+-----------------------------------------+----------------------------+
| ![](media/im                            | **Advisory**               |
| age1.wmf){width="0.38472222222222224in" |                            |
| height="0.3645833333333333in"}          | **Circular**               |
|                                         |                            |
| **U.S. Department**                     |                            |
|                                         |                            |
| **of Transportation**                   |                            |
|                                         |                            |
| **Federal Aviation**                    |                            |
|                                         |                            |
| **Administration**                      |                            |
+-----------------------------------------+----------------------------+

+-----------------------------+------------------+--------------------+
| **Subject:** INTRODUCTION   | **Date:**        | **AC No:** AC      |
| TO SAFETY MANAGEMENT        | February 28,     | 150/5200-37        |
| SYSTEMS (SMS) FOR AIRPORT   | 2007             |                    |
| OPERATORS                   |                  | **Change:**        |
|                             | **Initiated      |                    |
|                             | by:** AAS-300    |                    |
+-----------------------------+------------------+--------------------+

1.  **PURPOSE.** This Advisory Circular (AC) introduces the concept of a
    safety management system (SMS) for airport operators.

**BACKGROUND.** The application of a systematic, proactive, and
well-defined safety program (as is inherent in a SMS) allows an
organization producing a product or service to strike a realistic and
efficient balance between safety and production. The forecast growth in
air transportation will require new measures and a greater effort from
all aviation producers---including airport operators---in order to
achieve a continuing improvement in the level of aviation safety. The
use of SMS at airports can contribute to this effort by increasing the
likelihood that airport operators will detect and correct safety
problems before those problems result in an aircraft accident or
incident. In November 2005, the International Civil Aviation
Organization (ICAO) amended Annex 14, Volume I (Airport Design and
Operations) to require member States to have certificated international
airports establish an SMS. The FAA supports harmonization of
international standards, and has worked to make U.S. aviation safety
regulations consistent with ICAO standards and recommended practices.
The agency intends to implement the use of SMS at U.S. airports to meet
the intent of the ICAO standard in a way that complements existing
airport safety regulations in 14 CFR Part 139.

The following actions are being taken in conjunction with the
implementation of SMS at commercial airports in the United States:

*Rulemaking.* The FAA has opened a rulemaking project to consider a
formal requirement for SMS at certificated airports. In the United
States, about 570 airports are certificated under 14 CFR Part 139,
*Certification of Airports*. The agency anticipates issuing a notice of
proposed rulemaking (NPRM) for public comment in 2008. A decision on a
final rule will not be made until the agency has considered all of the
public and industry comments received on the NPRM. We will also take
into account the experience of airports that have already implemented an
SMS. In any decision to issue a final rule to have airport operators
implement SMS, the FAA would:

-   Consider the benefits and costs of the rule and tailor the rule to
    impose the minimum burden and costs necessary for effective
    implementation

-   Consider whether the requirement should apply to all certificated
    airports or only to airports above a certain activity level

-   Consider, for airports subject to an SMS requirement, how SMS
    program elements would apply to airports of different sizes and
    resource

-   Acknowledge the existing requirements of 14 CFR Part 139 and avoid
    duplication of safety programs

-   Consider the appropriate degree of FAA oversight of individual SMS
    plans by FAA airport certification safety inspectors

-   Review SMS training needs for FAA employees and airport operators

*Airport Improvement Program (AIP) grant eligibility.* The FAA has
determined that contract costs incurred for development of an initial
SMS at an airport are eligible for AIP planning grant funds.

*Additional guidance on SMS at airports.* If a regulation on SMS is
adopted the FAA will update the SMS Advisory Circular and issue
additional guidance as necessary for its implementation, including a
detailed checklist and possibly a model SMS plan document.

In addition, two projects have been approved for funding under the
Airport Cooperative Research Program (ACRP) administered by the
Transportation Research Board that will provide further guidance on SMS
implementation by airport operators. First, the Mitre Corporation has
received an ACRP grant to produce a white paper on SMS with a
description of its general benefits, the ICAO requirement, and how SMS
could be used at airports in the U.S. The white paper should be
published in May 2007. Second, ACRP has approved a grant project for
development of an SMS user guidebook for airport operators with detailed
practical guidance on the implementation of an airport SMS. Completion
of the project is expected by September 2008.

SMS will also be added to the agenda in the FAA's Airport Safety and
Operations Schools (ASOS), which is offered several times each year.

2.  **APPLICATION.** The material contained in this AC is applicable for
    use at all civil airports, when adapted to the size, activity level,
    staff level, and resources of each airport. A safety management
    system can be integrated into all aspects of airport operations,
    business and management practices. This includes consideration of
    work performed by all direct contractors.

