2-11
2.2.10 Organizational System Description.
2.2.10.1 Discussion. Section 5.17 provides requirements for the development of an organizational system description. The organizational system description summarizes the processes, procedures, activities, personnel, equipment, and facilities that impact the aviation safety of the products and services provided by the organization. This includes, but is not limited to activities, processes, and procedures for design and certification, production, and continued operational safety. An organizational system description defines the boundaries of where SMS is applied in an organization.
2.2.10.2 Implementation Strategies.
2.2.10.2.1 You must develop an organizational system description that includes a summary of information about the safety of the products and services provided [§§ 5.17(a) - (d)]. This summary must include your aviationrelated processes, procedures, and activities; the function and purpose of your aviation products or services; the operating environment; and the personnel, equipment, and facilities necessary for operation.
2.2.10.2.2 Your organizational system description must be maintained [§ 5.17].
Maintained means that the organizational system description is updated when changes occur that impact the summary of information described in §§ 5.17(a) - (d).
2.2.10.2.3 The organizational system description for a part 21 type and production certificate holder typically consists of a set of descriptions of subsystems each of which contributes to the safety of the products and services provided. Type and production certificate holders typically have three sub-systems in their organizational system description:
• Design and certification sub-system
• Production sub-system
• Continued operational safety sub-system § 5.17 Organizational system description.
An organizational system description developed and maintained under this part must include a summary of the following information about the safety of the aviation products or services provided by the person:
(a) The person’s aviation-related processes, procedures, and activities.
(b) The function and purpose of the aviation products or services.
(c) The operating environment.
(d) The personnel, equipment, and facilities necessary for operation.
2-12 Note 1: Activities, processes, or departments that do not impact aviation safety may be excluded from your organizational system description. For example, you may exclude processes that support other lines of business such as commercial bearings or automotive components from your organizational system description.
Note 2: Aviation-related processes, procedures, and activities related only to supplemental type certificates, technical standard order authorizations, and parts manufacturer approvals without any relation to those used for type certificate and production certificate activities may be excluded from your organizational system description.
Note 3: There is no requirement to develop new processes or procedures for the creation of the organizational system description.
2.2.10.2.4 Design and Certification Sub-System. This sub-system description summarizes the processes and activities used to design and obtain FAA certification of products. The objective of this sub-system is to produce a safe and compliant design for the product.
• Aviation-related processes, procedures, and activities: Include a summary of the key processes, procedures, and steps for: design, design reviews, requirements validation and verification, major / minor change classifications, minor change agreements, changed product rule requirements, ground and flight test, showing of compliance, and finding of compliance (include your organization designation authorization procedures, if applicable).
• Function and purpose of the aviation products or services provided:
Include a summary of the products or services you provide along with their function and purpose.
• Operating environment: Include the key internal and external factors that influence the ability of the design and certification subsystem to design and certify safe and compliant products. This can include customers, suppliers, outsourcing design activities, program schedule constraints, budgetary constraints, and staffing constraints.
• Personnel, equipment, and facilities necessary for operation: Include design departments, test departments, facilities used for test, and departments used for showing and finding of compliance (include your organization designation authorization unit, if applicable), design tools (software, and hardware). The “personnel necessary for operation” should include position titles such as “Head of Design” rather than the individual names of personnel.
2.2.10.2.5 Production Sub-System. This sub-system description summarizes the processes and activities used to produce products. The objective of this system is to produce a conforming product that is in a condition for safe operation.
2-13
• Aviation-related processes, procedures, and activities: Include a summary of the processes and procedures used for manufacturing, assembly, acceptance test, non-conforming material control and disposition, inspection, material review board, and quality of products.
• Function and purpose of the aviation products or services provided:
Include a summary of the products or services you provide along with their function and purpose.
• Operating environment: Include the key internal and external factors that influence the ability of the production subsystem to produce conforming and safe products. This can include supplier deliveries, conducting production activities in various locations, manufacturing schedules, budgetary constraints, and staffing constraints.
