure, and verify the safety performance of the organization, and to validate the effectiveness of safety risks controls.
b. Design Expectations. The organization will implement processes to accomplish the expectations for Processes 3.1.1 thru 3.1.8, below.
PROCESS 3.1.1 CONTINUOUS MONITORING.
a. Performance Objective. The organization will continuously monitor operational data, including products and services received from contractors, to identify hazards, measure the effectiveness of safety risk controls, and assess system performance.
b. Design Expectations.
(1) The organization will monitor operational data (e.g., duty logs, crew reports, work cards, process sheets, and reports from the employee safety feedback system specified in Process 3.1.6) to:
(a) Determine conformity to safety risk controls (described in Process 2.2.3);
(b) Measure the effectiveness of safety risk controls (described in Process 2.2.3);
(c) Assess SMS system performance; and
(d) Identify hazards.
(2) The organization will monitor products and services received from subcontractors.
PROCESS 3.1.2 INTERNAL AUDITS BY OPERATIONAL DEPARTMENTS.
a. Performance Objective. The organization will perform regularly scheduled internal audits of its operational processes, including those performed by contractors, to verify safety performance and evaluate the effectiveness of safety risk controls.