Par 3-3 Page 15
(c) Employees. All employees should be aware of the company’s safety policies, as well as the processes, procedures, and tools relevant to their responsibilities. They need to know how the confidential employee reporting system works. Employees have a duty and responsibility to follow an organization’s processes and procedures.
(6) Scalability. The method for meeting these requirements is not expected to vary greatly between different organizations. Rather, the numbers and relationships of personnel will be unique to each organization.
d. Designation and Responsibilities of Required Safety Management Personnel. This section of the regulation addresses two processes: (1) Designation and Responsibilities of the Accountable Executive, and (2) Designation and Responsibilities of Safety Management Personnel.
(1) Designation and Responsibilities of the Accountable Executive.
(a) SRR. Sections 5.25(a) and (b).
(b) Related Regulatory Requirements. None.
(c) ICAO/SMSPP. Element 1.3.
(d) Part 5 Requirements.
(e) Discussion.
1. Designation. Section 5.25(a) requires the organization to identify an alreadyexisting person in the organization who holds the ultimate decisionmaking authority over the § 5.25 Designation and responsibilities of required safety management personnel.
(a) Designation of the accountable executive. The certificate holder must identify an accountable executive who, irrespective of other functions, satisfies the following:
(1) Is the final authority over operations authorized to be conducted under the certificate holder’s certificate(s).
(2) Controls the financial resources required for the operations to be conducted under the certificate holder’s certificate(s).
(3) Controls the human resources required for the operations authorized to be conducted under the certificate holder’s certificate(s).
(4) Retains ultimate responsibility for the safety performance of the operations conducted under the certificate holder’s certificate.
(b) Responsibilities of the accountable executive. The accountable executive must accomplish the following:
(1) Ensure that the SMS is properly implemented and performing in all areas of the certificate holder’s organization.
(2) Develop and sign the safety policy of the certificate holder.
(3) Communicate the safety policy throughout the certificate holder’s organization.
(4) Regularly review the certificate holder's safety policy to ensure it remains relevant and appropriate to the certificate holder.
(5) Regularly review the safety performance of the certificate holder’s organization and direct actions necessary to address substandard safety performance in accordance with § 5.75.
Par 3-3 Page 16 certificate holder’s operations. This person is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe flight operations. A flowchart outlining a process for designating an accountable executive is available in Appendix 4, Identifying the Accountable Executive.
2. Responsibilities. As the ultimate authority in the organization, the accountable executive is responsible for the proper functioning of the SMS. This entails, among other things, keeping an open line of communication with the designated management personnel, providing sufficient resources for the SMS to function properly, and being actively involved in the SA component of SMS, discussed below.
3. Scalability. In smaller organizations, the accountable executive may personally participate in or directly supervise operational processes. This individual may serve in multiple positions within the company. In larger organizations, the accountable executive is responsible for ensuring that management personnel are clearly designated for ensuring the safety of operational and safety management processes.
(2) Designation and Responsibilities of Required Safety Management Personnel.
(a) SRR. Section 5.25(c).
(b) Related Regulatory Requirements. None.
(c) ICAO/SMSPP. Element 1.3.
(d) Part 5 Requirements.
(e) Discussion. This section of the regulation requires the company to ensure that sufficient personnel are available to provide support for essential SMS functions, such as analysis, assistance to operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive. These responsibilities may be carried out as collateral duties by managers referred to in § 5.23(a)(2), or the carrier could assign the tasks of supporting SMS functions to other personnel. For example some organizations may choose to use their existing required management personnel under § 119.65 to fulfill these responsibilities. Other organizations may organize a Safety Department with a number of persons or use existing personnel within each operational division.
§ 5.25 Designation and responsibilities of required safety management personnel.
(c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, must be responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the certificate holder’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout your organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
Par 3-3 Page 17 NOTE: The final rule preamble states: “Personnel designated to perform this function must be in positions in the organization of sufficient independence to have direct access to the accountable executive to report on the safety performance of the operation and recommend and necessary improvements.”
e. Coordination of Emergency Response Planning.
(1) SRR. Section 5.27.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Element 1.4.
(4) Part 5 Requirements.
(5) Discussion. The plan should provide procedures for management decisionmaking and action in an emergency. This should include a line of succession of management authority sufficient to respond to emergencies. Coordination of your emergency response plans with the emergency response plans of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous materials (hazmat) authorities. The plan might also address how you return or transition to normal operations after the emergency condition subsides. Many organizations already have emergency response plans that may be used to fulfill this requirement.
