2-35
2.5 Subpart D: Safety Assurance.
2.5.1 Monitoring of Operational Processes.
2.5.1.1 Discussion. Section 5.71(a) provides requirements for the acquisition of data to monitor the safety performance of the organization.
2.5.1.2 Implementation Strategies.
2.5.1.2.1 You must monitor the organization’s operational processes [§ 5.71(a)(1)].
Monitoring operational processes is what managers/process owners do on a day-to-day basis (e.g., direct supervision of employee activities, monitoring of reports from in-service product users, conducting design reviews to monitor the design process, monitoring of results from manufacturing or acceptance testing). Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance. This may include monitoring aviation safety-related products and services from outside sources. For example, if you choose to outsource the design of a critical system to a supplier, you may choose to co-locate some engineers at the supplier facility to monitor the design progress and attend design reviews.
§ 5.71 Safety performance monitoring and measurement.
(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:
(1) Monitoring of operational processes.
(2) Monitoring of the operational environment to detect changes.
(3) Auditing of operational processes and systems.
(4) Evaluations of the SMS and operational processes and systems.
(5) Investigations of incidents and accidents.
(6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part.
(7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting.
(8) Investigations of hazard notifications that have been received from external sources.
2-36
2.5.1.2.2 You must monitor the organization’s operational environment to detect changes [§ 5.71(a)(2)]. Monitoring of the operational environment involves practices that are similar to those of monitoring processes. The context for monitoring the environment of a system is developed from the system analysis that is conducted under SRM. Once the scope of the environment is defined under SRM, you must monitor the environment to assess impacts on the safety of your organization’s products or services.
For example, outsourcing a critical design activity to a supplier may require you to increase oversight to ensure safety critical design activities continue to be properly performed.
2.5.1.2.3 You must conduct audits of the organization’s processes and systems [§ 5.71(a)(3)]. Audits are a means of collecting data to confirm whether or not actual practices are being followed within your organization. Audits should typically involve the management and process owners responsible for the system(s) being audited. Procedures for auditing should describe your audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits.
2.5.1.2.4 You must conduct evaluations of the SMS and the organization’s processes and systems [§ 5.71(a)(4)]. An evaluation is typically an independent review of your organization’s processes, procedures, and systems. An evaluation is an internal oversight tool that provides your accountable executive with a snapshot of the safety performance of your organization’s processes and systems, as well as your organization’s SMS processes. Conducting evaluations at planned intervals will help your organization’s management determine if your organization’s safety management methods and practices are meeting the safety objectives and expectations set out in your safety policy. Your evaluation planning should take into account the safety criticality of your processes being evaluated and your results from previous evaluations. The scope, content, and frequency of evaluations should be based on your need for information to assess the health of your processes and your SMS.
2.5.1.2.5 You must conduct investigations of incidents and accidents involving the organization’s products and services [§ 5.71(a)(5)]. You should treat investigations of aviation-related incidents and accidents as an opportunity for organization learning to prevent a repeat of errors and to change your organizational processes so that mistakes do not recur. Your investigations should focus on what went wrong, rather than who caused the error, and emphasize improvement of safety performance. You should include investigation data, if available, from outside sources such as FAA or National Transportation Safety Board (NTSB) investigations and your organization may, where appropriate, participate as a party to official
2-37 investigations. Note that investigations of incidents and accidents not directly related to aviation are not covered by this provision.
2.5.1.2.6 You must conduct investigations of reports regarding potential noncompliance with regulatory standards or other safety risk controls [§ 5.71(a)(6)]. This subject is very similar to the one described above in that the focus of your investigation should reveal information that, when utilized correctly, will identify hazards related to non-compliances. It is not as important to identify “who did it” as it is to learn why it happened.
Within this process, it is important to distinguish between error and intentional/willful noncompliant actions. You should investigate reports regarding potential noncompliance with regulatory standards or of inadequate safety risk controls established through the SRM process.
2.5.1.2.7 You must develop a confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, and incidents, and propose solutions and safety improvements [§ 5.71(a)(7)].
