Par 4-1 Page 49 CHAPTER 4. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT SYSTEM (SMS)
4-1. PROCESS OVERVIEW.
a. Existing Title 14 of the Federal Code of Regulations (14 CFR) Part 121 Certificate Holders. For existing part 121 certificate holders, the process of creating an SMS and an implementation plan consists of the following:
• Mapping and analyzing your existing organization,
• Determining the extent to which your organization already complies with the requirements of 14 CFR part 5,
• Developing a plan to comply with the requirements of part 5 with which your organization does not already comply, and
• Submitting the plan to the Federal Aviation Administration (FAA) for approval.
NOTE: Existing part 121 certificate holders who wish to use their implementation plan that has been validated through SMS Pilot Project (SMSPP)/SMS Voluntary Program (SMSVP) must update their implementation plan to ensure compliance with part 5.
b. New Certification. SMS implementation for a certificate applicant is different than that for a certificate holder. The implementation plan requirement and the specific deadline for full SMS implementation is dependent on when your organization’s formal application for a part 121 certificate is accepted by the FAA.
(1) Applicants Completing Formal Application After March 9, 2015. According to 14 CFR part 119, § 119.8, applicants that have not completed formal application prior to March 9, 2015 must demonstrate that they meet the full requirements of 14 CFR part 5 prior to being issued a certificate. The application process for a part 121 certificate can be found in FAA Order 8900.1, Volume 10 (ATOS), Chapter 6, Section 2, Certification Process Document or Volume 2, Chapter 3 for Safety Assurance System (SAS).
(2) Applicants Completing Formal Application Prior to March 9, 2015. Applicants that have completed formal application prior to March 9, 2015 may be issued certificates;
however, they are still responsible for meeting the deadlines set out in §§ 119.8 and 5.1.
(a) Applicants Completing All Other Certification Requirements Prior to September 9, 2015. These applicants can be certificated without an SMS implementation plan.
However, they must submit an SMS implementation plan prior to September 9, 2015 for approval by the FAA.
(b) Applicants Completing All Other Certification Requirements Prior to March 9, 2016. These applicants must submit an SMS implementation plan for review by the FAA prior to being issued a certificate. They must have an approved implantation plan prior to March 9, 2016.
Par 4-1 Page 50
(c) Applicants Completing All Other Certification Requirements After March 9, 2016. Prior to receiving a part 121 certificate, these applicants will be required to have an approved SMS implementation plan for completion of all part 5 requirements prior to March 9, 2018.
(d) Applicants Unable to Complete All Certification Requirements Prior to March 9, 2018. These applicants will be required to demonstrate compliance with all requirements for SMS prior to being issued a certificate.
4-2. MAPPING AND ANALYZING YOUR ORGANIZATION. The first step in developing an SMS is mapping out and analyzing your organization. The initial mapping and analysis starts by describing and documenting your organizational structure, operational environment, and specific functions of each department.
a. Organizational Description. An organizational description should detail your company’s departments by operations, as well as management personnel responsible for the company’s systems (e.g., flight operations, training, ground operations, cabin safety, dispatch, maintenance). The organizational description may include, for example, discussion of using contractors for fueling and deicing operations, maintenance functions, etc. It is also common for unions of various employee groups to be discussed and described during the organizational description process.
b. Analysis. Following the organizational description, an analysis should describe and document what each department does, identify responsible and/or accountable personnel, and record who has the authority to modify processes and procedures and accept risk for each department. Typical timeframes: A small service provider may complete an organizational description in a few days; a medium-size service provider may do so within a couple of weeks, and a large organization may need a month or more.
4-3. CONDUCTING A GAP ANALYSIS. To build an implementation plan, you need to understand your current state of compliance with part 5, as well as programs you may already have that could be used to satisfy the requirements of part 5. A gap analysis involves analyzing and assessing your existing programs, systems, processes, and activities with respect to SMS requirements found in part 5. Your company may use any technique to identify what needs to be done to implement an SMS. If you chose to utilize a gap analysis, the completed gap analysis will provide input for development of your implementation plan.
a. Organizational Processes. Most certificate holders have many of the elements of an SMS in their current operational processes, although those processes may not entirely fulfill the requirements of part 5 (e.g., they may be limited in scope (do not cover the entire organization) and interoperability (do not interface sufficiently to form a “system”)). A list of regulatory and voluntary programs that may be appropriate for inclusion in your SMS to satisfy the requirements of part 5 can be found in Chapter 5, Integrating Existing Safety Programs into the Safety Management System (SMS).
b. Gap Analysis. In order to establish overall organizational compliance, the certificate holder should compare its current organizational processes to part 5 requirements.
