2-25
2.4 Subpart C: Safety Risk Management (SRM).
2.4.1 Applicability: Requirements to Apply Safety Risk Management (SRM).
2.4.1.1 Discussion. Section 5.51 provides the triggers that require application of safety risk management (SRM). The SRM process is triggered when you are considering new systems or revisions to existing systems as identified in your organizational system description. The SRM process is also triggered when developing operational procedures or when hazards or ineffective risk controls are identified through the safety assurance processes.
2.4.1.2 Implementation Strategies.
2.4.1.2.1 You must apply SRM if you decide to implement any new system that directly impacts the aviation safety of the products or services you provide [§ 5.51(a)]. For example, SRM is required if the organization decides to develop and implement a new design system.
2.4.1.2.2 You must apply SRM when an existing aviation safety-related system is being revised [§ 5.51(b)]. For example, SRM is required if the organization revises their production system.
2.4.1.2.3 You must apply SRM when procedures are being developed that directly impact the aviation safety of the products and services you provide [§ 5.51(c)]. Examples requiring SRM include development of procedures for design, certification, manufacturing, and continued operational safety.
2.4.1.2.4 You must apply SRM when hazards or ineffective risk controls are identified through your safety assurance processes [§ 5.51(d)]. Examples requiring SRM include product hazards (e.g., a quality escape) or ineffective risk controls in a system (e.g., a design and certification subsystem procedure that caused a design error).
§ 5.51 Applicability.
Any person required to have an SMS under this part must apply safety risk management to the following:
(a) Implementation of new systems.
(b) Revision of existing systems.
(c) Development of operational procedures.
(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.
2-26 Note: Two levels of SRM should be conducted when product hazards are identified through safety assurance. First, conduct SRM at the product level to determine if you need additional risk controls for the product. In addition, conduct SRM at the system level to determine if you need additional risk controls to prevent similar hazards for future products. For example, if you identify a design error through safety performance monitoring, you first analyze, assess, and mitigate, if necessary, the risk of the design error on the fielded product. Next, you analyze your design and certification system to determine if you need additional risk controls to prevent similar design errors on future products.
2.4.1.3 Scalability Examples. Not applicable.
2.4.2 System Analysis and Hazard Identification.
2.4.2.1 Discussion. Section 5.53 provides the requirements for system analysis and hazard identification.
2.4.2.2 Implementation Strategies.
2.4.2.2.1 You must analyze the systems in § 5.51 to identify hazards [§ 5.53(a)].
Completing a system analysis means that you have defined the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify and analyze hazards. At a minimum, you must consider the following when documenting the system analysis: the function and purpose of the system;
§ 5.53 System analysis and hazard identification.
(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).
(b) In conducting the system analysis, the following information must be considered:
(1) Function and purpose of the system.
(2) The system's operating environment.
(3) An outline of the system's processes and procedures.
(4) The personnel, equipment, and facilities necessary for operation of the system.
(5) The interfaces of the system.
(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.
2-27 the system's operating environment; an outline of the system's processes and procedures; the personnel, equipment, and facilities necessary for operation of the system; and the interfaces of the system [§ 5.53(b)].
2.4.2.2.2 You must develop processes to identify hazards within the context of the system analysis [§ 5.53(c)]. The hazard identification process should provide the steps to determine what could go wrong with your systems or processes that could cause or contribute an incident or aircraft accident.
Outputs from the hazard identification process should include a list of each hazard along with a short description.
2.4.2.2.3 You must maintain the hazard identification processes [§ 5.53(c)].
Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.2.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, system analysis and hazard identification could be performed by the owner/manager and/or another assigned employee(s).
An analysis could consist of a discussion between the engineering and production managers and other individuals designated by them. For organizations on the higher end of the spectrum of complexity, system analysis and hazard identification might be performed at multiple organizational levels (e.g., corporate, division, or department levels) and facilitated by the safety department/division or its equivalent. The organization might have standing committees of subject matter experts (SMEs) and stakeholders participating at various levels.
2.4.3 Safety Risk Analysis.
2.4.3.1 Discussion. Section 5.55(a) provides requirements to develop and maintain processes to analyze safety risk for identified hazards.