3-4. SUBPART C: SAFETY RISK MANAGEMENT.
a. Introduction.
(1) SRR. Part 5, subpart C.
(2) Related Regulatory Requirements. Section 5.23(a)(2).
(3) ICAO/SMSPP. Component 2.0.
(4) Summary. SRM is a formal system for identifying and mitigating risk. There are five processes necessary to control and mitigate risk. These processes are featured in Figure 3-1, Safety Risk Management Processes and Regulatory Requirements, and are discussed in more detail below. These are:
§ 5.27 Coordination of emergency response planning.
Where emergency response procedures are necessary, the certificate holder must develop and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the certificate holder’s organization;
(b) Assignment of employee responsibilities during the emergency; and
(c) Coordination of the certificate holder’s emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.
• System description and analysis.
• Hazard identification.
Safety risk analysis.
Safety risk assessment.
• Safety risk controls.
FIGURE 3-1. SAFETY RISK MANAGEMENT PROCESSES AND REGULATORY
REQUIREMENTS Start Inputs: 5.51 5.53 System SRM •New System
•System Change Analysis & (Subpart c) Analysis System 5.53(a) &(b) •New Operational Procedure Hazard (Design) - Inputs From SA: 5.73(6) Identification Hazard
5.53(c) Ident Risk 5.55 Risk Analysis 5.55(a) Assessment & Control
5.55(b) Risk Outputs: To SA Subpart D Assmt Evaluate Controls
5.55(d) Risk Control 5.55(c)
b. Applicability: Requirements to Apply SRM.
(1) SRR. Section 5.51.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Component 2.0.
(4) Objective. To determine situations where the SRM process must be applied.
Par 3-4 Page 18
Par 3-4 Page 19
(5) Part 5 Requirements.
(6) Discussion.
(a) To know when SRM process may be required, it is important to know what a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets which are directly related to the organization’s aviation safety activities. Examples of broad-based systems could include:
• Flight operations,
• Operational control (dispatch/flight following),
• Maintenance and inspection,
• Cabin safety,
• Ground handling and servicing,
• Cargo handling, and
• Training.
(b) Within these systems there are subsystems. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, deicing, fueling, aircraft fleet, ground operations, and hazmat training.
(c) Under § 5.51, the SRM process is triggered when proposed new systems or changes to systems are being considered. For example, changes to your operation could include the addition of new routes, opening or closing of line stations, adding or changing contractual arrangements for services, additions of new fleets or major modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS), or any one of many different types of operations. The SRM process is not triggered solely by major changes to a system; it is triggered by any revision of an existing system. However, the level of SRM documentation needed for smaller changes to a system may be significantly smaller than for major changes.
NOTE: It is not the intent of part 5 to require the application of SRM processes and procedures to activities that are not related to aviation operations.
c. System Analysis and Hazard Identification. This section of the regulation addresses the following two processes: (1) System Description and Analysis, and (2) Hazard Identification.
§ 5.51 Applicability A certificate holder must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk co ntrols through the safety assurance processes in subpart D of this part.
Par 3-4 Page 20 NOTE: Appendix 2, Safety Risk Management (SRM) Worksheets, contains a set of worksheets that may be useful for conducting SRM.
(1) System Description and Analysis.
(a) SRR. Section 5.53(a) and (b).
(b) Related Regulatory Requirements. None.
(c) ICAO/SMSPP. Element 2.1/Process 2.1.1.
(d) Objective. To gain an understanding of the components and elements of operational systems, processes, procedures and the operational environment.
(e) Part 5 Requirements.
(f) Discussion. Systems analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by describing the system (this can be as simple as flowcharting the system or writing a short narrative).
1. An example of system description and analysis might involve the need in your operations for a new aircraft (or fleet of aircraft) to meet your company or corporate goals.
Several of your organizational “systems” would be affected: flight operations, maintenance, station, ground, etc. As part of your examination of the flight operations system, you would need to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, union participation, and several other areas. This is a process normally done as part of your business activities.
2. Your system analysis should identify and consider activities and resources necessary for the system to function. For example, in the scenario of adding aircraft to your fleet, you would identify for the pilot training system, as one of the affected systems, the activities and resources necessary for pilot training to pilot the additional aircraft. These may include simulators, training curriculum, training aids, and instructors.