Par 4-3 Page 51 An implementation plan is then prepared to fill the gaps identified in the analysis. An optional FAA Gap Analysis Tool has been developed to assist certificate holders in their gap analysis efforts. An example is available in Appendix 5, Sample Gap Analysis and Implementation Plan Excerpts, but any method and/or tool that ensures complete coverage of part 5 requirements may be used by the certificate holder.
NOTE: If you determine that a process in your organization satisfies part 5, your gap analysis should identify how that process meets the requirements of part 5.
4-4. PREPARING AN IMPLEMENTATION PLAN.
a. What is an Implementation Plan?
(1) An implementation plan is a document that outlines the steps the air carrier plans to take to ensure that it has an SMS that is acceptable to the FAA by March 9, 2018.
(2) The requirements for an implementation plan are in §§ 5.1(b) and (c).
(3) To ensure that resources are being allocated and to monitor the development and implementation of the SMS, your accountable executive should be designated prior to the development of the implementation plan. The accountable executive is ultimately responsible for implementation and performance of the SMS.
b. What an Implementation Plan Should Cover. The implementation plan must cover the functions of your organization that directly impact aviation safety and the complete timeline of SMS development.
(1) It should include milestones for the development of the processes and procedures required by part 5.
(2) It should be updated as necessary as SMS implementation progresses.
(3) It should show a reference to each applicable part 5 section requirement and include a brief description explaining either:
• How you already comply with the specified requirement, or
• How you plan to comply with the requirement.
(4) The implementation plan should assign responsibility for completing implementation tasks/actions.
NOTE: An SMS process is considered “implemented” and in compliance with part 5 when: all process documentation (manuals) is complete and published; all process personnel are available and trained; all hardware/software is available and in the location of its intended use; and the Certificate Management Team (CMT) has validated the process.
Par 4-4 Page 52
(5) The implementation plan need not be complex or excessively detailed, but should provide a basic roadmap to meet part 5 requirements. The implementation plan may consist of more than one document, combined with the gap analysis document, or created in a format useful to your company. An implementation plan can be found in Appendix 5, Sample Gap Analysis and Implementation Plan Excerpts. If you are a part 121 certificate holder, your implementation plan must be approved by your respective CMT.
(6) Similar to the gap analysis process, you should receive input from the managers of all your organizational divisions and functional areas covered by the SMS. This is necessary to form a plan filling in all the gaps discovered during the gap analysis.
4-5. PHASED SMS IMPLEMENTATION STRATEGY.
a. Introduction. One recommended, but not required, way to implement an SMS is through a phased implementation approach. The sample SMS implementation strategy has four phases. For example, the four levels of phased implementation could be:
• Level 1 - Planning and organization,
• Level 2 - Basic safety management,
• Level 3 - Fully functional SMS, and
• Level 4 - Continuous improvement.
NOTE: Utilizing this method, the overall complexity of the task is divided into smaller, more manageable subcomponents.
b. Implementation Levels—Overview. The overall objective of the levels is to develop and implement an integrated, comprehensive SMS for your entire organization. Phased implementation can be thought of as organizational learning — the same building block approach often used in training and education of personnel. The recommended SMS development levels, as follows, are suggested but not required. Your organization may determine and develop your own phases, levels, divisional implementation strategies, etc. This four-level approach is only a representative template. Figure 4-1, Recommended Safety Management System (SMS) Implementation Levels, illustrates the recommended levels of SMS development and implementation.
Par 4-5 Page 53 FIGURE 4-1. RECOMMENDED SAFETY MANAGEMENT SYSTEM
IMPLEMENTATION LEVELS
(1) Implementation Level 1: Planning and Organization. Level 1 begins when your management team commits to providing the resources necessary for full SMS implementation.
Level 1 includes a thorough understanding of your organizational structure and a comparison (gap analysis) between the part 5 requirements and your organizational structure. Your organization will develop an implementation plan to bridge your identified gaps. The final implementation plan must be approved by your CMT.
(2) Implementation Level 2: Basic Safety Management. Level 2 is where you develop and implement basic Safety Risk Management (SRM) and Safety Assurance (SA) processes and apply those processes to existing systems. This is often called the “reactive phase.”
At this phase, your company is able to identify hazards and address unacceptable risk. Level 2 implementation, depending on the size and complexity of the organization, typically takes 12 months to complete.
