2-19
2.3.1.2.7 The safety policy must include a code of ethics which clarifies that safety is the organization’s highest priority [§ 5.21(a)(7)]. This can be achieved by providing a statement in the safety policy that the top priority of the organization is the safety of the products and services provided.
2.3.1.2.8 The safety policy must be signed by the organization’s accountable executive [§ 5.21(b)].
2.3.1.2.9 The safety policy must be documented and communicated throughout the organization [§ 5.21(c)]. Documented means that the safety policy is recorded and retrievable. Communicated through the organization means that all employees have been made aware of, and provided access to, the safety policy.
2.3.1.2.10 The accountable executive must regularly review the safety policy to ensure it remains relevant to the organization [§ 5.21(d)]. Regularly reviewed means that the accountable executive reviews the safety policy on a periodic basis, for example annually. Note that a key part of the accountable executive review is to ensure that the safety objectives continue to be relevant to the organization.
2.3.1.2.11 A sample safety policy meeting the requirements in § 5.21 can be found in Appendix A, Guidance For Developing A Safety Policy Guidance.
2.3.1.3 Scalability Examples. For organizations with lower overall levels of complexity, the owner or most senior manager (i.e., the accountable executive) may personally develop the safety policy. The safety policy can be a simple, single-page written document signed by the accountable executive and may be posted in the organization’s work areas or included in organizational briefings or in training. Organizations with higher levels of complexity may require the accountable executive or other senior managers and technical staff to perform this process. While the regulations only require the accountable executive to sign the safety policy, members of senior management may also sign the safety policy, in addition to the accountable executive. These organizations may disseminate their policy using a variety of resources such as organizational websites, intranets, email, or existing indoctrination and recurrent training.
2-20
2.3.2 Safety Accountability and Authority.
2.3.2.1 Discussion. Section 5.23 provides requirements for employee accountability for safety and identification of the levels of management with authority to make safety risk acceptance decisions.
2.3.2.2 Implementation Strategies.
2.3.2.2.1 The safety policy must define the accountability for safety of the accountable executive [5.23(a)(1)]. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are discussed in more detail in paragraph 2.3.3 below.
2.3.2.2.2 The safety policy must define the accountability for safety of all members of management [§ 5.23(a)(2)]. Managers with the support of SMS specialists are responsible for identifying hazards, conducting risk assessments, ensuring the effectiveness of safety risk controls, promoting safety, and advising the accountable executive of safety performance of the SMS. These personnel have the technical expertise and are responsible for implementation and operation of risk controls (often in the form of operational procedures, specified tools, training, communication, etc.).
Members of management may not be in a regulatory required position and might not appear on an organizational chart.
§ 5.23 Safety accountability and authority.
(a) Any person required to have an SMS under this part must define in its safety policy the accountability for safety of the following individuals:
(1) Accountable executive, as described in § 5.25.
(2) All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to:
(i) Hazard identification and safety risk assessment.
(ii) Assuring the effectiveness of safety risk controls.
(iii) Promoting safety as required in subpart E of this part.
(iv) Advising the accountable executive on the performance of the SMS and on any need for improvement.
(3) Employees relative to the person’s safety performance.
(b) The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance.
2-21
2.3.2.2.3 The safety policy must define the accountability of safety for all employees relative to the organization’s safety performance in the safety policy [§ 5.23(a)(3)]. All employees should be aware of the organization’s safety policies, as well as the processes, procedures, and tools relevant to their responsibilities.
2.3.2.2.4 You must identify the levels of management with authority to make decisions regarding safety risk acceptance [§ 5.23(b)]. Table 2-2 provides an example safety risk acceptance authority matrix.
Table 2-2. Safety Risk Acceptance Authority Example Safety Risk Level Safety Risk Acceptance Authority High Risk Accountable Executive Medium Risk Safety Committee, Department Manager Low Risk Process Owner
2.3.2.3 Scalability Examples. The method for meeting these requirements is not expected to vary greatly between different organizations. Rather, the numbers and relationships of personnel will be unique to your organization. In SMS documentation, the identified managers and process owners may be indicated by position title rather than name.
