2-43
2.6 Subpart E: Safety Promotion.
2.6.1 Competencies and Training.
2.6.1.1 Discussion. Section 5.91 provides requirements to ensure that employees attain and maintain the competencies necessary for the operation and performance of the SMS.
2.6.1.2 Implementation Strategies.
2.6.1.2.1 Your organization must train its employees in the processes, requirements, and expectations of the SMS relevant to the duties of each employee [§ 5.91]. Your employees may receive initial safety training for them to understand and perform their safety related duties. Recurrent training may also be necessary to reinforce these skills to meet the requirement for an employee to maintain SMS-related competencies. For example, an employee who is a process owner will probably need more detailed SMS training (e.g., safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than will an aircraft assembly technician. Line managers may need to know the potential consequences of safety failures and system failure modes more so than line employees will. Line employees may only need an overview of safety management fundamentals for their operational department (e.g., instructions on how to identify and report safety concerns). Intervals for training needed to maintain competencies are determined by your organization based on operational requirements. These intervals must be of sufficient frequency to ensure your employees maintain their SMS-related competencies.
2.6.1.2.2 Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they perform work functions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. You should establish competencies for all employees, commensurate with their duties relevant to the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests, and measured during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As a part of safety assurance, you should periodically review your organization’s training program(s) to § 5.91 Competencies and training.
Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS.
2-44 ensure that those programs meet the objectives set out in your safety policy.
2.6.1.2.3 It is the responsibility of your organization to determine its own training needs based on competency requirements. Management personnel, specifically designated by the accountable executive to ensure the SMS is fully implemented, may need to be trained first and may also need specialized training to fulfill their responsibilities. Determining your organization’s training needs starts with a careful review of the safety policy, processes, and objectives. Everyone working within the scope of your organization’s SMS should receive SMS training commensurate with their position in the organization.
2.6.1.3 Scalability Examples. You may choose to either train your employees in house or to contract out the training to outside vendors. Whichever option is taken, the training must be specific to your organization’s SMS and operations. Training can be in person or virtual based on your organizational needs. Training should be modular so only the material pertinent to the employee’s position within the organization is presented.
For example, an aircraft assembly technician might only need to be trained on employee reporting while a process owner would need to understand the organization’s SRM processes and procedures. An organization with only one or two employees would likely complete online training to meet this requirement. More complex organizations could have a training department that develops and conducts the training.
2.6.2 Safety Communication.
2.6.2.1 Discussion. Section 5.93 provides requirements for communicating safety information to employees.
§ 5.93 Safety communication.
Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum:
(a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities.
(b) Conveys hazard information relevant to the employee's responsibilities.
(c) Explains why safety actions have been taken.
(d) Explains why safety procedures are introduced or changed.
2-45
2.6.2.1.1 Implementation Strategies.
2.6.2.1.2 You must develop and maintain a means for communicating safety information to the organization [§ 5.93]. Effective communication involves adjusting the content and manner in which you deliver information, to match your target employee’s role in the organization.
Your accountable executive must ensure that communication mechanisms are available and are effectively used. Your delivery system should be appropriate according to the size and complexity of the organization. You could provide safety policy and information as text, visual media (e.g., posters, short videos), orally, or through examples. Your messages should be consistent, in a form to which employees at each level can relate and be delivered using whichever media you have available.
2.6.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, communicating safety considerations to employees will probably be simple and direct. For example, the organization or its accountable executive could conduct regular all-hands/employee meetings. Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams. For organizations on the higher end of the spectrum of complexity, communication is more likely to be formal and a tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. An organization may consider information technology approaches, such as email broadcasts or intranet websites, to direct and record the flow of safety information and for evaluation and auditing purposes.
2-46
2.7 Subpart F: SMS Documentation and Recordkeeping.
2.7.1 SMS Documentation.
2.7.1.1 Discussion. Section 5.95 provides requirements for SMS documentation.
2.7.1.1.1 Implementation Strategies.
2.7.1.1.2 You must develop and maintain SMS documentation including your safety policy along with SMS processes and procedures [§ 5.95]. Developing SMS documentation means that the safety policy, and SMS processes and procedures are written, have been recorded, and can be retrieved.
Maintaining SMS documentation means that the safety policy, and SMS processes and procedures are updated and kept current whenever they are changed.