(3) Implementation Level 3: Functional SMS. Level 3 is where your SRM process will be applied to the initial design of systems, processes, organizations, and services;
development of new or changed operational procedures; and planned changes to operational processes. This is the “proactive/predictive” phase, where risks in future planned operations are addressed. Both the SRM and SA processes developed at Level 2 are now applied in a predictive manner —applying safety management to something that you have not done before. At the completion of Level 3, you have a fully implemented SMS.
(4) Implementation Level 4: Continuous Improvement. At Level 4, you are monitoring your SMS and operational processes. By the time you reach this level, all required SMS processes are already in place. A major objective of a successful SMS is to attain and maintain this continuous improvement status for the life of the organization.
c. SMS Implementation Layout. Figure 4-2, Safety Management System Development, shows an example of a high-level phased implementation layout. An implementation plan prepared according to this layout would apply milestones, responsibilities, resources, and documentation.
4 1 2 3 Basic Safety Management
Fully Functional SMS
Continuous Improvement Planning & Organization
Par 4-5 Page 54 FIGURE 4-2. SAFETY MANAGEMENT SYSTEM DEVELOPMENT SMS Processes should be implemented by the indicated Level of Implementation Implementation Level SMS Processes 1 2 3 Part 5, Subpart B - Safety Policy (SMSPP 1.0) X § 5.21 - Safety Policy (SMSPP 1.1) X § 5.23 - Safety Accountability and Authority (SMSPP 1.2) X § 5.25 - Designation and responsibilities of required safety management personnel (SMSPP 1.3) (*1) X § 5.27 - Coordination of emergency response planning (SMSPP 1.4) X Part 5, Subpart C - Safety Risk Management (SRM) (SMSPP 2.0) (*4) X § 5.51 - Applicability - (SMSPP 2.0) X § 5.53 - System analysis and hazard identification (SMSPP 2.1) (*4) X § 5.53(a) and (b) - System analysis (SMSPP 2.1.1) X § 5.53(c) - Hazard Identification (SMSPP 2.1.2) X § 5.55 - Safety Risk Assessment and Control (SMSPP 2.2) X § 5.55(a) - Analyze Safety Risk (SMSPP 2.2.1) X § 5.55(b) - Safety Risk Assessment (SMSPP 2.1.2) X § 5.55(c) - Safety Risk Control (SMSPP 2.1.3) X Part 5, Subpart D - Safety Assurance (SA) (SMSPP 3.0) (*3) X § 5.71 - Safety Performance Monitoring and Measurement (SMSPP 3.1) X § 5.71(a)(1) and (2) - Monitoring (SMSPP 3.1.1) X § 5.71(a)(3) - Auditing (SMSPP 3.1.2 and 3.1.4) X § 5.71(a)(4) - Evaluations (SMSPP 3.1.3) X § 5.71(a)(5) and (6) - Investigations (SMSPP 3.1.5) X § 5.71(a)(7) - Confidential Employee Reporting System (SMSPP 3.1.6) X § 5.71(b) - Analyze Data (SMSPP 3.1.7) X § 5.73 - Safety Performance Assessment (SMSPP 3.1.8) (*3) X § 5.75 - Continuous Improvement (SMSPP 3.3) X § 5.75 - Correct Safety Performance (SMSPP 3.3.1) X Part 5, Subpart E - Safety Promotion (SMSPP 4.0) X § 5.91 - Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X § 5.93 - Safety Communication (SMSPP 4.2) X Part 5, Subpart F - SMS Documentation and Recordkeeping (SMSPP 1.5) X § 5.95 - SMS Documentation (SMSPP 1.5) X § 5.97 - SMS Records (SMSPP 1.5) X (*1) Level 1 - Implement - § 5.25(c)(1) only (*2) Level 1 - A training plan is expected for all personnel (*3) Level 2 - Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards (No need to baseline entire organization). Do not implement § 5.73a(4) and (5) (*4) Level 2 - Implementation of § 5.53, will be limited in level 2 by the lack of the system analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)
Par 4-5 Page 55 (and 54) SMS Processes should be implemented by the indicated Level of Implementation Implementation Level SMS Processes 1 2 3 Part 5, Subpart B - Safety Policy (SMSPP 1.0) X § 5.21 - Safety Policy (SMSPP 1.1) X § 5.23 - Safety Accountability and Authority (SMSPP 1.2) X § 5.25 - Designation and responsibilities of required safety management personnel (SMSPP 1.3) (*1) X § 5.27 - Coordination of emergency response planning (SMSPP 1.4) X Part 5, Subpart C - Safety Risk Management (SRM) (SMSPP 2.0) (*4) X § 5.51 - Applicability - (SMSPP 2.0) X § 5.53 - System analysis and hazard identification (SMSPP 2.1) (*4) X § 5.53(a) and (b) - System analysis (SMSPP 2.1.1) X § 5.53(c) - Hazard