e. Safety Performance Assessment.
(1) SRR. Section 5.73.
(2) Related Regulatory Requirements. Sections 5.23(a)(2)(ii) and 5.25(b)(1).
(3) ICAO/SMSPP. Element 3.1/Processes 3.1.8, 3.2, and 3.3.2.
(4) Objective. To make decisions regarding safety performance with reference to safety objectives and regulatory compliance.
(5) Part 5 Requirements.
§ 5.73 Safety performance assessment.
(a) The certificate holder must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to:
(1) Ensure compliance with the safety risk controls established by the certificate holder;
(2) Evaluate the performance of the SMS.
(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls.
(4) Identify changes in the operational environment that may introduce new hazards.
(5) Identify new hazards.
(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under
paragraph (a)(2) through (a)(5) of this section, the certificate holder must use the safety risk
management process described in subpart C of this part.
(6) Discussion. Under § 5.71, collected safety performance data is analyzed and the results are used for informed decisionmaking. The assessment process is where these decisions are made. Decisions are made by personnel with assigned responsibility and authority. The SA process should consider who makes the decisions regarding whether the company’s safety performance is effective and whether the company is meeting its safety objectives and expectations that are identified in the safety policy required by § 5.21. The conclusions of the safety assessments are reported to the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary.
(a) Assessments can have one of the following general outcomes:
• Performance is acceptable and objectives are being met.
• Performance is not acceptable, and analysis suggests that the problem lies with conformity with regulations or company policy and procedures, or necessary resources have not been provided. In the event this occurs, corrective action under § 5.75 would be warranted.
• Conformity with the risk controls and regulations appears to be satisfactory;
however, desired results are not being obtained. In the event that this occurs, the SRM processes would be triggered.
• New or uncontrolled hazards are discovered. This may be due to new hazards having arisen since the system was designed or discovery of factors Par 3-5 Page 39
that were overlooked. In this case, as in the previous, the SRM processes must be followed.
(b) The results of assessments can be recorded in a paper or electronic medium in a common logbook-style binder, an electronic file folder, common desktop software, or specialized system, such as a WBAT.
(7) Scalability.
(a) Small and Medium. As an organization grows in size, it is normal to have additional personnel performing safety, quality, or internal evaluation functions. An SMS does not change the number and types of personnel in these situations as much as it may change the way in which these persons and organizations work and interact. For example, safety performance and assessment could be a documented activity performed by the accountable executive or a coordinated activity between the accountable executive and other operational managers, supported and coordinated by the DOS. Risk acceptance would also normally fall to managers within this group.
(b) Large. This process is best addressed at the highest level in the organization and involves the accountable executive, division vice presidents, and other defined leaders and decision makers. At each level, the company would define who is responsible for making risk acceptance decisions and what actions should be taken to either correct the problem or design new risk controls. Larger companies typically have standing management committees at the functional organization level (e.g., flight operations, technical operations/maintenance, in-flight services, dispatch/operational control) and a second body at the corporate level to assure integration, coordination, and review by the accountable executive.
f. Continuous Improvement.
(1) SRR. Section 5.75.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Element 3.3/Process 3.3.1.
(4) Objective. To provide the organization’s decision makers with a means to correct safety performance deficiencies identified in the safety performance assessment process.
(5) Part 5 Requirements.
§ 5.75 Continuous improvement.
The certificate holder must establish and implement processes to correct safety performance deficiencies
identified in the assessments conducted under § 5.73.
Par 3-5 Page 40
(6) Discussion.
(a) The final step within SA is continuous improvement. This process is designed to ensure that you are correcting substandard safety performance identified during the safety performance assessment in order to continuously improve safety performance.
(b) As discussed in subparagraph 3-5e, Safety Performance Assessment), the corrective action process of § 5.75 is triggered when conformity with risk controls has been found to be deficient. In this case, it is not necessary to conduct a new safety risk analysis. Risk has already been assessed as being unacceptable without satisfactory completion of the risk control. For example, if it has been found that an Airworthiness Directive (AD) has not been applied to a particular aircraft, the only correct action is to comply with the risk control (in this case, the AD). The risk of flying the airplane without the AD has already been assessed as unacceptable.