• Personnel, equipment, and facilities necessary for operation: Include the following departments: manufacturing, assembly, test, inspection.
The “personnel necessary for operation” should include position titles such as “Head of Manufacturing” rather than the individual names of personnel.
2.2.10.2.6 Continued Operational Safety Sub-System. This sub-system description summarizes the processes and activities used to maintain the continued operational safety of the product. The objective of this system is to assure the safe operation of the product in service.
• Aviation-related processes, procedures, and activities: Include the processes and procedures used for training and manuals, maintenance requirements, customer support, in-service monitoring, risk assessment, and corrective action.
• Function and purpose of the aviation products or services provided:
Include a summary of the products or services you provide along with their function and purpose.
• Operating environment: Include the key internal and external factors that influence the ability of the continued operational safety subsystem to assure the safe operation of the products, articles, and services provided. This can include customer feedback, risk assessment and corrective action schedules, budgetary constraints, and staffing constraints.
• Personnel, equipment, and facilities necessary for operation: Include field service departments, safety departments, and tools used for risk assessment and corrective action. The “personnel necessary for operation” should include position titles such as “Head of Safety” rather than the individual names of personnel.
2-14
2.2.10.3 Scalability Examples. The organizational system description requires a summary of information allowing flexibility to be scaled to the size and complexity of an organization.
2.2.11 Implementation Plan.
2.2.11.1 Discussion. Section 5.19 provides requirements for the SMS implementation plan.
2.2.11.2 Implementation Strategies.
2.2.11.2.1 The implementation plan must be based on your organizational system description, and also must provide the means of compliance that you will use to meet the applicable requirements of part 5 [§ 5.19(a)]. For each section and subsection, provide a specific reference to a new, planned, or existing policy, process, or procedure when required by part 5. For the part 5 sections that do not specifically require a process or procedure, provide a brief narrative description that describes how you will comply with the section. Your implementation plan should also provide schedule dates summarizing when each planned activity will be completed. Note that the schedule must allow sufficient time for you to implement your SMS by the applicable date in § 5.11(d), § 5.13(b)(4), § 5.15(b)(4), and § 5.15(c)(4).
2.2.11.2.2 Table 2-1 provides an example format, including planned and completed SMS development activities that you may use to present the list of the specific regulations and subparts, including all subparagraphs, the description of the means of compliance, and planned completion dates. A template is available to assist in the development of your implementation plan. The implementation plan template may be requested from the following email address:
Program Management Section (AIR-8X7) Email: 9-AVS-AIR-SMS@faa.gov § 5.19 Implementation plan.
(a) An implementation plan filed under this part must be based on the organizational system description as defined in § 5.17 and describe the means of compliance (including, but not limited to, new or existing policies, processes, or procedures) used to meet the requirements of this part.
(b) A person required to submit an implementation plan under this part must make available to the Administrator, upon request, all necessary information and data that demonstrates that the SMS has been or will be implemented in accordance with the implementation plan.
2-15
2.2.11.2.3 You must, upon FAA request, make available information and data that demonstrates your SMS has been or will be implemented in accordance with your implementation plan [§ 5.19(b)].
Note: The FAA will request that you make SMS information and data available as we conduct oversight of your SMS. This request will follow completion of your SMS implementation and consist of an SMS verification and an SMS evaluation. The SMS verification confirms that you have developed an organizational system description and the policies, processes, and procedures required by part 5. The SMS evaluation confirms that your SMS operates in compliance with part 5.
2.2.11.3 Scalability Examples. Not applicable.
2-16 Table 2-1. Implementation Plan Example Section Requirement Reference(s) Planned Completion Date Complete Para. Sub-Para.
Subpart B - Safety Policy § 5.21 Safety policy.
(a) Any person required to have an SMS under this part must have a safety policy that includes at least the following:
(1) The person’s safety objectives. Safety Policy, Page 1. X
(2) The person’s commitment to fulfill the safety objectives.