Identification (SMSPP 2.1.2) X § 5.55 - Safety Risk Assessment and Control (SMSPP 2.2) X § 5.55(a) - Analyze Safety Risk (SMSPP 2.2.1) X § 5.55(b) - Safety Risk Assessment (SMSPP 2.1.2) X § 5.55(c) - Safety Risk Control (SMSPP 2.1.3) X Part 5, Subpart D - Safety Assurance (SA) (SMSPP 3.0) (*3) X § 5.71 - Safety Performance Monitoring and Measurement (SMSPP 3.1) X § 5.71(a)(1) and (2) - Monitoring (SMSPP 3.1.1) X § 5.71(a)(3) - Auditing (SMSPP 3.1.2 and 3.1.4) X § 5.71(a)(4) - Evaluations (SMSPP 3.1.3) X § 5.71(a)(5) and (6) - Investigations (SMSPP 3.1.5) X § 5.71(a)(7) - Confidential Employee Reporting System (SMSPP 3.1.6) X § 5.71(b) - Analyze Data (SMSPP 3.1.7) X § 5.73 - Safety Performance Assessment (SMSPP 3.1.8) (*3) X § 5.75 - Continuous Improvement (SMSPP 3.3) X § 5.75 - Correct Safety Performance (SMSPP 3.3.1) X Part 5, Subpart E - Safety Promotion (SMSPP 4.0) X § 5.91 - Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X § 5.93 - Safety Communication (SMSPP 4.2) X Part 5, Subpart F - SMS Documentation and Recordkeeping (SMSPP 1.5) X § 5.95 - SMS Documentation (SMSPP 1.5) X § 5.97 - SMS Records (SMSPP 1.5) X (*1) Level 1 - Implement - § 5.25(c)(1) only (*2) Level 1 - A training plan is expected for all personnel (*3) Level 2 - Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards (No need to baseline entire organization). Do not implement § 5.73a(4) and (5) (*4) Level 2 - Implementation of § 5.53, will be limited in level 2 by the lack of the system analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)
Par 5-1 Page 57 CHAPTER 5. INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY
MANAGEMENT SYSTEM (SMS)
5-1. PURPOSE OF THIS CHAPTER. This chapter explains how your existing safety programs may be integrated into the SMS Safety Assurance (SA) processes. The Federal Aviation Administration (FAA) encourages the continued use of your current safety programs as part of overall safety management. Expanding your current safety programs across your entire organization is one way to provide a comprehensive systems approach to SA.
5-2. DISCUSSION OF INDIVIDUAL PROGRAMS.
a. Safety Programs and the SMS. Certificate holders are encouraged to be creative in utilizing safety programs to meet the specifications of the SMS rule. These programs collect data on the performance of the safety system, so most can be used to help satisfy some of the SA requirements.
b. FAA-Sanctioned Programs. The following are FAA-sanctioned programs, but they are not the only programs available.
(1) Continuing Analysis and Surveillance System (CASS).
(a) Program. CASS is required by Title 14 of the Code of Federal Regulations (14 CFR) part 121, § 121.373. CASS is a quality assurance (QA) system that monitors and analyzes the performance and effectiveness of the air carrier’s Continuous Airworthiness Maintenance Program (CAMP).
(b) Integration. A CASS overlaps some of the SMS SA functions (14 CFR part 5, § 5.71). CASS could be a standalone system, or a subsystem within an SMS. CASS may be maintained separately; however, it would probably be beneficial to integrate CASS within the SMS. However accomplished, it is imperative to understand that CASS should supply information to the SMS. The SMS may even support CASS through the use of Safety Risk Management (SRM) and SA processes applied to CASS needs. An SMS may evaluate the CASS to ensure that all critical CASS elements are being performed and controlled and all outcomes are acceptable in accordance with FAA Order 8900.1, Volume 3, Chapter 44, Assess Continuing Analysis and Surveillance System for Parts 121 and 135, and the current edition of Advisory Circular (AC) 120-79, Developing and Implementing an Air Carrier CASS.
(2) Aviation Safety Action Program (ASAP).
(a) Program. The ASAP is meant to encourage voluntary reporting of safety issues and events that come to the attention of participating certificate holders’ employees. ASAPs include processes for intake of data from employees, analysis of the data, and development of corrective actions within a confidential environment. ASAP is accepted by the FAA but is not required. ASAP development, implementation, acceptance, and operation are detailed in the current edition of AC 120-66, Aviation Safety Action Program (ASAP).