(7) Scalability. Continuous improvement decisionmaking is an output of the performance assessment process. Therefore, the arrangements discussed for assessment apply to scalability for continuous improvement activities. The managers, committees, or working groups that make assessment decisions would also lay out courses of corrective action.
g. An SA Example. This example builds on the scenario discussed in the SRM example, which can be found in the SRM section, subparagraph 3-4e. In that example, an airline addressed the unacceptable risk of an airport approach procedure by imposing risk controls consisting of a change to operational procedures, including programming of the FMS and associated approach procedure training for flightcrew members.
(1) As required by §§ 5.71(a)(1) and 5.73(a)(1) and (a)(3), the air carrier specifically monitored the flight operations and the associated controls at the airport by the operational control/dispatch organization as part of their normal activities. This organization was tasked with assuring that crews assigned to the specific flights were appropriately qualified (thus verifying that this part of the risk control was being employed), and that the airplanes scheduled for the flights had appropriate operational equipment. As required by § 5.71(a)(2), the air carrier also monitored the airport to determine whether the altered approach procedure was still necessary.
(2) Another part of the risk control monitoring and auditing was conducted using structured line checks pursuant to § 5.71(a)(3). This method was used to conduct audits of specific flight operations (in addition to the airline’s normal checking procedures), thus providing data to verify that the procedures put in place provided risk controls that are effective, as required by § 5.73(a)(3). At the same time, per § 5.71(a)(7), the airline’s employee reporting system was available for pilots to submit their concerns to the company. Line check and employee reporting data were collected and analyzed under § 5.71, and then assessed by management under § 5.73.
(3) If any deficiencies were found, an analysis would have been conducted to ascertain whether the deficiencies should be addressed through SRM (per § 5.73(b)) or a correction (per § 5.75). If the root cause of the deficiencies was shortfalls in compliance with the designed operational process (e.g., required training was not completed), the deficiency should be Par 3-5 Page 41
addressed through a correction, per § 5.75. However, if the deficiency was associated with the basic design of the control (e.g., inadequate training curriculum), the SRM process would be repeated to revise the procedure in the areas where it was found deficient, per § 5.73(b).
3-6. SUBPART E: SAFETY PROMOTION.
a. Introduction.
(1) SRR. Part 5, subpart E, Safety Promotion
(2) Related Regulatory Requirements. Section 5.23(a)(2)(ii), Accountabilities of Members of Management.
(3) ICAO/SMSPP. Component 4.0.
(4) Objective. To provide employees with effective SMS training commensurate with their safety responsibilities, and to create a means to deliver organization-wide safety communication.
(5) Discussion. Because a key component of SMSs is the effective control of risk, every member in your organization must understand and take responsibility for the role they play in controlling risk by their actions and behavior. These members should also have access to up-to-date safety information so that they can properly fulfill their roles.
b. Competencies and Training.
(1) SRR. Section 5.91.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Element 4.1/Processes 4.1.1 and 4.1.2.
(4) Objective. To assure that employees are competent to perform their SMS-related duties.
(5) Part 5 Requirements.
§ 5.91 Competencies and training.
The certificate holder must provide training to each individual identified in § 5.23 to ensure the individuals
attain and maintain the competencies necessary to perform their duties relevant to the operation and
performance of the SMS.
(6) Discussion. Your organization will need to train its employees. Your employees may receive initial safety training for them to understand and perform their safety duties.
Recurrent training may also be necessary to reinforce these skills. For example, a Safety Department employee will probably need more detailed SMS training (such as safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than will a baggage handler. Line managers may need to know the potential consequences of safety Par 3-5 Page 42
failures and system failure modes more so than line employees will. Line employees may only need an overview of safety management fundamentals for their operational department (e.g., instructions on how to identify and report safety concerns).
(a) Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they successfully perform work functions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. By training your employees, you should establish competencies for all employees, commensurate with their duties relevant to the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests, and then measured periodically during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As part of SA, organizations should periodically review their training program(s) to ensure that those programs meet the objectives set out in the safety policy.
(b) It is the responsibility of your organization to determine its own training needs based on competency requirements. Management personnel, specifically designated by the accountable executive to ensure the SMS is fully implemented, may need to be trained first and may also need specialized training to fulfill their responsibilities. Determining the organization’s training needs starts with a careful review of the safety policy, processes, and objectives.
Everyone working within the scope of SMS should receive training commensurate with their position in the organization.
(7) Scalability. Organizations of all sizes may choose to either train their employees in house or to contract out the training to outside vendors. Whichever option is taken, the training must be specific to your company’s SMS and operations.
c. Safety Communication.
(1) SRR. Section 5.93.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Element 4.2.