2.4.3.2 Implementation Strategies.
2.4.3.2.1 You must develop processes to analyze safety risk for each hazard identified in § 5.53(c) [§ 5.55(a)]. Risk analysis should include a determination of the severity and likelihood of a hazard’s potential outcomes. For each identified hazard, determine the severity of the injury or damage that may result from the aircraft accident or incident and then § 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).
2-28 determine the likelihood of occurrence. It is important to remember that the severity and likelihood do not refer to the hazard but of an aircraft accident or incident that could be caused by the hazard. The risk analysis process should include criteria for severity and likelihood that are appropriate for your organization. For example, severity levels are sometimes defined as minimal, minor, major, hazardous, and catastrophic.
Likewise, likelihood levels are sometimes defined as frequent, probable, remote, extremely remote, and extremely improbable.
2.4.3.2.2 You should consider the basis for the estimates of severity and likelihood when conducting the risk analysis. Risk analyses are often based on expertise and expert judgment, but you should also use data from your organization’s own experience or those of others in the industry, where available. The type of consequence (aircraft accident or incident) that is envisioned normally drives the estimate of severity. Severity estimates should be based on reasonable expert judgment by applying a disciplined analysis. Review of accident statistics, failure data, error data, or equipment reliability data may help in determining likelihood.
2.4.3.2.3 You must maintain the safety risk analysis processes [§ 5.55(a)].
Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.3.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk analysis could be performed by the owner/manager and/or another employee(s). It might be performed in conjunction with system description and analysis, hazard identification, risk assessment, and risk control using the same individual/group. Organizations on the higher end of the spectrum of complexity might perform risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The organization might have standing committees of SMEs and stakeholders participating at various levels.
2.4.4 Safety Risk Assessment.
2.4.4.1 Discussion. Section 5.55(b) provides requirements to define a risk assessment process for the determination of acceptable safety risk.
§ 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.
2-29
2.4.4.2 Implementation Strategies.
2.4.4.2.1 You must define a risk assessment process to determine whether risk is acceptable [§ 5.55(b)]. A risk matrix is a common tool used in risk assessment decisions. A risk matrix provides you with a way to integrate the effect of the severity and likelihood of a hazard’s potential outcomes, enabling you to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.
Table 2-3 depicts a sample risk matrix.
Table 2-3. Sample Risk Matrix Risk Likelihood Risk Severity Minimal Minor Major Hazardous Catastrophic Frequent low medium high high high Probable low medium high high high Remote low medium medium high high Extremely Remote
low low medium medium high Extremely Improbable low
low low medium medium
2.4.4.2.2 Table 2-3 categorizes risk as high, medium, or low based on severity and likelihood. Your risk assessment process should define the risk levels you will consider acceptable and the risk levels that require mitigation and risk controls. For example, you may determine that low risks are acceptable without mitigation and do not require any risk controls. However, you may also determine that medium and high risks are unacceptable without additional risk controls. These risk acceptability determinations should be clearly defined in your risk assessment process and procedures. The risk assessment process should also involve the levels of management with the authority to make risk acceptance decisions (refer to 2.3.2.2.4).
2.4.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk assessment could be performed by the owner/manager and/or other employee(s) making the risk decisions. Risk acceptance could also be conducted by this individual/group. Organizations on the higher end of the spectrum of complexity might need to coordinate SRM across the divisional and geographic units of the organization to assure integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems. Many organizations have standing committees made up of senior managers, who are the decision makers, supported by working groups of technical personnel. For example,
2-30 the accountable executive could make organization-level decisions and department managers could make the decisions for their operations. A risk matrix may be useful to determine who makes the risk decision, whether the risk is acceptable, or to determine the priority for mitigating risk.
2.4.5 Safety Risk Control.
2.4.5.1 Discussion. Section 5.55(c) provides requirements to develop risk controls for unacceptable risks identified in the risk assessment process. Section
5.55(d) provides requirements to evaluate whether the risk will be acceptable before a safety risk control is applied.
