2-31
2.4.5.2.3 You must maintain the safety risk control development processes [§ 5.55(c)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.
2.4.5.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the risk control process could be a documented activity performed by the owner/manager and/or other employee(s) developing and evaluating the risk controls. It might be performed in conjunction with system analysis, hazard identification, risk analysis, and risk assessment, and using the same individual/group. For organizations on the higher end of the spectrum of complexity, the risk control process could be performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to develop the risk controls. There might need to be interdepartmental coordination before the controls are implemented. After the control is approved, it may be implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.
2.4.6 Notification of Hazards to Interfacing Persons.
2.4.6.1 Discussion. Section 5.57 provides requirements for providing hazard notifications to interfacing persons.
2.4.6.2 Implementation Strategies.
2.4.6.2.1 You must provide hazard notifications to interfacing persons, that to the best of your knowledge, could address a hazard or mitigate the hazard’s risk [§ 5.57]. Section 5.57 limits hazard notification to only those interfacing persons that contribute to the aviation safety of the products or services you provide.
Note: A hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.”
Reporting under § 5.57 should only occur for issues you have identified as hazards and the report should only be provided to the interfacing person you believe can best address the hazard or mitigate its risk. Section 5.57 § 5.57 Notification of hazards to interfacing persons.
If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.
2-32 does not require reporting of issues that are not hazards (e.g., commercial issues between companies). The intent of § 5.57 is to facilitate timely sharing of safety information.
2.4.6.2.2 Figure 2-1 provides a process that may be used for hazard notification.
Details for each step in this process follow:
Start: Complete the following steps for each hazard that is identified through your SRM processes.
Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer is “yes”, go to step 2. If the answer is “no,” notification is not required for this hazard.
Note: This decision may occur at any time while the hazard is being processed through the SRM steps (§§ 5.51, 5.53, 5.55).
Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard.
Note: For design and manufacturing organizations, the external organization (interfacing person) will typically be suppliers of parts or engineering services because these suppliers contributed to the safety of the products or services you provide. Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide.
Step 3: Provide a notification of the hazard to the external organization.
Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified, or risk controls put in place to address the hazard). You may use a non-disclosure agreement or other contract if you determine that the hazard notification can’t be provided without disclosing confidential or proprietary information.
Figure 2-1. Hazard Notification Process Start:
Hazard Notification Process.
Complete for each identified hazard Step 1: Is there an organization that could address the hazard or mitigate external No Hazard notification is not required. Stop:
its risk?
Yes Step 2: Does the external organization No Stop:
contribute to the Hazard notification is not safety of the required.
product or services you provide?
Yes Step 3: Provide a notification of the hazard to the external organization.
(Remove proprietary or confidential information)
2.4.6.3 Hazard Notification Example.
2.4.6.3.1 The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a technical standard order article manufacturer that is not required to have an SMS.
2-33
2-34
2.4.6.3.2 An airline operator received an employee report from a pilot stating that the aircraft flight management system deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. The operator’s SMS classified this employee report as a hazard because the airport is surrounded by high elevation terrain. Although this incident occurred during daytime and in visual meteorological conditions, management determined that if the same issue occurred during a night landing or instrument meteorological conditions, the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident.
2.4.6.3.3 The operator followed its hazard notification process and decided that the aircraft manufacturer was best person to mitigate the risk (step 1). The operator also decided that the aircraft manufacturer contributed to the safety of the services provided by the operator (step 2). The operator provided the following hazard notification to the aircraft manufacturer (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
2.4.6.3.4 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the flight management system supplier was best person to mitigate the risk (step 1).
The aircraft manufacturer also decided that the flight management system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the flight management system supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.”
2.4.6.3.5 No further action under § 5.57 is required by either the operator or aircraft manufacturer. Both organizations met the § 5.57 hazard notification requirements in this example.
2-35
2.5 Subpart D: Safety Assurance.
2.5.1 Monitoring of Operational Processes.
2.5.1.1 Discussion. Section 5.71(a) provides requirements for the acquisition of data to monitor the safety performance of the organization.
2.5.1.2 Implementation Strategies.
2.5.1.2.1 You must monitor the organization’s operational processes [§ 5.71(a)(1)].
Monitoring operational processes is what managers/process owners do on a day-to-day basis (e.g., direct supervision of employee activities, monitoring of reports from in-service product users, conducting design reviews to monitor the design process, monitoring of results from manufacturing or acceptance testing). Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance. This may include monitoring aviation safety-related products and services from outside sources. For example, if you choose to outsource the design of a critical system to a supplier, you may choose to co-locate some engineers at the supplier facility to monitor the design progress and attend design reviews.
§ 5.71 Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(1) Monitoring of operational processes.
(2) Monitoring of the operational environment to detect changes.
(3) Auditing of operational processes and systems.
(4) Evaluations of the SMS and operational processes and systems.
(5) Investigations of incidents and accidents.
(6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part.
(7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting.
(8) Investigations of hazard notifications that have been received from external sources.