3.  **COMMENTS OR SUGGESTIONS** for improvements to this AC should be
    sent to:

> Manager, Airport Safety and Operations Division
>
> Federal Aviation Administration
>
> ATTN: AAS-300
>
> 800 Independence Avenue, S.W.

Washington, DC 20591

4.  **COPIES OF THIS AC.** The Office of Airport Safety and Standards
    makes ACs available to the public through the Internet. These ACs
    may be found through the FAA home page (www.faa.gov). A printed copy
    of this AC and other ACs can be ordered from the U.S. Department of
    Transportation, Subsequent Distribution Office, Ardmore East
    Business Center, 3341 Q 75th Avenue, Landover, MD 20785.

![](media/image2.png){width="2.5034722222222223in"
height="0.5847222222222223in"}

DAVID L. BENNETT

Director of Airport Safety and Standards

**Intentionally left blank.**

TABLE OF CONTENTS

[Chapter 1: General Information 1](#__RefHeading___Toc160187678)

[1.1. PURPOSE. 1](#purpose.)

[1.2. Definitions. 1](#definitions.)

[1.3. Safety Culture. 2](#safety-culture.)

[Chapter 2: Elements of A Safety Management System
3](#elements-of-a-safety-management-system)

[2.1. General. 3](#general.)

[2.2. Safety Policy and Objectives. 3](#safety-policy-and-objectives.)

[2.2.1 Safety Policy. 3](#safety-policy.)

[2.2.2 Safety Objectives. 3](#safety-objectives.)

[2.3. Safety Risk Management 5](#safety-risk-management)

[2.4. Safety Assurance 6](#safety-assurance)

[2.5. Safety Promotion 7](#safety-promotion)

[Chapter 3: Safety Risk Management (SRM) 9](#safety-risk-management-srm)

[3.1. General. 9](#general.-1)

[3.2. SRM Background Information. 9](#srm-background-information.)

[3.3. The Five Phases of SRM. 9](#the-five-phases-of-srm.)

[Appendix 1: Example: Application of SRM to a Safety During Construction
Plan
15](#appendix-1-example-application-of-srm-to-a-safety-during-construction-plan)

**LIST OF FIGURES**

[Figure 2 - 1. SMS Lifecycle Overview 5](#__RefHeading___Toc160187695)

[Figure 3 - 1. Predictive Risk Matrix 12](#__RefHeading___Toc160187696)

**Intentionally left blank.**

# General Information {#general-information .Style-Heading-1-+-14-pt}

## PURPOSE.  {#purpose. .Style-Heading-2-+-Justified}

This chapter provides general guidelines for Safety Management Systems
(SMSs). The benefits of an SMS would apply to all activities at an
airport. However, any action by the FAA to amend 14 CFR Part 139 to
implement a requirement for an SMS would be limited to those areas
subject to 14 CFR Part 139 regulation. Accordingly, the following
general guidelines should not be taken as an indication of the content
or scope of a possible future FAA rule relating to SMS.

## Definitions.  {#definitions. .Style-Heading-2-+-Justified}

**Gap Analysis --** Identification of existing safety components,
compared to SMS program requirements. Gap analysis provides an airport
operator an initial SMS development plan and roadmap for compliance.

**Hazard --** Any existing or potential condition that can lead to
injury, illness, or death to people; damage to or loss of a system,
equipment, or property; or damage to the environment. A hazard is a
condition that is a prerequisite to an accident or incident.

**Risk Assessment --** Assessment of the system or component to compare
the achieved risk level with the tolerable risk level.

**Safety Assessment --** A systematic, comprehensive evaluation of an
implemented system.

**Safety assurance --** SMS process management functions that
systematically provide confidence that organizational products/services
meet or exceed safety requirements.

**Safety Management System (SMS) --** The formal, top-down business-like
approach to managing safety risk. It includes systematic procedures,
practices, and policies for the management of safety (including safety
risk management, safety policy, safety assurance, and safety promotion).

**Safety Policy --** Defines the fundamental approach to managing safety
that is to be adopted within an organization. Safety policy further
defines the organization's commitment to safety and overall safety
vision.

**Safety promotion --** A combination of safety culture, training, and
data sharing activities that supports the implementation and operation
of an SMS in an organization.

**Safety risk --** The composite of the likelihood (i.e., risk) of the
potential effect of a hazard, and predicted severity of that effect. As
an example, the possibility of an overshoot by an aircraft landing on an
icy runway would be considered a safety risk of the hazard. The hazard
is "icy runway" and the risk is "possibility of an overshoot."

**Safety risk control --** Anything that mitigates the safety risk of a
hazard. Safety risk controls necessary to mitigate an unacceptable risk
should be mandatory, measurable, and monitored for effectiveness.

**Safety Risk Management (SRM) --** A formal process within the SMS
composed of describing the system, identifying the hazards, assessing
the risk, analyzing the risk, and controlling the risk. The SRM process
is embedded in the operational system; is not a separate/distinct
process.

