Appendix 1
b. Design Expectations.
(1) Line management of operational departments will conduct regular internal audits of safety-related functions of the organization’s operational processes (production system). (Note:
The internal audit is a primary means of output measurement under Component 1.0b(3)(c) and
(4)(e)).
(2) Line management will ensure that regular audits are conducted to:
(a) Determine conformity with safety risk controls, and
(b) Assess performance of safety risk controls.
(3) Planning of the audits program will take into account:
(a) Safety criticality of the processes to be audited, and
(b) The results of previous audits.
(4) The organization will define:
(a) Audits, including:
1. Criteria,
2. Scope,
3. Frequency,
4. Method;
(b) How the auditors will be selected; and
(c) The requirement that auditors will not audit their own work.
(5) The organization will document audit procedures, to include:
(a) The responsibilities; and
(b) Expectations for:
1. Planning audits,
2. Conducting audits,
3. Reporting results,
4. Maintaining records, and Page 21
Appendix 1
5. Auditing contractors and vendors.
PROCESS 3.1.3 INTERNAL EVALUATION.
a. Performance Objective. The organization will conduct internal evaluations of the SMS and operational processes at planned intervals, to determine that the SMS conforms to its objectives and expectations.
b. Design Expectations.
(1) The organization will conduct internal evaluations of the operational processes and the SMS at planned intervals to determine that the SMS conforms to objectives and expectations (Note: SMS output measurement is a primary control under Component 1.0b(3)(c) and (4)(e)).
(2) Planning of the evaluation program will take into account:
(a) Safety criticality of the processes being evaluated, and
(b) The results of previous evaluations.
(3) The organization will define:
(a) Evaluations, including:
1. Criteria,
2. Scope,
3. Frequency, and
4. Methods;
(b) The processes used to select the evaluators; and
(c) Documented procedures, which include:
1. The responsibilities and
2. Requirements for:
a. Planning evaluations,
b. Conducting evaluations,
c. Reporting results,
d. Maintaining records, and
e. Evaluating contractors and vendors.
Appendix 1
(4) The program will include an evaluation of the programs described in Component 1.0b(1).
(5) The person or organization performing evaluations of operational processes must be independent of the process being evaluated.
PROCESS 3.1.4 EXTERNAL AUDITING OF THE SMS.
a. Performance Objective. The organization will include the results of assessments performed by oversight (FAA) and other organizations (IOSA, IS-BAO, etc) in its analysis of data.
b. Design Expectations: The organization will include the results of oversight organization assessments, and other external audit results, in the analyses conducted as described in Process 3.1.7.
PROCESS 3.1.5 INVESTIGATION.
a. Performance Objective. The organization will establish procedures to collect data and investigate incidents, accidents, and instances of potential regulatory noncompliance to identify potential new hazards or risk control failures.
b. Design Expectations.
(1) The organization will collect data on:
(a) Incidents,
(b) Accidents, and
(c) Potential regulatory non-compliance.
(2) The organization will establish procedures to:
(a) Investigate accidents,
(b) Investigate incidents, and
(c) Investigate instances of potential regulatory non-compliance.
PROCESS 3.1.6 EMPLOYEE REPORTING AND FEEDBACK SYSTEM.
a. Performance Objective. The organization will establish and maintain a confidential employee safety reporting and feedback system. Data obtained from this system will be monitored to identify emerging hazards and to assess performance of risk controls in the operational systems.
Appendix 1
b. Design Expectations.
(1) The organization will establish and maintain a confidential employee safety reporting and feedback system as in Component 4.0b(1)(e).
(2) Employees will be encouraged to use the safety reporting and feedback system without fear of reprisal and to submit solutions/safety improvements where possible.
(3) Data from the safety reporting and feedback system will be monitored to identify emerging hazards.
(4) Data collected in the safety reporting and feedback system will be included in analyses described in Process 3.1.7.
PROCESS 3.1.7 ANALYSIS OF DATA.
a. Performance Objective. The organization will analyze the data described in Processes 3.1.1 through 3.1.6 to assess the performance and effectiveness of risk controls in the organization’s operational processes and the SMS, and to identify root causes of nonconformance’s and potential new hazards.
b. Design Expectations.
(1) The organization will analyze the data described in Processes 3.1.1 through 3.1.6 to demonstrate performance and effectiveness of:
(a) Risk controls in the organization’s operational processes and
(b) The SMS.
(2) Through data analysis, the organization will identify root causes of nonconformance and potential new hazards and evaluate where improvements can be made to the organizations:
(a) Operational processes and
(b) The SMS.
PROCESS 3.1.8 SYSTEM ASSESSMENT.
a. Performance Objective. The organization will perform an assessment of the safety performance and effectiveness of risk controls, conformance to SMS expectations as stated herein, and the objectives of the safety policy.
b. Design Expectations.
(1) The organization will assess the performance and effectiveness of:
(a) Safety-related functions of operational processes against their objectives and expectations, and Page 24
Appendix 1
(b) The SMS against its objectives and expectations.