2.7.1.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the owner/manager or designee may be responsible for maintaining and distributing current versions of guidance documents.
Documentation may consist of a set of written documents, spreadsheets, and forms that are kept in file cabinets or electronic systems.
Organizations on the higher end of the spectrum of complexity may use software applications or develop new database tools to support documentation requirements. These organizations should examine existing tools and infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements.
§ 5.95 SMS documentation.
Any person required to have an SMS under this part must develop and maintain the following SMS documentation:
(a) Safety policy.
(b) SMS processes and procedures.
2-47
2.7.2 SMS Records.
2.7.2.1 Discussion. Section 5.97 provides requirements for SMS recordkeeping.
2.7.2.2 Implementation Strategies.
2.7.2.2.1 Records associated with the outputs of SRM processes must be maintained for as long as any associated controls remain relevant to your operations [§ 5.97(a)]. While records of SRM processes that do not result in any risk controls being implemented (or where all risks are acceptable) are not required to be retained, organizations may choose to retain those records for historical purposes.
2.7.2.2.2 Records of your safety assurance processes must be maintained for a minimum of 5 years [§ 5.97(b)]. This includes appropriate safety performance monitoring, measurement, and assessment records.
2.7.2.2.3 Training records must be retained for as long as the individual is employed by the organization [§ 5.97(c)]. These records should show when the individual received initial and recurrent SMS training. Superseded recurrent training records must be retained in accordance with the organization’s record retention processes and procedures for as long as the employee is employed by the organization.
2.7.2.2.4 Records of your safety communications must be maintained for a minimum of 24 months [§ 5.97(d)]. This includes safety communications under § 5.93 and hazard sharing communications under § 5.57.
§ 5.97 SMS records.
Any person required to have an SMS under this part must:
(a) Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation.
(b) Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years.
(c) Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person.
(d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months.
2-48
2.7.2.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the owner/manager or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, and completed forms that are kept in file cabinets or binders. Organizations on the higher end of the spectrum of complexity, may have a dedicated records staff or department whose duties include document distribution and records retention.
3-1 CHAPTER 3. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT SYSTEM (SMS)
3.1 Process Overview. There are several steps to developing and implementing an SMS that is compliant with part 5 (ref §§ 5.11, 5.13, 5.15):
• Required: Develop an organizational system description.
• Recommended: Complete a gap analysis to identify the areas where your organization complies with part 5 and where changes are required.
• Required: Develop and submit an SMS implementation plan to the FAA for approval.
• Required: Develop the necessary policies, processes, procedures, and systems to comply with part 5 and your implementation plan.
• Required: Implement the SMS in accordance with part 5 and your implementation plan.
3.1.1 Develop an Organizational System Description. Follow the guidance in paragraph
2.2.10 of this AC (ref § 5.17) to develop your organizational system description.
3.1.2 Gap Analysis. A gap analysis involves analyzing and assessing your existing programs, systems, processes, and activities with respect to SMS requirements found in part 5.
Most certificate holders have many of the elements of part 5 in their current processes, although those processes may not entirely fulfill the part 5 requirements. For example, the current processes may be limited in scope (i.e., do not cover the entire organization) and/or interoperability (i.e., do not interface sufficiently to form a “system”). If you determine that a process in your organization satisfies one or more part 5 requirements, your analysis should document how that process meets the requirements. You may document how you meet certain part 5 requirements by referencing the processes or procedures where the requirements are discussed. Your gap analysis should identify the additional policies, processes, and procedures you need to develop to fully comply with part 5.
3.1.3 Develop and Submit an Implementation Plan. Follow the guidance in paragraph 2.2.11 of this AC (ref § 5.19) to develop your implementation plan, and in paragraphs 2.2.7,
2.2.8, or 2.2.9 of this AC (ref §§ 5.11, 5.13, or 5.15) to submit your implementation plan for FAA approval.
3.1.4 Develop the Policies, Processes and Procedures to Comply with Part 5. Develop the necessary policies, processes, and procedures in accordance with the implementation plan (ref §§ 5.11, 5.13, or 5.15).
3.1.5 Implement the SMS. Follow the guidance in paragraphs 2.2.7, 2.2.8, or 2.2.9 of this AC (ref §§ 5.11, 5.13, or 5.15) to implement the SMS in accordance with your implementation plan.