2-36
2.5.1.2.2 You must monitor the organization’s operational environment to detect changes [§ 5.71(a)(2)]. Monitoring of the operational environment involves practices that are similar to those of monitoring processes. The context for monitoring the environment of a system is developed from the system analysis that is conducted under SRM. Once the scope of the environment is defined under SRM, you must monitor the environment to assess impacts on the safety of your organization’s products or services.
For example, outsourcing a critical design activity to a supplier may require you to increase oversight to ensure safety critical design activities continue to be properly performed.
2.5.1.2.3 You must conduct audits of the organization’s processes and systems [§ 5.71(a)(3)]. Audits are a means of collecting data to confirm whether or not actual practices are being followed within your organization. Audits should typically involve the management and process owners responsible for the system(s) being audited. Procedures for auditing should describe your audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits.
2.5.1.2.4 You must conduct evaluations of the SMS and the organization’s processes and systems [§ 5.71(a)(4)]. An evaluation is typically an independent review of your organization’s processes, procedures, and systems. An evaluation is an internal oversight tool that provides your accountable executive with a snapshot of the safety performance of your organization’s processes and systems, as well as your organization’s SMS processes. Conducting evaluations at planned intervals will help your organization’s management determine if your organization’s safety management methods and practices are meeting the safety objectives and expectations set out in your safety policy. Your evaluation planning should take into account the safety criticality of your processes being evaluated and your results from previous evaluations. The scope, content, and frequency of evaluations should be based on your need for information to assess the health of your processes and your SMS.
2.5.1.2.5 You must conduct investigations of incidents and accidents involving the organization’s products and services [§ 5.71(a)(5)]. You should treat investigations of aviation-related incidents and accidents as an opportunity for organization learning to prevent a repeat of errors and to change your organizational processes so that mistakes do not recur. Your investigations should focus on what went wrong, rather than who caused the error, and emphasize improvement of safety performance. You should include investigation data, if available, from outside sources such as FAA or National Transportation Safety Board (NTSB) investigations and your organization may, where appropriate, participate as a party to official
2-37 investigations. Note that investigations of incidents and accidents not directly related to aviation are not covered by this provision.
2.5.1.2.6 You must conduct investigations of reports regarding potential noncompliance with regulatory standards or other safety risk controls [§ 5.71(a)(6)]. This subject is very similar to the one described above in that the focus of your investigation should reveal information that, when utilized correctly, will identify hazards related to non-compliances. It is not as important to identify “who did it” as it is to learn why it happened.
Within this process, it is important to distinguish between error and intentional/willful noncompliant actions. You should investigate reports regarding potential noncompliance with regulatory standards or of inadequate safety risk controls established through the SRM process.
2.5.1.2.7 You must develop a confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, and incidents, and propose solutions and safety improvements [§ 5.71(a)(7)].
Employees should be encouraged to report safety issues and not fear reprisal from management as long as the issue was not either deliberately caused or created through gross negligence. Policies that assure employees of fair treatment and a non-reprisal reporting policy which establishes clear standards of behavior are essential parts of your reporting process.
Another aspect of your confidential reporting system is that the submitter’s identity is protected to the extent that is practicable. Therefore, you should define methods for employee reporting and de-identification of sources without losing essential information.
2.5.1.2.8 You must conduct investigations of hazard notifications that have been received from external sources [§ 5.71(a)(8)]. When an aviation organization receives notification of a hazard from an external source, they are required to evaluate the hazard utilizing the same safety assurance processes as they would if they received a confidential employee report.
The hazard should be evaluated using the SRM processes and if the aviation organization determines the hazard would best be addressed by an external organization, they must notify that organization utilizing their processes in §5.57.
2.5.1.2.9 You must maintain the data acquisition processes to monitor the safety performance of the organization [§ 5.71]. Maintain means that these processes are accurate and kept current whenever they are changed.
2-38
2.5.1.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel who are directly involved in the organization’s day-to-day activities. For example, regularly reviewing in-service reports from customers is a form of monitoring and could be conducted during the normal course of duties. For organizations on the higher end of the spectrum of complexity, monitoring may involve multiple levels of management, safety professionals, functional area managers, trained auditors/analysts, and teams/groups of line managers. This may include review of customer reports from field service departments, monitoring of safety critical manufacturing processes, and monitoring of design process adherence.
2.5.2 Analysis of Data.
2.5.2.1 Discussion. Section 5.71(b) provides requirements for the analysis of safety data.
2.5.2.1.1 Implementation Strategies.
2.5.2.1.2 You must develop processes that analyze the data acquired in § 5.71(a) along with any other relevant data with respect to the organization’s operations, products, and services [§ 5.71(b)]. Analysis involves examining the data acquired in order to make inferences about the safety performance of operational systems and the SMS. It is common for organizations to treat each employee report, audit finding, or investigation in isolation; however, system problems may not be seen if data points are examined in isolation. You should also look across individual reports and among various data sources for patterns or trends as you are conducting your analysis processes. You can record the outputs from data analysis in a simple recording medium such as a notebook, paper files, common desktop software, or specialized systems.