(b) Integration. ASAP can be used to satisfy some SMS requirements (§ 5.71).
For example, the ASAP can be used to partially satisfy the requirement for a confidential
Par 5-2 Page 58 reporting system. Employee groups not covered by an ASAP would need some type of confidential employee reporting system. In the event of termination of an ASAP program, those covered employees would be required to have a confidential employee reporting system. ASAP requires analysis and corrective action; however, it does not require analysis of patterns or trends across reports that would identify systemic problems. This information should be analyzed through the SA process.
(3) Aviation Safety Reporting System (ASRS).
(a) Program. The FAA ASRS utilizes the National Aeronautics and Space Administration (NASA) as a third party to receive aviation safety reports. The ASRS does not provide an explicit requirement for corrective actions, nor does it provide sufficient detailed data with which to adequately analyze specific systems or processes.
(b) Integration. Trend and global systemic information may be appropriate for SA analysis under SMS. Additional information on these policies can be obtained in AC 00-46, Aviation Safety Reporting Program.
(4) Flight Operational Quality Assurance (FOQA).
(a) Program. FOQA is a voluntary program for the routine collection and analysis of digital flight data generated during aircraft operations. The FOQA program is another potential tool in an operator’s SMS to monitor operational data and provides data analysis and assessment. FOQA program development, implementation, acceptance, and operation are covered in the current edition of AC 120-82, Flight Operational Quality Assurance.
(b) Integration. FOQA can be used to satisfy some SMS SA requirements (§ 5.71).
FOQA requires data collection and analysis but stops short of requiring corrective action. Thus, this requirement would be dependent on the configuration of the specific operator’s program — a subject of the gap analysis. FOQA, if present, must interface with the operator’s other safety programs and their SMS.
(5) Voluntary Disclosure Reporting Program (VDRP).
(a) Program. The VDRP provides incentives for a certificate holder to voluntarily identify, report, and correct instances of regulatory noncompliance. The FAA will review, accept, and oversee corrective actions and conduct followup surveillance. The FAA’s acceptance of the voluntary disclosure foregoes legal enforcement action, and protects from release, when specific criteria are met, qualifying disclosures and corrective actions. Additional information on the VDRP can be obtained in the current edition of AC 00-58, Voluntary Disclosure Reporting Program.
(b) Integration. VDRP data is not normally a source of safety information.
However, the data gathered during an investigation, subsequent development, and implementation of a fix could be integrated into the data analysis, assessment, and validation processes of a carrier’s SMS SA.
Par 5-2 Page 59 (and 58)
(6) Internal Evaluation Program (IEP).
(a) Program. The IEP can be a safety process that, through inspections, audits, and evaluations, assesses the adequacy of managerial controls and processes in critical safety systems. The FAA encourages (and the Department of Defense (DOD) requires) using an IEP to increase awareness management and employees’ responsibility to follow company safety practices and comply with all regulatory requirements. IEP is the subject of the current editions of AC 120-59, Air Carrier Internal Evaluation Program, and AC 145-5, Repair Station Internal Evaluation Programs.
(b) Integration. An IEP can be part of an SA process. If used by a certificate holder, an IEP can satisfy the internal evaluation requirement of § 5.71. Since an IEP is not covered by a standalone regulation or formal voluntary program approval process, its use within an SMS is dependent on the configuration.
(7) Line Operations Safety Audit (LOSA).
(a) Program. The Line Operations Safety Audit (LOSA) is a formal process where qualified observers ride the jump seat during regularly scheduled flights to collect safety-related data on various weather and visibility conditions, operational complexities, and flightcrew performance. A LOSA program is not formally approved or accepted by the FAA. LOSA is the subject of the current edition of AC 120-90, Line Operations Safety Audits.
(b) Integration. A LOSA program could be used to satisfy part of the internal audit requirements of § 5.71. A gap analysis would be required to ensure that it meets SMS standards.
LOSA results, if present, should be included in the SA data acquisition process.
(8) Advanced Qualification Program (AQP).
(a) Program. The AQP is a systematic methodology for developing training program components for air carrier crewmembers and dispatchers. An AQP incorporates data-driven quality control processes for validating and maintaining the effectiveness of curriculum content. AQP is the subject of the current edition of AC 120-54, Advanced Qualification Program.
(b) Integration. The AQP can be used to satisfy a portion of the SMS SA monitoring requirement (§ 5.71(a)(1)). The certificate holder may elect to use or develop an AQP, depending on their unique operational complexities.