Employees should be encouraged to report safety issues and not fear reprisal from management as long as the issue was not either deliberately caused or created through gross negligence. Policies that assure employees of fair treatment and a non-reprisal reporting policy which establishes clear standards of behavior are essential parts of your reporting process.
Another aspect of your confidential reporting system is that the submitter’s identity is protected to the extent that is practicable. Therefore, you should define methods for employee reporting and de-identification of sources without losing essential information.
2.5.1.2.8 You must conduct investigations of hazard notifications that have been received from external sources [§ 5.71(a)(8)]. When an aviation organization receives notification of a hazard from an external source, they are required to evaluate the hazard utilizing the same safety assurance processes as they would if they received a confidential employee report.
The hazard should be evaluated using the SRM processes and if the aviation organization determines the hazard would best be addressed by an external organization, they must notify that organization utilizing their processes in §5.57.
2.5.1.2.9 You must maintain the data acquisition processes to monitor the safety performance of the organization [§ 5.71]. Maintain means that these processes are accurate and kept current whenever they are changed.
2-38
2.5.1.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel who are directly involved in the organization’s day-to-day activities. For example, regularly reviewing in-service reports from customers is a form of monitoring and could be conducted during the normal course of duties. For organizations on the higher end of the spectrum of complexity, monitoring may involve multiple levels of management, safety professionals, functional area managers, trained auditors/analysts, and teams/groups of line managers. This may include review of customer reports from field service departments, monitoring of safety critical manufacturing processes, and monitoring of design process adherence.
2.5.2 Analysis of Data.
2.5.2.1 Discussion. Section 5.71(b) provides requirements for the analysis of safety data.
2.5.2.1.1 Implementation Strategies.
2.5.2.1.2 You must develop processes that analyze the data acquired in § 5.71(a) along with any other relevant data with respect to the organization’s operations, products, and services [§ 5.71(b)]. Analysis involves examining the data acquired in order to make inferences about the safety performance of operational systems and the SMS. It is common for organizations to treat each employee report, audit finding, or investigation in isolation; however, system problems may not be seen if data points are examined in isolation. You should also look across individual reports and among various data sources for patterns or trends as you are conducting your analysis processes. You can record the outputs from data analysis in a simple recording medium such as a notebook, paper files, common desktop software, or specialized systems.
2.5.2.1.3 You must maintain the data analysis processes [§ 5.71(b)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.
§ 5.71 Safety performance monitoring and measurement.
(b) Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services.
2-39
2.5.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, analysis may consist of making notes about how things didn’t go as planned. This data could be reviewed on a regular basis, perhaps monthly or quarterly. For organizations on the higher end of the spectrum of complexity, various departments may have their own data analysis group reviewing data and analyzing the data by SMEs within the respective department, possibly supported and coordinated by a safety department.
2.5.3 Confidential Employee Report Summary Reporting Requirements.
2.5.3.1 Discussion. Section 5.71(c) provides requirements for submission of confidential employee report summaries to the FAA.
2.5.3.2 Implementation Strategies.
2.5.3.2.1 Holders of both a type certificate and a production certificate for the same product must submit a summary of confidential employee reports received to the FAA every six months [§ 5.71(c)]. This summary should include the number of reports received during the six-month period and a concise description of each report. Reports should be submitted to the certificate management section that oversees your production certificate.
Note 1: Section 5.71(c) only applies to holders of both a type certificate and production certificate for the same product.
Note 2: Title 49 U.S.C. 44735(a)(2) provides protection from freedom of information act disclosure for reports submitted under § 5.71(c). You may label each page of the report with the following for protection from freedom of information act disclosure: “The information in this document is protected from disclosure under 49 U.S.C. 44735(a)(2).”
§ 5.71 Safety performance monitoring and measurement.
(c) Any person that holds both a type certificate and a production certificate issued under part 21 of this chapter for the same product must submit a summary of the confidential employee reports received under subparagraph (a)(7) of this section to the Administrator once every 6 months.