(4) Objective. To assure that employees have current and pertinent safety information.
(5) Part 5 Requirements.
§ 5.93 Safety communication.
The certificate holder must develop and maintain means for communicating safety informat ion that, at a minimum:
(a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities.
(b) Conveys hazard information relevant to the employee’s responsibilities.
(c) Explains why safety actions have been taken.
(d) Explains why safety procedures are introduced or changed.
Par 3-6 Page 43
(6) Discussion.
(a) Effective communication involves adjusting the content of the communication and manner in which the information is delivered to match the target employee’s role in the organization. The accountable executive must ensure that communication mechanisms are available and are effectively utilized. The delivery system should be appropriate according to the size and complexity of the organization.
(b) Safety policy and information could be provided as text, visual media such as posters or short videos, orally, or through examples. Messages should be consistent and in a form employees at each level can relate to, and be delivered using whichever media the organization has available. For example, hazard communications regarding birds for flightcrew members (regarding new bird strike avoidance techniques) may be in a “Notices” section of the Flight Operations Manual (FOM), and may be reinforced by recurrent training. Hazard communications made to line maintenance technicians (regarding birds roosting and nesting in flight controls, auxiliary power unit (APU) intakes, and engine cowlings) may be conveyed by posters and changes to daily inspection procedures. Hazard communications regarding birds made to ground service personnel may be in the form of posters, videos, and demonstrations (cleaning and removing bird droppings from windshields).
(7) Scalability.
(a) Small. Communicating safety considerations to employees will probably be simple and direct. For example, the company owner or the organization could conduct regular all-hands/employee meetings, such as “hangar talk sessions.” Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams.
(b) Medium. Communication methods may be more structured than in small organizations. Safety information may be published throughout the company by printed or electronic means. Safety meetings are likely more structured and formal. Communication and feedback may be formalized in order to provide information to individual employees as well as organization-wide information for cross-boundary issues and/or common hazards.
(c) Large. Communication is more likely to be formal and a tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel.
Information technology (IT) approaches, such as email broadcasts or intranet Web sites, may be considered to facilitate directing the flow of safety information and recording its accomplishment for evaluation and auditing purposes.
3-7. SUBPART F: SMS DOCUMENTATION AND RECORDKEEPING.
a. Introduction.
(1) SRR. Part 5, Subpart F.
(2) Related Regulatory Requirements. None.
Par 3-6 Page 44
(3) ICAO/SMSPP. Element 1.5.
(4) Discussion. You must establish and maintain SMS information, in either paper or electronic form, describing the safety-related processes and procedures. Additionally, you must maintain the SMS records discussed below for a specified period of time.
b. SMS Documentation.
(1) SRR. Section 5.95.
(2) Related Regulatory Requirements. None.
(3) ICAO/SMSPP. Element 1.5.
(4) Part 5 Requirements.
§ 5.95 SMS documentation.
The certificate holder must develop and maintain SMS documentation that describes the certificate holder’s:
(a) Safety policy.
(b) SMS processes and procedures.
(5) Discussion. You must establish and maintain SMS information, in either paper or electronic form, describing the safety-related processes and procedures and interfaces between these. You should also implement a distribution system to ensure that the documents dealing with these processes and procedures are promptly updated whenever there is a change in one or more of these processes or procedures.
(6) Scalability.
(a) Small and Medium. The owner/manager or designee may be responsible for maintaining and distributing current versions of guidance documents. Documentation may consist of a set of typewritten documents, spreadsheets, and forms that are kept in file cabinets or binders. Managers of medium-size companies need the same type of information to make decisions, although the volume is typically larger than that of a small company and smaller than that of a large organization.
(b) Large. Documentation and recordkeeping processes for a large organization may use a WBAT, unique software applications, or development of new database tools to support risk reporting and analysis. These organizations should examine existing tools and infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements.
c. SMS Records.
(1) SRR. Section 5.97.
(2) Related Regulatory Requirements. None.
Par 3-7 Page 45
(3) ICAO/SMSPP. Element 1.5.
(4) Part 5 Requirements.
§ 5.97 SMS records.
(a) The certificate holder must maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation.
(b) The certificate holder must maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years.
(c) The certificate holder must maintain a record of all training provided under § 5.91 for each individual.
Such records must be retained for as long as the individual is employed by the certificate holder.
(d) The certificate holder must retain records of all communications provided under § 5.93 for a minimum of 24 consecutive calendar-months.