(2) System assessments will document results that indicate a finding of:
(a) Conformity with existing safety risk control(s)/SMS expectations(s) (including regulatory requirements applicable to the SMS);
(b) Nonconformity with existing safety risk control(s)/SMS expectations(s) (including regulatory requirements applicable to the SMS); and
(c) New hazard(s) found.
(3) The SRM process will be utilized if the assessment indicates:
(a) The identification of new or potential hazards or
(b) The need for system changes.
(4) The organization will maintain records of assessments in accordance with the expectations of Element 1.5b(3) and (4).
ELEMENT 3.2 MANAGEMENT OF CHANGE.
a. Performance Objective. The organization will develop and maintain a process to identify changes within the organization or its operational environment which may affect established processes and services and to describe the arrangements to assure safety performance before implementing changes.
b. Design Expectations.
(1) The following will not be implemented until the SRM process (Component 2.0) is accomplished:
(a) New system designs,
(b) Changes to existing system designs,
(c) New operations/procedures, and
(d) Modified operations/procedures.
ELEMENT 3.3 CONTINUOUS IMPROVEMENT.
a. Performance Objective. The organization will develop and maintain a process to identify he causes of sub-standard safety performance, determine the implications of substandard safety performance, and eliminate or mitigate such causes.
Appendix 1
b. Design Expectations.
(1) The organization will continuously improve SMS and safety risk control effectiveness through the use of the safety and quality policies, objectives, audit and evaluation results, analysis of data, corrective and preventive actions, and management reviews.
(2) The organization will develop safety lessons learned.
(a) Lessons learned information will be used to promote continuous improvement of safety.
(b) The organization will communicate information on safety lessons learned throughout the organization.
PROCESS 3.3.1 PREVENTIVE/CORRECTIVE ACTION.
a. Performance Objective. The organization will take corrective and preventive action to eliminate the causes, or potential causes of nonconformance identified during analysis, to prevent recurrence.
b. Design Expectations.
(1) The organization will develop:
(a) Corrective actions for identified nonconformities with risk controls, and
(b) Preventive actions for identified potential nonconformities with risk controls.
(2) Safety lessons learned will be considered in the development of:
(a) Corrective actions, and
(b) Preventive actions.
(3) The organization will take necessary corrective and preventive action based on the findings of investigations.
(4) The organization will prioritize and implement corrective and preventative action(s) in a timely manner.
(5) Records will be kept and maintained of the disposition and status of corrective and preventive actions.
PROCESS 3.3.2 MANAGEMENT REVIEW.
a. Performance Objective. Top management will conduct regular reviews of the SMS to assess the performance and effectiveness of the organization’s operational processes and the need for improvements.
Appendix 1
b. Design Expectations.
(1) Top management will conduct regular reviews of the SMS, including:
(a) The outputs of safety risk management (Component 2.0),
(b) The outputs of SA (Component 3.0), and
(c) Lessons learned (Element 3.3b(2).
(2) Management reviews will include assessing the performance and effectiveness of an organization’s process designs, the implications of such, and the need for improvements of:
(a) Operational processes, and
(b) The SMS.
COMPONENT 4.0 SAFETY PROMOTION.
a. Performance Objective. Top management will promote the growth of a positive safety culture and communicate it throughout the organization.
b. General Design Expectations.
(1) Top management will promote the growth of a positive safety culture by:
(a) Publication of senior management’s stated commitment to safety to all employees;
(b) Visibly demonstrating their commitment to the SMS;
(c) Communicating the safety responsibilities for the organization’s personnel;
(d) Clearly and regularly communicating safety policy, goals, objectives, standards, and performance to all organizational employees;
(e) Creating an effective employee reporting and feedback system that provides confidentiality;
(f) Using a safety information system that provides an accessible, efficient means to retrieve safety information; and
(g) Making essential resources available to implement and maintain the SMS.
ELEMENT 4.1 COMPETENCIES AND TRAINING.
a. Performance Objective. The organization will ensure that personnel are trained and competent to perform the SMS duties. The scope of safety training will be commensurate with the individual’s involvement in the SMS.
Appendix 1
b. Design Expectations. The organization will implement processes to accomplish the expectations for Processes 4.1.1 thru 4.1.2, below.
PROCESS 4.1.1 PERSONNEL EXPECTATIONS (COMPETENCE).
a. Performance Objective. The organization will document competency requirements for those positions identified in Element 1.2b(3) and 1.3 and ensure those requirements are met.
b. Design Expectations.
(1) The organization will determine and document competency requirements for those positions identified in Element 1.2b(3) and 1.3.
(2) The organization will ensure that those individuals in the positions identified in Element 1.2b(3) and 1.3, meet the Process 4.1.1b(1) competency requirements.
PROCESS 4.1.2 TRAINING.
a. Performance Objective. The organization will develop, document, deliver, and regularly evaluate training necessary to meet competency requirements of 4.1.1b(1).
b. Design Expectations.
(1) Training needed to meet competency requirements of 4.1.1b(1) will be developed for those individuals in the positions identified in Element 1.2b(3) and 1.3.