2.5.2.1.3 You must maintain the data analysis processes [§ 5.71(b)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.
§ 5.71 Safety performance monitoring and measurement.
(b) Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services.
2-39
2.5.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, analysis may consist of making notes about how things didn’t go as planned. This data could be reviewed on a regular basis, perhaps monthly or quarterly. For organizations on the higher end of the spectrum of complexity, various departments may have their own data analysis group reviewing data and analyzing the data by SMEs within the respective department, possibly supported and coordinated by a safety department.
2.5.3 Confidential Employee Report Summary Reporting Requirements.
2.5.3.1 Discussion. Section 5.71(c) provides requirements for submission of confidential employee report summaries to the FAA.
2.5.3.2 Implementation Strategies.
2.5.3.2.1 Holders of both a type certificate and a production certificate for the same product must submit a summary of confidential employee reports received to the FAA every six months [§ 5.71(c)]. This summary should include the number of reports received during the six-month period and a concise description of each report. Reports should be submitted to the certificate management section that oversees your production certificate.
Note 1: Section 5.71(c) only applies to holders of both a type certificate and production certificate for the same product.
Note 2: Title 49 U.S.C. 44735(a)(2) provides protection from freedom of information act disclosure for reports submitted under § 5.71(c). You may label each page of the report with the following for protection from freedom of information act disclosure: “The information in this document is protected from disclosure under 49 U.S.C. 44735(a)(2).”
§ 5.71 Safety performance monitoring and measurement.
(c) Any person that holds both a type certificate and a production certificate issued under part 21 of this chapter for the same product must submit a summary of the confidential employee reports received under subparagraph (a)(7) of this section to the Administrator once every 6 months.
2-40
2.5.4 Safety Performance Assessment.
2.5.4.1 Discussion. Section 5.73(a) provides requirements to conduct assessments of the organization’s safety performance against its safety objectives. In addition, section 5.73(b) requires SRM if ineffective risk controls or new hazards have been identified through the assessments.
2.5.4.2 Implementation Strategies.
2.5.4.2.1 You must conduct assessments of the organization’s safety performance against its safety objectives [§ 5.73(a)]. In addition, you must complete SRM if the assessments identify ineffective risk controls or new hazards [§ 5.73(b)]. Under § 5.73, you review the analysis of your safety performance data to assess the organization’s safety performance against its safety objectives. The assessments should determine if the organization’s safety performance is effective and is meeting the safety objectives that are identified in the safety policy required by § 5.21. These assessments should be made by personnel with assigned responsibility and authority in the process area. The conclusions of the safety assessments are reviewed by the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary.
2.5.4.2.2 Assessments can have one of the following general outcomes:
• Performance is acceptable and objectives are being met.
• Performance is not acceptable, and analysis suggests that the problem lies with compliance with risk controls, regulations, organizational § 5.73 Safety performance assessment.
(a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to:
(1) Ensure compliance with the safety risk controls established by the person.
(2) Evaluate the performance of the SMS.
(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls.
(4) Identify changes in the operational environment that may introduce new hazards.
(5) Identify new hazards.
(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part.
2-41 policy and procedures, or necessary resources have not been provided.
In this case, corrective action under § 5.75 would be warranted.
• Compliance with risk controls and regulations appears to be satisfactory; however, desired results are not being obtained (i.e., the risk control is ineffective). In this case, the SRM processes would be triggered under § 5.73(b).
• New or uncontrolled hazards are discovered. This may be due to new hazards having arisen since the system was developed or discovery of factors that were previously unknown. In this case, the SRM processes must be followed under § 5.73(b).
2.5.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, safety performance and assessment could be a documented activity performed by the accountable executive. For organizations on the higher end of the spectrum of complexity, this process is best addressed at the highest level in the organization and involves the accountable executive, division vice presidents, and other defined leaders and decision makers. At each level, the organization would define who is responsible to either correct the problem or develop new risk controls. These organizations typically have standing management committees at the functional organization level and a second body at the corporate level to assure integration, coordination, and review by the accountable executive.
2.5.5 Continuous Improvement.
2.5.5.1 Discussion. Section 5.75 provides requirements to correct safety performance deficiencies that have been identified in the organization’s assessments of its safety performance against its safety objectives.
2.5.5.1.1 Implementation Strategies.
2.5.5.1.2 You must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73 [§ 5.75].
As discussed in paragraph 2.5.4.2.2, the corrective action process of § 5.75 is triggered when compliance with, or implementation of, risk controls has been found to be deficient. In this case, it is not necessary to conduct a new safety risk analysis. Risk has already been assessed as being unacceptable without satisfactory completion of the risk control. The § 5.75 Continuous improvement.
Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73.
2-42 required corrective action for this case is to make the necessary corrective actions to ensure that the organization conforms to the risk controls.
2.5.5.2 Scalability Examples.
2.5.5.2.1 Continuous improvement decision making is an output of the performance assessment process. The managers, committees, or working groups that make assessment decisions would also lay out courses of corrective action.