2-40
2.5.4 Safety Performance Assessment.
2.5.4.1 Discussion. Section 5.73(a) provides requirements to conduct assessments of the organization’s safety performance against its safety objectives. In addition, section 5.73(b) requires SRM if ineffective risk controls or new hazards have been identified through the assessments.
2.5.4.2 Implementation Strategies.
2.5.4.2.1 You must conduct assessments of the organization’s safety performance against its safety objectives [§ 5.73(a)]. In addition, you must complete SRM if the assessments identify ineffective risk controls or new hazards [§ 5.73(b)]. Under § 5.73, you review the analysis of your safety performance data to assess the organization’s safety performance against its safety objectives. The assessments should determine if the organization’s safety performance is effective and is meeting the safety objectives that are identified in the safety policy required by § 5.21. These assessments should be made by personnel with assigned responsibility and authority in the process area. The conclusions of the safety assessments are reviewed by the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary.
2.5.4.2.2 Assessments can have one of the following general outcomes:
• Performance is acceptable and objectives are being met.
• Performance is not acceptable, and analysis suggests that the problem lies with compliance with risk controls, regulations, organizational § 5.73 Safety performance assessment.
(a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to:
(1) Ensure compliance with the safety risk controls established by the person.
(2) Evaluate the performance of the SMS.
(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls.
(4) Identify changes in the operational environment that may introduce new hazards.
(5) Identify new hazards.
(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part.
2-41 policy and procedures, or necessary resources have not been provided.
In this case, corrective action under § 5.75 would be warranted.
• Compliance with risk controls and regulations appears to be satisfactory; however, desired results are not being obtained (i.e., the risk control is ineffective). In this case, the SRM processes would be triggered under § 5.73(b).
• New or uncontrolled hazards are discovered. This may be due to new hazards having arisen since the system was developed or discovery of factors that were previously unknown. In this case, the SRM processes must be followed under § 5.73(b).
2.5.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, safety performance and assessment could be a documented activity performed by the accountable executive. For organizations on the higher end of the spectrum of complexity, this process is best addressed at the highest level in the organization and involves the accountable executive, division vice presidents, and other defined leaders and decision makers. At each level, the organization would define who is responsible to either correct the problem or develop new risk controls. These organizations typically have standing management committees at the functional organization level and a second body at the corporate level to assure integration, coordination, and review by the accountable executive.
2.5.5 Continuous Improvement.
2.5.5.1 Discussion. Section 5.75 provides requirements to correct safety performance deficiencies that have been identified in the organization’s assessments of its safety performance against its safety objectives.
2.5.5.1.1 Implementation Strategies.
2.5.5.1.2 You must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73 [§ 5.75].
As discussed in paragraph 2.5.4.2.2, the corrective action process of § 5.75 is triggered when compliance with, or implementation of, risk controls has been found to be deficient. In this case, it is not necessary to conduct a new safety risk analysis. Risk has already been assessed as being unacceptable without satisfactory completion of the risk control. The § 5.75 Continuous improvement.
Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73.
2-42 required corrective action for this case is to make the necessary corrective actions to ensure that the organization conforms to the risk controls.
2.5.5.2 Scalability Examples.
2.5.5.2.1 Continuous improvement decision making is an output of the performance assessment process. The managers, committees, or working groups that make assessment decisions would also lay out courses of corrective action.
2-43
2.6 Subpart E: Safety Promotion.
2.6.1 Competencies and Training.
2.6.1.1 Discussion. Section 5.91 provides requirements to ensure that employees attain and maintain the competencies necessary for the operation and performance of the SMS.
2.6.1.2 Implementation Strategies.
2.6.1.2.1 Your organization must train its employees in the processes, requirements, and expectations of the SMS relevant to the duties of each employee [§ 5.91]. Your employees may receive initial safety training for them to understand and perform their safety related duties. Recurrent training may also be necessary to reinforce these skills to meet the requirement for an employee to maintain SMS-related competencies. For example, an employee who is a process owner will probably need more detailed SMS training (e.g., safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than will an aircraft assembly technician. Line managers may need to know the potential consequences of safety failures and system failure modes more so than line employees will. Line employees may only need an overview of safety management fundamentals for their operational department (e.g., instructions on how to identify and report safety concerns). Intervals for training needed to maintain competencies are determined by your organization based on operational requirements. These intervals must be of sufficient frequency to ensure your employees maintain their SMS-related competencies.