§ 5.53 System analysis and hazard identification.
(a) When applying safety risk management, the certificate holder must analyze the systems identified in § 5.51. Those safety analyses must be used to identify hazards under paragraph (c) of this section, and developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system’s operating environment.
(3) An outline of the system’s processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
Par 3-4 Page 21
3. The above example of adding aircraft to your fleet would entail consideration of several systems and a variety of procedures due to the number of processes that would be affected. However, in a simpler case, such as a change in the procedure for arming cabin doors prior to pushback, only those elements of the systems that would be affected by the change would need to be considered. The carrier would not be expected to perform a comprehensive analysis of the entire cabin safety system.
4. The system description and analysis process frequently includes representatives from management, safety staff, subject matter experts (SME), employees, and representation groups (e.g., unions) formed into workgroups such as safety committees, safety roundtables, safety action groups, or similar titles. Since many, if not most, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process.
5. The outputs could be recorded in a simple recording medium such as a worksheet or a notebook, common desktop software, or a Web-Based Application Tool (WBAT), (see Appendix 6). Appendix 2 provides an example of a set of worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBATs.
(g) Scalability.
1. Small. System description and analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers such as the Director of Operations (DO) and/or Chief Pilot or other individuals designated by them.
2. Medium. System description and analysis could be performed by a member of management or one of the designated SMS management representatives with a small workgroup of company SMEs and stakeholders.
3. Large. System description and analysis might be performed at multiple organizational levels (e.g., corporate, division, or department) and facilitated by the Safety Department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
(2) Hazard Identification.
(a) SRRs. Section 5.53(c).
(b) Related Regulatory Requirements.
• Section 5.23(a)(2)(i), Accountabilities of Members of Management.
• Section 5.25(c)(2), Responsibilities of Safety Management Personnel.
(c) ICAO/SMSPP. Element 2.1/Process 2.1.2.
Par 3-4 Page 22
(d) Objective. To examine operational systems, operations, processes, and the operational environment in order to identify conditions that could result in an aircraft accident.
(e) Part 5 Requirements.
(f) Discussion. The hazard identification process flows from the system analysis. In hazard identification, you would ask: What could go wrong with your processes, under typical or abnormal operational conditions, that could cause an accident?
1. Most often the same individuals or groups conducting the system analysis process (safety committees, safety roundtables, etc.) would conduct hazard identification. You use your experience, FAA requirements, manufacturers’ technical data, and knowledge of your operations to identify hazards to your operation. For example, a newly modified component of an aircraft cabin door might require new arming and disarming procedures by flight attendants and new signaling procedures for station personnel upon aircraft arrival at a passenger gate.
Hazards could include the effectiveness of new procedure training, employees missing training, failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc. While identification of every conceivable hazard is unlikely, you are expected to exercise due diligence in identifying hazards that could foreseeably lead to an aircraft accident.
2. The output of hazard identification could be recorded in a simple recording medium such as a spreadsheet or paper files, or software such as a WBAT.
(g) Scalability.
1. Small. Hazard identification could be performed by the owner/manager and/or another employee(s), often as part of the system analysis.
2. Medium. As in the system analysis, hazard identification could be performed by a member of management or a designated SMS management representative with a small workgroup of company SMEs and stakeholders.
3. Large. Hazard identification might be performed at multiple organizational levels (e.g., corporate, division, or department levels) and facilitated by a Safety Department/division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.
d. Safety Risk Analysis and Control. This section of the regulation addresses the following three processes: (1) Safety Risk Analysis, (2) Safety Risk Assessment, and (3) Safety Risk Control.
§ 5.53 System analysis and hazard identification.
(c) The certificate holder must develop and maintain processes to identify hazards within the context of the system analysis.
Par 3-4 Page 23
(1) Safety Risk Analysis.
(a) SRRs. Section 5.55(a).
(b) Related Regulatory Requirements. Section 5.25(c)(2), Responsibilities of Safety Management Personnel.
(c) ICAO/SMSPP. Element 2.2/Process 2.2.1.
(d) Objective. To estimate the severity and likelihood of a potential accident due to exposure to an identified hazard.
(e) Part 5 Requirements.
(f) Discussion. For each identified hazard, define the potential for injury and damage that may result from an accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, you need to define the likelihood of occurrence of an accident and severity of the injury or damage that may result from the aircraft accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard.