2.4.5.2 Implementation Strategies.
2.4.5.2.1 You must develop a process to develop risk controls for risks that have been determined to be unacceptable and require mitigation [§ 5.55(c)].
You should use the knowledge gained from the previous system analysis and risk analysis steps to develop the risk controls. Risk controls include anything that would lessen the likelihood or severity of a potential accident or incident. Examples of risk controls include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, new information technology controls, changes to staffing arrangements, or any of a number of other system changes.
2.4.5.2.2 You must evaluate the system with the proposed risk control(s) in place to determine if the level of risk is acceptable before the risk control is implemented [§ 5.55(d)]. The first step in this evaluation involves completion of the system analysis, hazard identification, and risk analysis to determine the risk with the proposed risk control in place. This risk is commonly referred to as “substitute risk.” The next step is to complete an assessment to determine if the substitute risk is acceptable. The risk control may be implemented if the substitute risk is determined to be acceptable. If the substitute risk is not acceptable, additional risk control(s) should be developed and the risk control evaluation in this paragraph should be repeated until the substitute risk is acceptable.
§ 5.55 Safety risk assessment and control.
Any person required to have an SMS under this part must:
(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.
(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.
2-31
2.4.5.2.3 You must maintain the safety risk control development processes [§ 5.55(c)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.5.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the risk control process could be a documented activity performed by the owner/manager and/or other employee(s) developing and evaluating the risk controls. It might be performed in conjunction with system analysis, hazard identification, risk analysis, and risk assessment, and using the same individual/group. For organizations on the higher end of the spectrum of complexity, the risk control process could be performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to develop the risk controls. There might need to be interdepartmental coordination before the controls are implemented. After the control is approved, it may be implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.
2.4.6 Notification of Hazards to Interfacing Persons.
2.4.6.1 Discussion. Section 5.57 provides requirements for providing hazard notifications to interfacing persons.
2.4.6.2 Implementation Strategies.
2.4.6.2.1 You must provide hazard notifications to interfacing persons, that to the best of your knowledge, could address a hazard or mitigate the hazard’s risk [§ 5.57]. Section 5.57 limits hazard notification to only those interfacing persons that contribute to the aviation safety of the products or services you provide.
Note: A hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.”
Reporting under § 5.57 should only occur for issues you have identified as hazards and the report should only be provided to the interfacing person you believe can best address the hazard or mitigate its risk. Section 5.57 § 5.57 Notification of hazards to interfacing persons.
If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.
2-32 does not require reporting of issues that are not hazards (e.g., commercial issues between companies). The intent of § 5.57 is to facilitate timely sharing of safety information.
2.4.6.2.2 Figure 2-1 provides a process that may be used for hazard notification.
Details for each step in this process follow:
Start: Complete the following steps for each hazard that is identified through your SRM processes.
Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer is “yes”, go to step 2. If the answer is “no,” notification is not required for this hazard.
Note: This decision may occur at any time while the hazard is being processed through the SRM steps (§§ 5.51, 5.53, 5.55).
Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard.
Note: For design and manufacturing organizations, the external organization (interfacing person) will typically be suppliers of parts or engineering services because these suppliers contributed to the safety of the products or services you provide. Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide.
Step 3: Provide a notification of the hazard to the external organization.
Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified, or risk controls put in place to address the hazard). You may use a non-disclosure agreement or other contract if you determine that the hazard notification can’t be provided without disclosing confidential or proprietary information.
Figure 2-1. Hazard Notification Process Start:
Hazard Notification Process.
Complete for each identified hazard Step 1: Is there an organization that could address the hazard or mitigate external No Hazard notification is not required. Stop:
its risk?
Yes Step 2: Does the external organization No Stop:
contribute to the Hazard notification is not safety of the required.
product or services you provide?
Yes Step 3: Provide a notification of the hazard to the external organization.
(Remove proprietary or confidential information)
2.4.6.3 Hazard Notification Example.
2.4.6.3.1 The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a technical standard order article manufacturer that is not required to have an SMS.
