CHAPTER 5. INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY
MANAGEMENT SYSTEM (SMS)
5-1. PURPOSE OF THIS CHAPTER. This chapter explains how your existing safety programs may be integrated into the SMS Safety Assurance (SA) processes. The Federal Aviation Administration (FAA) encourages the continued use of your current safety programs as part of overall safety management. Expanding your current safety programs across your entire organization is one way to provide a comprehensive systems approach to SA.
5-2. DISCUSSION OF INDIVIDUAL PROGRAMS.
a. Safety Programs and the SMS. Certificate holders are encouraged to be creative in utilizing safety programs to meet the specifications of the SMS rule. These programs collect data on the performance of the safety system, so most can be used to help satisfy some of the SA requirements.
b. FAA-Sanctioned Programs. The following are FAA-sanctioned programs, but they are not the only programs available.
(1) Continuing Analysis and Surveillance System (CASS).
(a) Program. CASS is required by Title 14 of the Code of Federal Regulations (14 CFR) part 121, § 121.373. CASS is a quality assurance (QA) system that monitors and analyzes the performance and effectiveness of the air carrier’s Continuous Airworthiness Maintenance Program (CAMP).
(b) Integration. A CASS overlaps some of the SMS SA functions (14 CFR part 5, § 5.71). CASS could be a standalone system, or a subsystem within an SMS. CASS may be maintained separately; however, it would probably be beneficial to integrate CASS within the SMS. However accomplished, it is imperative to understand that CASS should supply information to the SMS. The SMS may even support CASS through the use of Safety Risk Management (SRM) and SA processes applied to CASS needs. An SMS may evaluate the CASS to ensure that all critical CASS elements are being performed and controlled and all outcomes are acceptable in accordance with FAA Order 8900.1, Volume 3, Chapter 44, Assess Continuing Analysis and Surveillance System for Parts 121 and 135, and the current edition of Advisory Circular (AC) 120-79, Developing and Implementing an Air Carrier CASS.
(2) Aviation Safety Action Program (ASAP).
(a) Program. The ASAP is meant to encourage voluntary reporting of safety issues and events that come to the attention of participating certificate holders’ employees. ASAPs include processes for intake of data from employees, analysis of the data, and development of corrective actions within a confidential environment. ASAP is accepted by the FAA but is not required. ASAP development, implementation, acceptance, and operation are detailed in the current edition of AC 120-66, Aviation Safety Action Program (ASAP).
(b) Integration. ASAP can be used to satisfy some SMS requirements (§ 5.71).
For example, the ASAP can be used to partially satisfy the requirement for a confidential Par 5-1 Page 55
reporting system. Employee groups not covered by an ASAP would need some type of confidential employee reporting system. In the event of termination of an ASAP program, those covered employees would be required to have a confidential employee reporting system. ASAP requires analysis and corrective action; however, it does not require analysis of patterns or trends across reports that would identify systemic problems. This information should be analyzed through the SA process.
(3) Aviation Safety Reporting System (ASRS).
(a) Program. The FAA ASRS utilizes the National Aeronautics and Space Administration (NASA) as a third party to receive aviation safety reports. The ASRS does not provide an explicit requirement for corrective actions, nor does it provide sufficient detailed data with which to adequately analyze specific systems or processes.
(b) Integration. Trend and global systemic information may be appropriate for SA analysis under SMS. Additional information on these policies can be obtained in AC 00-46, Aviation Safety Reporting Program.
(4) Flight Operational Quality Assurance (FOQA).
(a) Program. FOQA is a voluntary program for the routine collection and analysis of digital flight data generated during aircraft operations. The FOQA program is another potential tool in an operator’s SMS to monitor operational data and provides data analysis and assessment. FOQA program development, implementation, acceptance, and operation are covered in the current edition of AC 120-82, Flight Operational Quality Assurance.
(b) Integration. FOQA can be used to satisfy some SMS SA requirements (§ 5.71).
FOQA requires data collection and analysis but stops short of requiring corrective action. Thus, this requirement would be dependent on the configuration of the specific operator’s program — a subject of the gap analysis. FOQA, if present, must interface with the operator’s other safety programs and their SMS.
(5) Voluntary Disclosure Reporting Program (VDRP).
(a) Program. The VDRP provides incentives for a certificate holder to voluntarily identify, report, and correct instances of regulatory noncompliance. The FAA will review, accept, and oversee corrective actions and conduct followup surveillance. The FAA’s acceptance of the voluntary disclosure foregoes legal enforcement action, and protects from release, when specific criteria are met, qualifying disclosures and corrective actions. Additional information on the VDRP can be obtained in the current edition of AC 00-58, Voluntary Disclosure Reporting Program.