**Severity --** The consequence or impact of a hazard in terms of degree
of loss or harm.

**System(s) --** An integrated set of elements that are combined in an
operational or support environment to accomplish a defined objective.
These elements include people, hardware, software, firmware,
information, procedures, facilities, services and environment.

## Top Management -- The person or group of people who direct and control an organization. Sometimes it is also referred to as Senior Management. {#top-management-the-person-or-group-of-people-who-direct-and-control-an-organization.-sometimes-it-is-also-referred-to-as-senior-management. .Style-Heading-2-+-Justified .unnumbered}

## Safety Culture.  {#safety-culture. .Style-Heading-2-+-Justified}

Effective safety management requires more than establishing an
appropriate organizational structure and establishing rules and
procedures to be followed. It requires a commitment to safety on the
part of senior management. The attitudes, decisions and methods of
operation at the policy-making level demonstrate the priority given to
safety.

A key indicator of management's commitment to safety is the adequacy of
resources. Establishing a management structure, assigning responsibility
and accountability, and allocating appropriate resources must be
consistent with the organization's stated safety objectives.

In effective safety cultures, there are clear reporting lines, clearly
defined duties and well understood procedures. Personnel fully
understand their responsibilities and know what to report, to whom and
when. Senior management reviews not only the financial performance of
the organization but also its safety performance.

Safety culture, then, is both attitudinal and structural, relating to
individuals and organizations. It concerns the requirement to not only
perceive safety issues but also match them with appropriate action.
Safety culture relates to such intangibles as personal attitudes and the
style of the organization. It is therefore difficult to measure,
especially when the principal criterion for measuring safety is the
absence of accidents and incidents. Yet, personal attitudes and
corporate style enable or facilitate the unsafe acts and conditions that
are the precursors to accidents and incidents. Therefore, safety culture
may affect systems safety either negatively or positively.

# Elements of A Safety Management System {#elements-of-a-safety-management-system .Style-Heading-1-+-14-pt}

## General.  {#general. .Style-Heading-2-+-Justified}

Effective safety management requires a systems approach to the
development of safety policies, procedures and practices to allow the
organization to achieve its safety objectives. Similar to other
management functions, safety management requires planning, organizing,
communicating and providing direction.

A SMS provides a proactive, systematic, and integrated method of
managing safety for airport operators. Essential to a SMS are formal
safety risk management procedures that provide risk analysis and
assessment.

Generally accepted industry standards and International Civil Aviation
Organization (ICAO) guidance describe Safety Management Systems in terms
of four distinct elements. They include:

-   Safety Policy and Objectives

-   Safety Risk Management

-   Safety Assurance

-   Safety Promotion.

## Safety Policy and Objectives. {#safety-policy-and-objectives. .Style-Heading-2-+-Justified}

### **Safety Policy.** 

Management's commitment to safety should be formally expressed in a
statement of the organization's safety policy. This policy should
reflect the organization's safety philosophy and become the
establishment of the SMS. The safety policy outlines the methods and
processes that the organization will use to achieve desired safety
outcomes. A safety policy will be signed by Top Management and will
typically contain the following attributes:

-   The commitment of senior management to implement SMS

-   A commitment to continual safety improvement

-   The encouragement of employees to report safety issues without fear
    of reprisal

-   A commitment to provide the necessary safety resources

-   A commitment to make safety the highest priority

### **Safety Objectives.** 

SMS requires the support of senior management. SMS also requires that
Top Management in the organization, one with the authority to adequately
control resources, be assigned SMS responsibilities. In addition to
having a basic understanding of the SMS, effective decision-makers
understand how to use SMS outputs as inputs to the SMS lifecycle as
described in Figure 2‑1. Executives and managers also understand when
safety risk management is necessary, and when to elevate decisions and
the supporting information to a higher level. Some key elements of
accountability within an organization are:

-   The organization's policy concerning responsibility and
    accountability, including written guidance regarding the safety
    authorities and responsibilities of all key personnel assigned to
    the airport

-   Identification within the system of someone responsible for
    administration of the overall SMS. Often, that one responsible
    person will be the Safety Manager. This person reports to the
    highest level of management to assure appropriate consideration of
    all reports, recommendations, and issues

-   At larger airports, operations may support the Safety Manager being
    a full-time permanent employee and in some cases having a support
    staff*.* Some airports may have an existing risk management office
    that could substantially meet SMS safety management requirements

-   The responsibilities of the Safety Manager are clearly defined along
    with identified lines of communication within the organization

-   Depending on the size and complexity of the airport's operation, it
    may be useful to establish a safety committee. The safety committee
    acts as a source of expertise for the Safety Manager and is chaired
    by the Safety Manager

How an organization arranges its method of conducting business and
managing safety will influence its resilience to hazardous situations
and its ability to reduce risks. To ensure responsible safety
management, successful organizations follow a disciplined approach to
documentation and information management.