1. The risk analysis also needs to consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, which could result in an accident? Have you changed equipment that your employees must use, the procedures for using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For example, if, in the process of a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that would lead to errors?
2. This is one reason why the system analysis is an essential foundational step in risk management. If risk analysis is not based upon a thorough understanding of the system, you may miss important details that could cause the system to fail. The knowledge gained in the system analysis and subsequent risk analysis will later be used to develop a mitigating strategy.
Risk controls will target the conditions that we think will cause an accident or affect its severity or likelihood.
3. Risk analyses in operational contexts are often based on expertise and expert judgment, but they should also use data from the carrier’s own experience or those of others in the industry where available. Review of accident statistics, failure data, error data (e.g., runway incursion reports or information from the National Aeronautics and Space Administration (NASA)’s Aviation Safety Reporting System (ASRS)) or equipment reliability data may help in determining likelihood.
§ 5.55 Safety risk assessment and control.
(a) The certificate holder must develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
Par 3-4 Page 24
4. The type of consequence (e.g., error, failure, accident, or incident) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often lead only to aircraft damage.
5. Even where the best estimate has to be based on reasonable expert judgment, effective risk management can be accomplished by applying a disciplined analysis. The outputs could be recorded in a simple recording medium such as a notebook, basic desktop software, a WBAT,5 or a spreadsheet application.
(g) Scalability.
1. Small. Risk analysis could be performed by the owner/manager, and/or another employee(s). It might be performed in conjunction (by the same individual/group) with system description and analysis, hazard identification, risk assessment, and risk control.
2. Medium. Risk analysis could be performed by a member of management and/or the designated management representative with a small workgroup of company SMEs and stakeholders.
3. Large. Risk analysis might be performed at multiple organizational levels,
(e.g., the corporate, division, or department levels) and facilitated by the Safety Department or specially trained analytical personnel shared with other departments. The organization might have standing committees of SMEs and stakeholders participating at various levels.
(2) Safety Risk Assessment.
5 The Web-Based Analysis Tool (WBAT) is a federally developed and funded software system that may be used to assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which supports the air carrier’s implementation of SMS.
Par 3-4 Page 25
(a) SRRs. Section 5.55(b).
(b) Related Regulatory Requirements.
• Section 5.23(a)(2)(i), Accountabilities of Members of Management.
• Section 5.23(b), Decision Authority Regarding Safety Risk Acceptance.
(c) ICAO/SMSPP. Element 2.2/Process 2.2.2.
(d) Objective. To make a decision regarding the acceptability of operation in the presence of an identified hazard.
(e) Part 5 Requirements.
(f) Discussion. Once the risk is analyzed, you must assess whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides you with a way to integrate the effect of severity of the outcome and the probability of occurrence, which enables you to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
1. If a risk matrix is used, the carrier should develop criteria for severity and likelihood that are appropriate for their type of operations and their operational scenario. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. In this case, different types of airplanes operated and their relative values would dictate different scales between carriers. Likewise, the method that the carrier uses to estimate likelihood will have an effect on how likelihood scales are defined. If the carrier prefers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Figure 3-2 below depicts a sample risk matrix.
§ 5.55 Safety risk assessment and control.
(b) The certificate holder must define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
Par 3-4 Page 26 FIGURE 3-2. SAMPLE RISK MATRIX
2. Risk assessment is based on judgment, experience, and input from data collection tools (DCT) and previous processes. If the risk is acceptable, it may be done with the SRM process. If this is the case, then the system may be placed into operation and monitored in the SA process. If you decide the risk is not acceptable, you will need to follow the next step in SRM, which is developing risk controls.
3. Risk assessments must also involve the levels of management with the authority to make risk decisions, deciding what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispatching a flight that presents a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For large scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance decisions will depend on the scope of the proposed change to the operation and the level of risk presented to the operation.
4. The outputs of this process could be recorded on paper or via an electronic medium, such as a WBAT.
(g) Scalability.
1. Small. Risk assessment could be performed by the owner/manager, and/or another employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. These processes could be similar to a flight risk management process, or you could use a risk matrix.
2. Medium and Large. SRM should be coordinated across the divisional and geographic units of the company to assure integrated decisionmaking and communication.
Decisions involving multiple systems may require joint decisionmaking among departments or managers responsible for those systems. Many companies have standing committees made up of senior managers, who are the decision makers, supported by working groups of technical