(b) Integration. VDRP data is not normally a source of safety information.
However, the data gathered during an investigation, subsequent development, and implementation of a fix could be integrated into the data analysis, assessment, and validation processes of a carrier’s SMS SA.
Par 5-2 Page 56
(6) Internal Evaluation Program (IEP).
(a) Program. The IEP can be a safety process that, through inspections, audits, and evaluations, assesses the adequacy of managerial controls and processes in critical safety systems. The FAA encourages (and the Department of Defense (DOD) requires) using an IEP to increase awareness management and employees’ responsibility to follow company safety practices and comply with all regulatory requirements. IEP is the subject of the current editions of AC 120-59, Air Carrier Internal Evaluation Program, and AC 145-5, Repair Station Internal Evaluation Programs.
(b) Integration. An IEP can be part of an SA process. If used by a certificate holder, an IEP can satisfy the internal evaluation requirement of § 5.71. Since an IEP is not covered by a standalone regulation or formal voluntary program approval process, its use within an SMS is dependent on the configuration.
(7) Line Operations Safety Audit (LOSA).
(a) Program. The Line Operations Safety Audit (LOSA) is a formal process where qualified observers ride the jump seat during regularly scheduled flights to collect safety-related data on various weather and visibility conditions, operational complexities, and flightcrew performance. A LOSA program is not formally approved or accepted by the FAA. LOSA is the subject of the current edition of AC 120-90, Line Operations Safety Audits.
(b) Integration. A LOSA program could be used to satisfy part of the internal audit requirements of § 5.71. A gap analysis would be required to ensure that it meets SMS standards.
LOSA results, if present, should be included in the SA data acquisition process.
(8) Advanced Qualification Program (AQP).
(a) Program. The AQP is a systematic methodology for developing training program components for air carrier crewmembers and dispatchers. An AQP incorporates data-driven quality control processes for validating and maintaining the effectiveness of curriculum content. AQP is the subject of the current edition of AC 120-54, Advanced Qualification Program.
(b) Integration. The AQP can be used to satisfy a portion of the SMS SA monitoring requirement (§ 5.71(a)(1)). The certificate holder may elect to use or develop an AQP, depending on their unique operational complexities.
Par 5-2 Page 57 (and 58)
Appendix 1 APPENDIX 1. SMS CROSS-REFERENCE FOR TRANSITIONING SMS PILOT
PROJECT PARTICIPANTS
The following table provides a cross reference between Advisory Circular (AC) 120-92A, Appendix 1, Safety Management System Framework: Functional Expectations, and Title 14 of the Code of Federal Regulations (14 CFR) part 5. It is an aid to service providers who have implemented all or part of an SMS under AC 120-92A. The FAA emphasizes that this cross-reference chart does not mean that an existing process automatically satisfies the pertinent part 5 requirements. Certificate holders should conduct a gap analysis, or a similar procedure, to ascertain whether changes need to be made to their existing processes in order to satisfy the requirements of part 5.
FIGURE A1-1. SAFETY MANAGEMENT SYSTEM PILOT PROJECT6
AC 120-92A–PART 5 CROSS-REFERENCE
AC 120-92A, Appendix 1 (SMSPP) Framework Title 14 CFR Part 5 Component 1.0 Safety Policy and Objectives § 5.3(a)(1), Subpart A, General Requirements Element 1.1 Safety Policy § 5.21, Safety Policy, Subpart B Safety Policy Element 1.2 Management Commitment and Safety Accountabilities § 5.23, Safety Accountability and Authority, § 119.65 Requirements, § 121.135 Manual Contents, and § 121.369 Manual Requirements Element 1.3 Key Safety Personnel § 5.25, Designation and Responsibilities of Required Safety Management Personnel, § 119.65 Requirements Element 1.4 Emergency Preparedness and Response § 5.27, Coordination of Emergency Response Planning Element 1.5 SMS Documentation and Records Subpart F, SMS Documentation and Recordkeeping, §§ 5.95, 5.97 and 121.135 Component 2.0 Safety Risk Management Subpart C, Safety Risk Management, § 5.51 Applicability Element 2.1 System Analysis & Hazard Identification § 5.53, System Analysis and Hazard Identification Process 2.1.1 System Description and Task Analysis § 5.53(a) and (b) Process 2.1.2 Identify Hazards § 5.53(c) Element 2.2 Risk Assessment and Control §5.55(a), Safety Risk Assessment and Control Process 2.2.1 Analyze Safety Risk § 5.55(a) Process 2.2.2 Assess Safety Risk § 5.55(b) Process 2.2.3 Control/Mitigate Safety Risk § 5.55(c) 6 This cross-reference is included to assist carriers who originally developed their documentation in accordance with AC 120-92A, Appendix 2, and for alignment with international standards. The items referenced as “components” or “elements” are also consistent with International Civil Aviation Organization (ICAO) Annex 19, Appendix 2, the ICAO SMS Framework.