(2) Training development will consider scope, content, and frequency of training required to maintain competency for those individuals in the positions identified in Element 1.2b(3) and
1.3.
(3) Employees will receive training commensurate with their:
(a) Position level within the organization, and
(b) Impact on the safety of the organization’s products or services.
(4) To ensure training currency, training will be periodically:
(a) Reviewed and
(b) Updated.
ELEMENT 4.2 COMMUNICATION AND AWARENESS.
a. Performance Objective. Top management will communicate the outputs of its SMS to its employees, and will provide its oversight organization access to SMS outputs in accordance with established agreements and disclosure programs.
Appendix 1
b. Design Expectations.
(1) The organization will communicate safety critical outputs of the SMS, rationale behind controls, preventative or corrective actions and insure awareness of SMS objectives to its employees.
(2) The organization will provide its oversight organization access to the outputs of the SMS.
(3) The organization’s SMS will be able to inter-operate with other organization’s SMSs to cooperatively manage issues of mutual concern.
Page 29 (and 30)
Appendix 2 APPENDIX 2. COMPARISON OF SAFETY MANAGEMENT SYSTEM FRAMEWORK
WITH OTHER STANDARDS
1. PURPOSE OF THIS APPENDIX. The table below is provided to assist those organizations developing and implementing an SMS. It provides a reference between existing standards and this FAA SMS Framework. It includes references to the following:
a. Quality Management Systems via International Standards Organization International Organization for Standardization (ISO) 9001:2000 and the Aerospace Basic Quality System Standard (AS 9100) requirements;
b. Environmental Management Systems via ISO 14001 requirements;
c. Occupational Safety and Health Management Systems (OHSAS) via OHSAS 18001.
OHSAS 18001 is an Occupation Health and Safety Assessment Series for health and safety management systems, which was created through a concerted effort from a number of the world’s leading national standards bodies, certification bodies, and specialist consultancies; and
d. FAA AC 120-92, appendix 1, current edition, clause numbers (old SMS Standard).
NOTE: The following table is intended to assist the organization SMS developers in building on existing management systems to develop the SMS and/or integrating its SMS with these existing management systems.
TABLE 1. SAFETY MANAGEMENT SYSTEM FRAMEWORK COMPARED WITH
OTHER STANDARDS Content (Standards)
FAA SMS Framework AC 120-92 (2006, App 1) ISO 9001:
2000/AS 9100 ISO 14001 OHSAS 18001 Purpose and Applicability 1 1 1 1 1 References (Normative) 2 2 2 2 2 Definitions 3 3 3 3 3 Functional Expectations 4 4 4 4 4 General requirements (and Responsibility/ Authority (ISO 9000))
1.0 4.1 4.1, 5.5 4.1 4.1 Policy (safety, environmental, quality)
1.0 b (4)( b),
1.1
4.0
5.1, 5.3, 8.5 4.2 4.2 Planning 1.0 b (4)( g) 4.4 5.4 4.3 4.3 Page 1
Appendix 2 Content FAA SMS AC 120-92 ISO 9001: ISO OHSAS (Standards) Framework (2006, App 1) 2000/AS 9100 14001 18001 Requirements (hazard/risk, environmental aspects, customer requirements)
2.0, 3.2 5.0, 5.7 5.2, 7.2.1, 7.2.2 .3.1 4.3.1 Legal and other requirements, customer focus (ISO 9000)
1.0 b (4)( c),
(d) 4.6 5.2, 7.2.1 4.3.2 4.3.2 Objectives and targets 1.1, 2.1.1 4.2, 5.1 5.4.1 4.3.3 4.3.3 Programs, action planning to meet targets, continuous improvement
1.0 b (4) (g),
2.2.3 4.4 5.4.2, 8.5.1 4.3.4 4.3.4 Management responsibility and organizational structure
1.2 4.5 5, 6 (Resource mgmt.) 4.4.1 4.4.1 Training 4.1.1, 4.1.2 7.3, 7.4 6.2.2 4.4.2 4.4.2 Communications 3.1.6, 3.3, 4.2 6.3.6, 6.8, 7.2 5.5.3, 7.2.3 4.4.3 4.4.3 Documentation and quality manual (ISO 9000)
1.5 4.9 4.2 4.4.4 4.4.4 Document and data control 1.5 4.9 4.2.3 4.4.5 4.4.5 Operational control and product realization
1.0 b (4)( e),
(f) 4.1, 4.7 7 4.4.6 4.4.6 Emergency preparedness and response, control of nonconforming product (ISO 9000)
1.4 4.8 8.3 4.4.7 4.4.7 Performance measurement and monitoring
1.0, 3.1.1,
3.1.7, 3.1.8 6.3.1, 6.4, 6.5 8 4.5 4.5 Accidents, incidents, nonconformity,
3.1.5, 3.1.8,
3.3.1 6.3.5, 6.5, 6.6 8.3, 8.5.2, 8.5.3 4.5.2 4.5.2 Page 2