1 APPENDIX A. GUIDANCE FOR DEVELOPING A SAFETY POLICY A.1 Safety Policy.
The safety policy must meet the requirements in § 5.21 and be signed by the accountable executive. References (i.e., “pointers” to other manuals which provide guidance how each requirement is to be met) could be embedded in the safety policy. It is important to remember the safety policy is unique to your organization and should be developed to meet the specific needs, activities, and structure of your organization. A safety policy is a document that states what your organization will do and how its employees are expected to act.
A.1.1 A sample safety policy is included in Paragraph A.2.
A.1.2 Reserved.
2 A.2 Sample Safety Policy.
Safety is one of our core functions and an effective safety management system (SMS) is vital to the success and longevity of [company name]. We are committed to implementing, maintaining, and continuously improving a fully functional SMS to ensure that the safety of our products and services are our highest priority.
All employees, starting with the [title of the Accountable Executive], are accountable for supporting our organization’s ultimate goal to achieve the highest level of safety performance of the products and services we provide.
At [company name], we are committed to:
• Supporting the management of safety through the provision of all necessary resources to establish and maintain a fully functional SMS.
• Establishing safety objectives that are available for all employees to review in the [location of objectives]. We will ensure that our safety objectives are monitored, measured, and tracked to ensure they are fulfilled.
• Regularly reviewing the safety performance of our organization and directing actions necessary to address substandard safety performance.
• Encouraging employees to disclose safety concerns without fear of reprisal and ensuring that no action will be taken against any employee who discloses a safety concern through the confidential employee reporting system.1 Specific reporting procedures are located [location of procedures].
• Communicating this safety policy to all employees to ensure each of us is aware of our SMS and safety-related duties and responsibilities.
• Periodically reviewing this safety policy to ensure it remains relevant and appropriate to our organization.
[Signed], Accountable executive [Additional management personnel optional]
1 Activities involving intentional disregard for FAA regulations, company policies and procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary action.
Appendix B B-1 APPENDIX B. IDENTIFYING THE ACCOUNTABLE EXECUTIVE B.1 Identifying the Accountable Executive Flowcharts. The following flowcharts provide a series of questions to assist you with the selection of your organization’s accountable executive:
• Figure B-1, Accountable Executive Decision Process
• Figure B-2, Verifying the Accountable Executive B.1.1 Figure B-1 identifies different organizational structures and how those structures may determine the accountable executive. These flowcharts cannot address all possible organizational structures.
B.1.2 Once you have identified the accountable executive, the questions in Figure B-2 will assist you in verifying that the person in the selected position is the correct choice. All questions must receive a “yes” answer as they are validating the requirements of part 5 and § 5.25(a). Should any of the questions result in a “no” answer, you should start the selection process again with a new candidate.
Appendix B Figure B-1. Accountable Executive Decision Process Accountable Executive Decision Process Confirm selection Is the organization a sole proprietor ship? Yes Proprietor is Accountable Executive by answering the questions on Figure B-2 Accountable Executive Proprietor is No Accountable Executive Is the Nominate a Confirm selection organization a partnership partner as by answering the between Accountable questions on individuals? Yes Executive Figure B-2 No Nominated partner is Accountable Executive controlled by a organization Is the appointed a CEO or Has the Board Confirm selection by answering the Directors? Board of equivalent to manage the organization? questions on Figure B-2 No CEO is Accountable Executive Chairman of Board is Accountable Executive Who in the What is the most organization senior position in holds this the company? position?
If a clear selection cannot be made, No Confirm Yes organization and re-evaluate by answering selection Accountable Executive Identified person is begin process the questions again on Figure B-2 B-2
Appendix B Figure B-1. Verifying the Accountable Executive Start Identify person by name Select another candidate Does the person have final $5.25 (a) (1) authority over the service provider's operations?
No Yes Does the person control the financial resources required for §5.25 (a) (2) → the service provider's operation?
No Yes Does the person control the human resources required to §5.25 (a) (3) → conduct the service provider's operations? No Yes Does the person retain the ultimate responsibility for the safety §5.25 (a) (4) performance of the service provider's operations? No Yes This person is the Accountable Executive B-3