Safety Policy Page 4.
Introductory Message X
(3) A clear statement about the provision of the necessary resources for the implementation of the SMS.
Safety Policy Page 4.
Introductory Message X
(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.
Employee Safety Reporting Procedure Mar-2025
(5) A policy that defines unacceptable behavior and conditions for disciplinary action.
Employee Expectations Policy Feb-2025
(6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.
Not required for part 21 type and production certificate holders.
(7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority.
HR Manual Chapter 1, page 4 X
2-17
2.3 Subpart B: Safety Policy.
2.3.1 Safety Policy.
2.3.1.1 Discussion. Section 5.21 provides the requirements for the safety policy.
2.3.1.2 Implementation Strategies.
2.3.1.2.1 The safety policy must include safety objectives [§ 5.21(a)(1)]. When developing safety objectives, it is important to ensure they are measurable and not just inspirational statements such as “We will strive to be the best” or “We will maintain a zero-accident rate” etc. Safety objectives are measured using safety performance indicators and need to be tracked by the safety assurance component of your SMS to ensure your objectives are being met. A reference to the safety objectives may also be provided in the safety policy.
§ 5.21 Safety policy.
(a) Any person required to have an SMS under this part must have a safety policy that includes at least the following:
(1) The person’s safety objectives.
(2) The person’s commitment to fulfill the safety objectives.
(3) A clear statement about the provision of the necessary resources for the implementation of the SMS.
(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.
(5) A policy that defines unacceptable behavior and conditions for disciplinary action.
(6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.
(7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority.
(b) The safety policy must be signed by the accountable executive described in § 5.25.
(c) The safety policy must be documented and communicated throughout the person’s organization.
(d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the person.
2-18 Examples of safety objectives include:
• Milestones for implementation of safety-related programs or initiatives.
• Time to complete investigations of employee hazard or incident reports.
• Tracking of potential aviation-related safety issues including root cause and corrective action completion.
2.3.1.2.2 The safety policy must include a commitment to fulfill the safety objectives [§ 5.21(a)(2)]. This can be achieved by providing a statement in the safety policy that the safety objectives will be monitored, measured, and tracked to ensure they are met.
2.3.1.2.3 The safety policy must include a clear statement about the provision of the necessary resources for the implementation of the SMS [§ 5.21(a)(3)].
This can be achieved by providing a statement in the safety policy committing to provide the resources necessary to implement the SMS.
2.3.1.2.4 The safety policy must include requirements for employee reporting of safety hazards or issues [§ 5.21(a)(4)]. This can be achieved by stating that the organization has established a confidential employee reporting system for all employees to report hazards, accidents, incidents, and safety issues without fear of reprisal. A reference to the reporting procedures may also be provided in the safety policy.
2.3.1.2.5 The safety policy must include a policy that defines unacceptable behavior and conditions for disciplinary action [§ 5.21(a)(5)]. This can be achieved by providing a statement in the safety policy regarding unacceptable behavior and disciplinary actions. A reference to the unacceptable behavior and disciplinary action policy may also be provided in the safety policy.
2.3.1.2.6 The safety policy is not required to provide requirements for emergency response plans [§ 5.21(a)(6)]. The FAA has determined that emergency response plans are not necessary for part 21 type and production certificate holders (refer to paragraph 2.3.4).
2-19
2.3.1.2.7 The safety policy must include a code of ethics which clarifies that safety is the organization’s highest priority [§ 5.21(a)(7)]. This can be achieved by providing a statement in the safety policy that the top priority of the organization is the safety of the products and services provided.
2.3.1.2.8 The safety policy must be signed by the organization’s accountable executive [§ 5.21(b)].
2.3.1.2.9 The safety policy must be documented and communicated throughout the organization [§ 5.21(c)]. Documented means that the safety policy is recorded and retrievable. Communicated through the organization means that all employees have been made aware of, and provided access to, the safety policy.