2.6.1.2.2 Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they perform work functions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. You should establish competencies for all employees, commensurate with their duties relevant to the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests, and measured during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As a part of safety assurance, you should periodically review your organization’s training program(s) to § 5.91 Competencies and training.
Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS.
2-44 ensure that those programs meet the objectives set out in your safety policy.
2.6.1.2.3 It is the responsibility of your organization to determine its own training needs based on competency requirements. Management personnel, specifically designated by the accountable executive to ensure the SMS is fully implemented, may need to be trained first and may also need specialized training to fulfill their responsibilities. Determining your organization’s training needs starts with a careful review of the safety policy, processes, and objectives. Everyone working within the scope of your organization’s SMS should receive SMS training commensurate with their position in the organization.
2.6.1.3 Scalability Examples. You may choose to either train your employees in house or to contract out the training to outside vendors. Whichever option is taken, the training must be specific to your organization’s SMS and operations. Training can be in person or virtual based on your organizational needs. Training should be modular so only the material pertinent to the employee’s position within the organization is presented.
For example, an aircraft assembly technician might only need to be trained on employee reporting while a process owner would need to understand the organization’s SRM processes and procedures. An organization with only one or two employees would likely complete online training to meet this requirement. More complex organizations could have a training department that develops and conducts the training.
2.6.2 Safety Communication.
2.6.2.1 Discussion. Section 5.93 provides requirements for communicating safety information to employees.
§ 5.93 Safety communication.
Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum:
(a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities.
(b) Conveys hazard information relevant to the employee's responsibilities.
(c) Explains why safety actions have been taken.
(d) Explains why safety procedures are introduced or changed.
2-45
2.6.2.1.1 Implementation Strategies.
2.6.2.1.2 You must develop and maintain a means for communicating safety information to the organization [§ 5.93]. Effective communication involves adjusting the content and manner in which you deliver information, to match your target employee’s role in the organization.
Your accountable executive must ensure that communication mechanisms are available and are effectively used. Your delivery system should be appropriate according to the size and complexity of the organization. You could provide safety policy and information as text, visual media (e.g., posters, short videos), orally, or through examples. Your messages should be consistent, in a form to which employees at each level can relate and be delivered using whichever media you have available.
2.6.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, communicating safety considerations to employees will probably be simple and direct. For example, the organization or its accountable executive could conduct regular all-hands/employee meetings. Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams. For organizations on the higher end of the spectrum of complexity, communication is more likely to be formal and a tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. An organization may consider information technology approaches, such as email broadcasts or intranet websites, to direct and record the flow of safety information and for evaluation and auditing purposes.
2-46
2.7 Subpart F: SMS Documentation and Recordkeeping.
2.7.1 SMS Documentation.
2.7.1.1 Discussion. Section 5.95 provides requirements for SMS documentation.
2.7.1.1.1 Implementation Strategies.
2.7.1.1.2 You must develop and maintain SMS documentation including your safety policy along with SMS processes and procedures [§ 5.95]. Developing SMS documentation means that the safety policy, and SMS processes and procedures are written, have been recorded, and can be retrieved.
Maintaining SMS documentation means that the safety policy, and SMS processes and procedures are updated and kept current whenever they are changed.
2.7.1.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the owner/manager or designee may be responsible for maintaining and distributing current versions of guidance documents.
Documentation may consist of a set of written documents, spreadsheets, and forms that are kept in file cabinets or electronic systems.
Organizations on the higher end of the spectrum of complexity may use software applications or develop new database tools to support documentation requirements. These organizations should examine existing tools and infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements.
§ 5.95 SMS documentation.
Any person required to have an SMS under this part must develop and maintain the following SMS documentation:
(a) Safety policy.
(b) SMS processes and procedures.