2-33
2-34
2.4.6.3.2 An airline operator received an employee report from a pilot stating that the aircraft flight management system deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. The operator’s SMS classified this employee report as a hazard because the airport is surrounded by high elevation terrain. Although this incident occurred during daytime and in visual meteorological conditions, management determined that if the same issue occurred during a night landing or instrument meteorological conditions, the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident.
2.4.6.3.3 The operator followed its hazard notification process and decided that the aircraft manufacturer was best person to mitigate the risk (step 1). The operator also decided that the aircraft manufacturer contributed to the safety of the services provided by the operator (step 2). The operator provided the following hazard notification to the aircraft manufacturer (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
2.4.6.3.4 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the flight management system supplier was best person to mitigate the risk (step 1).
The aircraft manufacturer also decided that the flight management system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the flight management system supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
2.4.6.3.5 No further action under § 5.57 is required by either the operator or aircraft manufacturer. Both organizations met the § 5.57 hazard notification requirements in this example.
2-35
2.5 Subpart D: Safety Assurance.
2.5.1 Monitoring of Operational Processes.
2.5.1.1 Discussion. Section 5.71(a) provides requirements for the acquisition of data to monitor the safety performance of the organization.
2.5.1.2 Implementation Strategies.
2.5.1.2.1 You must monitor the organization’s operational processes [§ 5.71(a)(1)].
Monitoring operational processes is what managers/process owners do on a day-to-day basis (e.g., direct supervision of employee activities, monitoring of reports from in-service product users, conducting design reviews to monitor the design process, monitoring of results from manufacturing or acceptance testing). Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance. This may include monitoring aviation safety-related products and services from outside sources. For example, if you choose to outsource the design of a critical system to a supplier, you may choose to co-locate some engineers at the supplier facility to monitor the design progress and attend design reviews.
§ 5.71 Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(1) Monitoring of operational processes.
(2) Monitoring of the operational environment to detect changes.
(3) Auditing of operational processes and systems.
(4) Evaluations of the SMS and operational processes and systems.
(5) Investigations of incidents and accidents.
(6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part.
(7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting.
(8) Investigations of hazard notifications that have been received from external sources.
2-36
2.5.1.2.2 You must monitor the organization’s operational environment to detect changes [§ 5.71(a)(2)]. Monitoring of the operational environment involves practices that are similar to those of monitoring processes. The context for monitoring the environment of a system is developed from the system analysis that is conducted under SRM. Once the scope of the environment is defined under SRM, you must monitor the environment to assess impacts on the safety of your organization’s products or services.
For example, outsourcing a critical design activity to a supplier may require you to increase oversight to ensure safety critical design activities continue to be properly performed.
2.5.1.2.3 You must conduct audits of the organization’s processes and systems [§ 5.71(a)(3)]. Audits are a means of collecting data to confirm whether or not actual practices are being followed within your organization. Audits should typically involve the management and process owners responsible for the system(s) being audited. Procedures for auditing should describe your audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits.
2.5.1.2.4 You must conduct evaluations of the SMS and the organization’s processes and systems [§ 5.71(a)(4)]. An evaluation is typically an independent review of your organization’s processes, procedures, and systems. An evaluation is an internal oversight tool that provides your accountable executive with a snapshot of the safety performance of your organization’s processes and systems, as well as your organization’s SMS processes. Conducting evaluations at planned intervals will help your organization’s management determine if your organization’s safety management methods and practices are meeting the safety objectives and expectations set out in your safety policy. Your evaluation planning should take into account the safety criticality of your processes being evaluated and your results from previous evaluations. The scope, content, and frequency of evaluations should be based on your need for information to assess the health of your processes and your SMS.
2.5.1.2.5 You must conduct investigations of incidents and accidents involving the organization’s products and services [§ 5.71(a)(5)]. You should treat investigations of aviation-related incidents and accidents as an opportunity for organization learning to prevent a repeat of errors and to change your organizational processes so that mistakes do not recur. Your investigations should focus on what went wrong, rather than who caused the error, and emphasize improvement of safety performance. You should include investigation data, if available, from outside sources such as FAA or National Transportation Safety Board (NTSB) investigations and your organization may, where appropriate, participate as a party to official