2-22
2.3.3 Designation and Responsibilities of Required Safety Management Personnel.
§ 5.25 Designation and responsibilities of required safety management personnel.
(a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following:
(1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.
(4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization.
(b) Responsibilities of the accountable executive. The accountable executive must accomplish the following:
(1) Ensure that the SMS is properly implemented and is performing across all pertinent areas.
(2) Develop and sign the safety policy.
(3) Communicate the safety policy throughout the person’s organization.
(4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person.
(5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75.
(c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following:
(1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.
(2) Facilitate hazard identification and safety risk analysis.
(3) Monitor the effectiveness of safety risk controls.
(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.
(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.
2-23
2.3.3.1 Discussion. Section 5.25 provides requirements to designate an accountable executive and defines the accountable executive’s responsibilities. This section also requires the accountable executive to designate management personnel with responsibility for operation of the SMS.
2.3.3.2 Implementation Strategies.
2.3.3.2.1 You must designate an accountable executive who holds the ultimate decision-making authority over the organization’s operations [§ 5.25(a)].
This person is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. A flowchart outlining a process for designating an accountable executive is available in Appendix B, Identifying the Accountable Executive.
2.3.3.2.2 The accountable executive must accomplish the responsibilities in § 5.25(b). These responsibilities include ensuring that the SMS is properly implemented and is performing across the organization; developing and signing the safety policy; communicating the safety policy throughout the organization; regularly reviewing the safety policy to ensure it remains relevant and appropriate; and regularly reviewing the safety performance and directing actions to address substandard safety performance.
2.3.3.2.3 The accountable executive must designate sufficient management personnel that are responsible for operation of the SMS [§ 5.25(c)]. These responsibilities include coordination, implementation, maintenance, and integration of the SMS throughout the organization; facilitating hazard identification and safety risk analysis; monitoring the effectiveness of safety risk controls; promoting safety throughout the organization; and reporting to the accountable executive on the performance of the SMS and on any need for improvement.
2.3.3.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the accountable executive may personally participate in or directly supervise operational processes. This individual may serve in multiple positions within the organization. For organizations on the higher end of the spectrum of complexity, the accountable executive is responsible for ensuring that management personnel are clearly designated for ensuring the safety of operational and safety management processes.
The accountable executive may be identified by position title.
2-24
2.3.4 Coordination of Emergency Response Planning.
2.3.4.1 Discussion. Section 5.27 requires coordination of emergency response planning “where emergency response procedures are necessary.”
Emergency response plans are for accidents and incidents in aircraft operations and other aviation-related emergencies. As a part 21 certificate holder, you may be involved in the investigation of aircraft accidents or incidents but are likely not involved in the emergency response to the aircraft accident or incident. For this reason, the FAA has determined that emergency response planning is not necessary for part 21 certificate holders.
2.3.4.2 Implementation Strategies. Emergency response planning is not necessary for part 21 certificate holders.
2.3.4.3 Scalability Examples. Not applicable.
§ 5.27 Coordination of emergency response planning.
Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:
(a) Delegation of emergency authority throughout the person’s organization.
(b) Assignment of employee responsibilities during the emergency.
(c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.
2-25
2.4 Subpart C: Safety Risk Management (SRM).
2.4.1 Applicability: Requirements to Apply Safety Risk Management (SRM).
2.4.1.1 Discussion. Section 5.51 provides the triggers that require application of safety risk management (SRM). The SRM process is triggered when you are considering new systems or revisions to existing systems as identified in your organizational system description. The SRM process is also triggered when developing operational procedures or when hazards or ineffective risk controls are identified through the safety assurance processes.
2.4.1.2 Implementation Strategies.
2.4.1.2.1 You must apply SRM if you decide to implement any new system that directly impacts the aviation safety of the products or services you provide [§ 5.51(a)]. For example, SRM is required if the organization decides to develop and implement a new design system.
2.4.1.2.2 You must apply SRM when an existing aviation safety-related system is being revised [§ 5.51(b)]. For example, SRM is required if the organization revises their production system.