2.3.1.2.10 The accountable executive must regularly review the safety policy to ensure it remains relevant to the organization [§ 5.21(d)]. Regularly reviewed means that the accountable executive reviews the safety policy on a periodic basis, for example annually. Note that a key part of the accountable executive review is to ensure that the safety objectives continue to be relevant to the organization.
2.3.1.2.11 A sample safety policy meeting the requirements in § 5.21 can be found in Appendix A, Guidance For Developing A Safety Policy Guidance.
2.3.1.3 Scalability Examples. For organizations with lower overall levels of complexity, the owner or most senior manager (i.e., the accountable executive) may personally develop the safety policy. The safety policy can be a simple, single-page written document signed by the accountable executive and may be posted in the organization’s work areas or included in organizational briefings or in training. Organizations with higher levels of complexity may require the accountable executive or other senior managers and technical staff to perform this process. While the regulations only require the accountable executive to sign the safety policy, members of senior management may also sign the safety policy, in addition to the accountable executive. These organizations may disseminate their policy using a variety of resources such as organizational websites, intranets, email, or existing indoctrination and recurrent training.
2-20
2.3.2 Safety Accountability and Authority.
2.3.2.1 Discussion. Section 5.23 provides requirements for employee accountability for safety and identification of the levels of management with authority to make safety risk acceptance decisions.
2.3.2.2 Implementation Strategies.
2.3.2.2.1 The safety policy must define the accountability for safety of the accountable executive [5.23(a)(1)]. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are discussed in more detail in paragraph 2.3.3 below.
2.3.2.2.2 The safety policy must define the accountability for safety of all members of management [§ 5.23(a)(2)]. Managers with the support of SMS specialists are responsible for identifying hazards, conducting risk assessments, ensuring the effectiveness of safety risk controls, promoting safety, and advising the accountable executive of safety performance of the SMS. These personnel have the technical expertise and are responsible for implementation and operation of risk controls (often in the form of operational procedures, specified tools, training, communication, etc.).
Members of management may not be in a regulatory required position and might not appear on an organizational chart.
§ 5.23 Safety accountability and authority.
(a) Any person required to have an SMS under this part must define in its safety policy the accountability for safety of the following individuals:
(1) Accountable executive, as described in § 5.25.
(2) All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to:
(i) Hazard identification and safety risk assessment.
(ii) Assuring the effectiveness of safety risk controls.
(iii) Promoting safety as required in subpart E of this part.
(iv) Advising the accountable executive on the performance of the SMS and on any need for improvement.
(3) Employees relative to the person’s safety performance.
(b) The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance.
2-21
2.3.2.2.3 The safety policy must define the accountability of safety for all employees relative to the organization’s safety performance in the safety policy [§ 5.23(a)(3)]. All employees should be aware of the organization’s safety policies, as well as the processes, procedures, and tools relevant to their responsibilities.
2.3.2.2.4 You must identify the levels of management with authority to make decisions regarding safety risk acceptance [§ 5.23(b)]. Table 2-2 provides an example safety risk acceptance authority matrix.
Table 2-2. Safety Risk Acceptance Authority Example Safety Risk Level Safety Risk Acceptance Authority High Risk Accountable Executive Medium Risk Safety Committee, Department Manager Low Risk Process Owner
2.3.2.3 Scalability Examples. The method for meeting these requirements is not expected to vary greatly between different organizations. Rather, the numbers and relationships of personnel will be unique to your organization. In SMS documentation, the identified managers and process owners may be indicated by position title rather than name.
2-22
2.3.3 Designation and Responsibilities of Required Safety Management Personnel.
§ 5.25 Designation and responsibilities of required safety management personnel.
(a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following:
(1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization.
(b) Responsibilities of the accountable executive. The accountable executive must accomplish the following:
(1) Ensure that the SMS is properly implemented and is performing across all pertinent areas.
(2) Develop and sign the safety policy.
(3) Communicate the safety policy throughout the person’s organization.
(4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person.
(5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75.
(c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.