(5) Discussion. The timeline associated with the retention of the documents required by the regulation for outputs of SRM processes would be for as long as they remain relevant to the operation. For risk assessments, this may mean for as long as the air carrier engages in the activity for which the risk assessment was conducted. For risk controls, it may mean for as long as the risk control remains in effect.
(6) Scalability.
(a) Small. The owner/manager or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, and completed forms that are kept in file cabinets or binders.
(b) Medium. An individual or small staff may coordinate document maintenance and retention. This staff may use a combination of paper and electronic media to administer the process. Some records may be retained by department heads in accordance with a procedure delegating this responsibility.
(c) Large. The organization may have a dedicated records staff or department whose duties include document distribution and records retention. Due to the size and complexity of the organization, the use of technology is probably more pronounced.
Par 3-7 Page 46
CHAPTER 4. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT SYSTEM
(SMS)
4-1. PROCESS OVERVIEW.
a. Existing Title 14 of the Federal Code of Regulations (14 CFR) Part 121 Certificate Holders. For existing part 121 certificate holders, the process of creating an SMS and an implementation plan consists of the following:
• Mapping and analyzing your existing organization,
• Determining the extent to which your organization already complies with the requirements of 14 CFR part 5,
• Developing a plan to comply with the requirements of part 5 with which your organization does not already comply, and
• Submitting the plan to the Federal Aviation Administration (FAA) for approval.
NOTE: Existing part 121 certificate holders who wish to use their implementation plan that has been validated through SMS Pilot Project (SMSPP)/SMS Voluntary Program (SMSVP) must update their implementation plan to ensure compliance with part 5.
b. New Certification. SMS implementation for a certificate applicant is different than that for a certificate holder. The implementation plan requirement and the specific deadline for full SMS implementation is dependent on when your organization’s formal application for a part 121 certificate is accepted by the FAA.
(1) Applicants Completing Formal Application After March 9, 2015. According to 14 CFR part 119, § 119.8, applicants that have not completed formal application prior to March 9, 2015 must demonstrate that they meet the full requirements of 14 CFR part 5 prior to being issued a certificate. The application process for a part 121 certificate can be found in FAA Order 8900.1, Volume 10 (ATOS), Chapter 6, Section 2, Certification Process Document or Volume 2, Chapter 3 for Safety Assurance System (SAS).
(2) Applicants Completing Formal Application Prior to March 9, 2015. Applicants that have completed formal application prior to March 9, 2015 may be issued certificates;
however, they are still responsible for meeting the deadlines set out in §§ 119.8 and 5.1.
(a) Applicants Completing All Other Certification Requirements Prior to September 9, 2015. These applicants can be certificated without an SMS implementation plan.
However, they must submit an SMS implementation plan prior to September 9, 2015 for approval by the FAA.
(b) Applicants Completing All Other Certification Requirements Prior to March 9, 2016. These applicants must submit an SMS implementation plan for review by the FAA prior to being issued a certificate. They must have an approved implantation plan prior to March 9, 2016.
Par 4-1 Page 47
(c) Applicants Completing All Other Certification Requirements After March 9, 2016. Prior to receiving a part 121 certificate, these applicants will be required to have an approved SMS implementation plan for completion of all part 5 requirements prior to March 9, 2018.
(d) Applicants Unable to Complete All Certification Requirements Prior to March 9, 2018. These applicants will be required to demonstrate compliance with all requirements for SMS prior to being issued a certificate.
4-2. MAPPING AND ANALYZING YOUR ORGANIZATION. The first step in developing an SMS is mapping out and analyzing your organization. The initial mapping and analysis starts by describing and documenting your organizational structure, operational environment, and specific functions of each department.
a. Organizational Description. An organizational description should detail your company’s departments by operations, as well as management personnel responsible for the company’s systems (e.g., flight operations, training, ground operations, cabin safety, dispatch, maintenance). The organizational description may include, for example, discussion of using contractors for fueling and deicing operations, maintenance functions, etc. It is also common for unions of various employee groups to be discussed and described during the organizational description process.
b. Analysis. Following the organizational description, an analysis should describe and document what each department does, identify responsible and/or accountable personnel, and record who has the authority to modify processes and procedures and accept risk for each department. Typical timeframes: A small service provider may complete an organizational description in a few days; a medium-size service provider may do so within a couple of weeks, and a large organization may need a month or more.