2.4.1.2.3 You must apply SRM when procedures are being developed that directly impact the aviation safety of the products and services you provide [§ 5.51(c)]. Examples requiring SRM include development of procedures for design, certification, manufacturing, and continued operational safety.
2.4.1.2.4 You must apply SRM when hazards or ineffective risk controls are identified through your safety assurance processes [§ 5.51(d)]. Examples requiring SRM include product hazards (e.g., a quality escape) or ineffective risk controls in a system (e.g., a design and certification subsystem procedure that caused a design error).
§ 5.51 Applicability.
Any person required to have an SMS under this part must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.
2-26 Note: Two levels of SRM should be conducted when product hazards are identified through safety assurance. First, conduct SRM at the product level to determine if you need additional risk controls for the product. In addition, conduct SRM at the system level to determine if you need additional risk controls to prevent similar hazards for future products. For example, if you identify a design error through safety performance monitoring, you first analyze, assess, and mitigate, if necessary, the risk of the design error on the fielded product. Next, you analyze your design and certification system to determine if you need additional risk controls to prevent similar design errors on future products.
2.4.1.3 Scalability Examples. Not applicable.
2.4.2 System Analysis and Hazard Identification.
2.4.2.1 Discussion. Section 5.53 provides the requirements for system analysis and hazard identification.
2.4.2.2 Implementation Strategies.
2.4.2.2.1 You must analyze the systems in § 5.51 to identify hazards [§ 5.53(a)].
Completing a system analysis means that you have defined the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify and analyze hazards. At a minimum, you must consider the following when documenting the system analysis: the function and purpose of the system;
§ 5.53 System analysis and hazard identification.
(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system's operating environment.
(3) An outline of the system's processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
(5) The interfaces of the system.
(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.
2-27 the system's operating environment; an outline of the system's processes and procedures; the personnel, equipment, and facilities necessary for operation of the system; and the interfaces of the system [§ 5.53(b)].
2.4.2.2.2 You must develop processes to identify hazards within the context of the system analysis [§ 5.53(c)]. The hazard identification process should provide the steps to determine what could go wrong with your systems or processes that could cause or contribute an incident or aircraft accident.
Outputs from the hazard identification process should include a list of each hazard along with a short description.
2.4.2.2.3 You must maintain the hazard identification processes [§ 5.53(c)].
Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.2.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, system analysis and hazard identification could be performed by the owner/manager and/or another assigned employee(s).
An analysis could consist of a discussion between the engineering and production managers and other individuals designated by them. For organizations on the higher end of the spectrum of complexity, system analysis and hazard identification might be performed at multiple organizational levels (e.g., corporate, division, or department levels) and facilitated by the safety department/division or its equivalent. The organization might have standing committees of subject matter experts (SMEs) and stakeholders participating at various levels.
2.4.3 Safety Risk Analysis.
2.4.3.1 Discussion. Section 5.55(a) provides requirements to develop and maintain processes to analyze safety risk for identified hazards.
2.4.3.2 Implementation Strategies.
2.4.3.2.1 You must develop processes to analyze safety risk for each hazard identified in § 5.53(c) [§ 5.55(a)]. Risk analysis should include a determination of the severity and likelihood of a hazard’s potential outcomes. For each identified hazard, determine the severity of the injury or damage that may result from the aircraft accident or incident and then § 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
2-28 determine the likelihood of occurrence. It is important to remember that the severity and likelihood do not refer to the hazard but of an aircraft accident or incident that could be caused by the hazard. The risk analysis process should include criteria for severity and likelihood that are appropriate for your organization. For example, severity levels are sometimes defined as minimal, minor, major, hazardous, and catastrophic.
Likewise, likelihood levels are sometimes defined as frequent, probable, remote, extremely remote, and extremely improbable.