Appendix 1 AC 120-92A, Appendix 1 (SMSPP) Framework Title 14 CFR Part 5 Component 3.0 Safety Assurance Subpart D, Safety Assurance Element 3.1 Safety Performance Monitoring and Measurement § 5.71, Safety Performance Monitoring and Measurement Process 3.1.1 Continuous Monitoring § 5.71(a)(1) and (2) Process 3.1.2 Internal Audits by Operational Departments § 5.71(a)(3) Process 3.1.3 Internal Evaluation § 5.71(a)(4) Process 3.1.4 External Auditing of the SMS § 5.71(a)(3) Process 3.1.5 Investigation § 5.71(a)(5) and (6) Process 3.1.6 Employee Reporting and Feedback System § 5.71(a)(7) Process 3.1.7 Analysis of Data § 5.71(b) Process 3.1.8 System Assessment § 5.73(a), Safety Performance Assessment Element 3.2 Management of Change § 5.73(b) and (a)(2)–(5) Element 3.3 Continuous Improvement § 5.75, Continuous Improvement Process 3.3.1 Preventive/Corrective Action § 5.75 Process 3.3.2 Management Review § 5.73(a) Component 4.0 Safety Promotion Subpart E, Safety Promotion Element 4.1 Competencies and Training § 5.91, Competencies and Training Process 4.1.1 Personnel Requirements (Competence) § 5.91 Process 4.1.2 Training § 5.91 Element 4.2 Communication and Awareness § 5.93, Safety Communication Page 2
Appendix 2 APPENDIX 2. SAFETY RISK MANAGEMENT (SRM) WORKSHEETS The worksheets in this appendix are provided to illustrate the SRM process and a possible way to develop and document the SRM processes required under Title 14 of the Code of Federal Regulations (14 CFR) part 5, subpart C. These worksheets are provided for illustrative purposes only. Carriers may develop their own record keeping systems and should determine the amount and depth of documentation and recordkeeping that are needed to show compliance. Not all situations will require the same degree of detail.
FIGURE A2-1. SAFETY RISK MANAGEMENT TRIGGERING CONDITIONS AND
SUMMARY
NOTE: Refer to part 5, § 5.51
Title:
Reason for Risk Assessment New System Design Change to Existing System Design New Operational Procedure Modification to an Existing Operation or Procedure Operational Environment Change Ineffective Risk Control Brief Summary Where signed below, the authorized manager has determined that no new hazards have been introduced by this change:
Name:
Signature:
Appendix 2 FIGURE A2-2. SYSTEM ANALYSIS NOTE: Refer to § 5.53(a) and (b).
Responsible Manager:
Authority for Implementation and Risk Acceptance:
Function and Purpose of the System or Change:
Description of Operating Environment Related Hazards Personnel Equipment Facilities Page 2
Appendix 2 FIGURE A2-3. HAZARD LIST NOTE: Refer to §§ 5.53(c) and 5.23 (a)(1).
System/Project: __________________________ Responsible Manager: __________________________ Hazard Potential Consequence(s) H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 Page 3
Appendix 2 FIGURE A2-4. RISK ANALYSIS NOTE: Refer to § 5.55(a).
Pre-Control Post-Control Hazard Potential Consequences Severity Likelihood Substitute Risk?
Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 Page 4
Appendix 2 FIGURE A2-5. RISK ANALYSIS AND ASSESSMENT SUMMARY NOTE: Refer to §§ 5.55(b) and 5.23(b).
Acceptance Authority (Sign here and Initial Appropriate Columns): ___________________ Pre-Control Accept? Post-Control Accept?
Hazard Potential Consequences Severity Likelihood Severity Likelihood H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 Page 5
Appendix 2 FIGURE A2-6. RISK CONTROL NOTE: Refer to § 5.55(c) and (d).
System/Project: ___________________________________________________________ Responsible Manager: ___________________________________________________________ Hazard Control Substitute Risk Residual Risk H1 H2 H3 H4 H5 H6 H7 H8 H9 H10 Page 6