4-3. CONDUCTING A GAP ANALYSIS. To build an implementation plan, you need to understand your current state of compliance with part 5, as well as programs you may already have that could be used to satisfy the requirements of part 5. A gap analysis involves analyzing and assessing your existing programs, systems, processes, and activities with respect to SMS requirements found in part 5. Your company may use any technique to identify what needs to be done to implement an SMS. If you chose to utilize a gap analysis, the completed gap analysis will provide input for development of your implementation plan.
a. Organizational Processes. Most certificate holders have many of the elements of an SMS in their current operational processes, although those processes may not entirely fulfill the requirements of part 5 (e.g., they may be limited in scope (do not cover the entire organization) and interoperability (do not interface sufficiently to form a “system”)). A list of regulatory and voluntary programs that may be appropriate for inclusion in your SMS to satisfy the requirements of part 5 can be found in Chapter 5, Integrating Existing Safety Programs into the Safety Management System (SMS).
b. Gap Analysis. In order to establish overall organizational compliance, the certificate holder should compare its current organizational processes to part 5 requirements.
Par 4-1 Page 48
An implementation plan is then prepared to fill the gaps identified in the analysis. An optional FAA Gap Analysis Tool has been developed to assist certificate holders in their gap analysis efforts. An example is available in Appendix 5, Sample Gap Analysis and Implementation Plan Excerpts, but any method and/or tool that ensures complete coverage of part 5 requirements may be used by the certificate holder.
NOTE: If you determine that a process in your organization satisfies part 5, your gap analysis should identify how that process meets the requirements of part 5.
4-4. PREPARING AN IMPLEMENTATION PLAN.
a. What is an Implementation Plan?
(1) An implementation plan is a document that outlines the steps the air carrier plans to take to ensure that it has an SMS that is acceptable to the FAA by March 9, 2018.
(2) The requirements for an implementation plan are in §§ 5.1(b) and (c).
(3) To ensure that resources are being allocated and to monitor the development and implementation of the SMS, your accountable executive should be designated prior to the development of the implementation plan. The accountable executive is ultimately responsible for implementation and performance of the SMS.
b. What an Implementation Plan Should Cover. The implementation plan must cover the functions of your organization that directly impact aviation safety and the complete timeline of SMS development.
(1) It should include milestones for the development of the processes and procedures required by part 5.
(2) It should be updated as necessary as SMS implementation progresses.
(3) It should show a reference to each applicable part 5 section requirement and include a brief description explaining either:
• How you already comply with the specified requirement, or
• How you plan to comply with the requirement.
(4) The implementation plan should assign responsibility for completing implementation tasks/actions.
NOTE: An SMS process is considered “implemented” and in compliance with part 5 when: all process documentation (manuals) is complete and published; all process personnel are available and trained; all hardware/software is available and in the location of its intended use; and the Certificate Management Team (CMT) has validated the process.
Par 4-3 Page 49
(5) The implementation plan need not be complex or excessively detailed, but should provide a basic roadmap to meet part 5 requirements. The implementation plan may consist of more than one document, combined with the gap analysis document, or created in a format useful to your company. An implementation plan can be found in Appendix 5, Sample Gap Analysis and Implementation Plan Excerpts. If you are a part 121 certificate holder, your implementation plan must be approved by your respective CMT.
(6) Similar to the gap analysis process, you should receive input from the managers of all your organizational divisions and functional areas covered by the SMS. This is necessary to form a plan filling in all the gaps discovered during the gap analysis.
4-5. PHASED SMS IMPLEMENTATION STRATEGY.
a. Introduction. One recommended, but not required, way to implement an SMS is through a phased implementation approach. The sample SMS implementation strategy has four phases. For example, the four levels of phased implementation could be:
• Level 1 - Planning and organization,
• Level 2 - Basic safety management,
• Level 3 - Fully functional SMS, and
• Level 4 - Continuous improvement.
NOTE: Utilizing this method, the overall complexity of the task is divided into smaller, more manageable subcomponents.
b. Implementation Levels—Overview. The overall objective of the levels is to develop and implement an integrated, comprehensive SMS for your entire organization. Phased implementation can be thought of as organizational learning — the same building block approach often used in training and education of personnel. The recommended SMS development levels, as follows, are suggested but not required. Your organization may determine and develop your own phases, levels, divisional implementation strategies, etc. This four-level approach is only a representative template. Figure 4-1, Recommended Safety Management System (SMS) Implementation Levels, illustrates the recommended levels of SMS development and implementation.
Par 4-4 Page 50