2.4.3.2.2 You should consider the basis for the estimates of severity and likelihood when conducting the risk analysis. Risk analyses are often based on expertise and expert judgment, but you should also use data from your organization’s own experience or those of others in the industry, where available. The type of consequence (aircraft accident or incident) that is envisioned normally drives the estimate of severity. Severity estimates should be based on reasonable expert judgment by applying a disciplined analysis. Review of accident statistics, failure data, error data, or equipment reliability data may help in determining likelihood.
2.4.3.2.3 You must maintain the safety risk analysis processes [§ 5.55(a)].
Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.3.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk analysis could be performed by the owner/manager and/or another employee(s). It might be performed in conjunction with system description and analysis, hazard identification, risk assessment, and risk control using the same individual/group. Organizations on the higher end of the spectrum of complexity might perform risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The organization might have standing committees of SMEs and stakeholders participating at various levels.
2.4.4 Safety Risk Assessment.
2.4.4.1 Discussion. Section 5.55(b) provides requirements to define a risk assessment process for the determination of acceptable safety risk.
§ 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
2-29
2.4.4.2 Implementation Strategies.
2.4.4.2.1 You must define a risk assessment process to determine whether risk is acceptable [§ 5.55(b)]. A risk matrix is a common tool used in risk assessment decisions. A risk matrix provides you with a way to integrate the effect of the severity and likelihood of a hazard’s potential outcomes, enabling you to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
Table 2-3 depicts a sample risk matrix.
Table 2-3. Sample Risk Matrix Risk Likelihood Risk Severity Minimal Minor Major Hazardous Catastrophic Frequent low medium high high high Probable low medium high high high Remote low medium medium high high Extremely Remote
low low medium medium high Extremely Improbable low
low low medium medium
2.4.4.2.2 Table 2-3 categorizes risk as high, medium, or low based on severity and likelihood. Your risk assessment process should define the risk levels you will consider acceptable and the risk levels that require mitigation and risk controls. For example, you may determine that low risks are acceptable without mitigation and do not require any risk controls. However, you may also determine that medium and high risks are unacceptable without additional risk controls. These risk acceptability determinations should be clearly defined in your risk assessment process and procedures. The risk assessment process should also involve the levels of management with the authority to make risk acceptance decisions (refer to 2.3.2.2.4).
2.4.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk assessment could be performed by the owner/manager and/or other employee(s) making the risk decisions. Risk acceptance could also be conducted by this individual/group. Organizations on the higher end of the spectrum of complexity might need to coordinate SRM across the divisional and geographic units of the organization to assure integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems. Many organizations have standing committees made up of senior managers, who are the decision makers, supported by working groups of technical personnel. For example,
2-30 the accountable executive could make organization-level decisions and department managers could make the decisions for their operations. A risk matrix may be useful to determine who makes the risk decision, whether the risk is acceptable, or to determine the priority for mitigating risk.
2.4.5 Safety Risk Control.
2.4.5.1 Discussion. Section 5.55(c) provides requirements to develop risk controls for unacceptable risks identified in the risk assessment process. Section
5.55(d) provides requirements to evaluate whether the risk will be acceptable before a safety risk control is applied.
2.4.5.2 Implementation Strategies.
2.4.5.2.1 You must develop a process to develop risk controls for risks that have been determined to be unacceptable and require mitigation [§ 5.55(c)].
You should use the knowledge gained from the previous system analysis and risk analysis steps to develop the risk controls. Risk controls include anything that would lessen the likelihood or severity of a potential accident or incident. Examples of risk controls include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, new information technology controls, changes to staffing arrangements, or any of a number of other system changes.
2.4.5.2.2 You must evaluate the system with the proposed risk control(s) in place to determine if the level of risk is acceptable before the risk control is implemented [§ 5.55(d)]. The first step in this evaluation involves completion of the system analysis, hazard identification, and risk analysis to determine the risk with the proposed risk control in place. This risk is commonly referred to as “substitute risk.” The next step is to complete an assessment to determine if the substitute risk is acceptable. The risk control may be implemented if the substitute risk is determined to be acceptable. If the substitute risk is not acceptable, additional risk control(s) should be developed and the risk control evaluation in this paragraph should be repeated until the substitute risk is acceptable.
§ 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.
(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.