The process of formal documentation clarifies the relationship of the
SMS to other organizational functions and the integration of SMS
activities. Further, the documentation process defines how SMS
activities relate to the organization's operating policies. The contents
of this documentation may be in the form of safety reporting records,
surveys, hazard reporting forms, and risk analysis/mitigation processes.
It is important that the organization maintain a record of the measures
taken to fulfill the objectives of the SMS. These records may be
required in the event of a formal investigation of an accident or
serious incident and should be maintained in sufficient detail to ensure
traceability of all significant safety-related decisions.

**NOTE:** *The Airport SMS should be distributed as necessary to educate
and inform the airport staff. If the FAA adopts a rule to make a SMS
mandatory at some or all certificated airports, SMS documentation
related to 14 CFR Part 139 responsibilities would be incorporated into
the Airport Certification Manual (ACM) or added as an appendix. As an
appendix to the ACM, the Airport SMS, to the extent it relates to 14 CFR
Part 139, would be subject to the same document control measures as any
other part of the ACM.*

![](media/image3.wmf)

[]{#__RefHeading___Toc160187695 .anchor}Figure 2 - . SMS Lifecycle
Overview

## Safety Risk Management {#safety-risk-management .Style-Heading-2-+-Justified}

Safety Risk Management (SRM) is at the heart of any Safety Management
System. It is through the SRM process that an organization identifies
hazards, determines potential risks, and designs appropriate risk
mitigation strategies. Safety Risk Management is discussed in Chapter 3.

## Safety Assurance {#safety-assurance .Style-Heading-2-+-Justified}

Safety Assurance includes self-auditing, external auditing, and safety
oversight. Safety oversight can be achieved through auditing and
surveillance practices, given the diverse activities at commercial
airports. In addition to the airport operator's existing
responsibilities for self-inspection and correction of discrepancies
under 14 CFR Part 139, an effective airport SMS audit program should:

-   Develop identified safety performance indicators and targets

-   Monitor adherence to safety policy through self-auditing

-   Allocate adequate resources for safety oversight

-   Solicit input through a non-punitive safety reporting system

-   Systematically review all available feedback from daily
    self-inspections, assessments, reports, safety risk analysis, and
    safety audits

-   Communicate findings to staff and implement agreed-upon mitigation
    strategies (14 CFR Part 139 already requires this for actions
    covered by that regulation)

-   Promote integration of a systems approach to safety into the overall
    operation of the airport

A systems approach to safety management addresses significant hazards
and the possible risks these hazards may present to employees and the
public. Individuals responsible for developing the SMS program should
work with the persons that have direct responsibility for analyzing
hazards, identifying control measures derived from that analysis, and
ensuring those measures are effective. Similarly, individuals
responsible for operations should have direct responsibility for the
safety of those operations and should be given the resources to
implement the necessary controls.

Feedback is necessary to assess how well the SMS is working. This is
achieved through safety oversight, performance monitoring, and
continuous improvement processes.

The SMS should include a visible non-punitive safety reporting system
supported by management. The safety reporting system should permit
feedback from personnel regarding hazards and safety-related concerns.
The SMS should use this information to identify and address safety
deficiencies. The safety reporting system may also identify and correct
non-conformance to safety policy.

Safety auditing is a core safety management activity. Similar to
financial audits, safety audits provide a means for systematically
assessing how well the organization is meeting its safety objectives.
Top Management may choose to have an external agency audit the system
(e.g., by a consultant or another airport operator). The safety audit,
together with other safety oversight activities, provides feedback to
managers concerning the overall safety performance of the organization.

Safety performance monitoring validates the SMS, confirming the
organization's safety objectives. Through regular review and evaluation,
management can pursue continuous improvements in safety management and
may revise safety objectives to ensure that the SMS remains effective
and relevant to the organization's operation.

## Safety Promotion {#safety-promotion .Style-Heading-2-+-Justified}

Safety Promotion includes:

-   Training and education

```{=html}
<!-- -->
```
-   Safety communication

-   Safety competency and continuous improvement

The Safety Manager provides current information and training relating to
safety issues relevant to the specific operation of the airport. The
provision of appropriate training to all staff, regardless of their
level in the organization, is an indication of management's commitment
to an effective SMS. Safety training and education should consist of the
following:

-   A documented process to identify training requirements

```{=html}
<!-- -->
```
-   A validation process that measures the effectiveness of training

-   Initial (general safety) job-specific training

-   Recurrent safety training

-   Indoctrination/initial training incorporating SMS

-   Training that includes human factors and organizational factors

Training requirements and activities should be documented for each area
of activity within the organization. A training file should be developed
for each employee, including management, to assist in identifying and
tracking employee training requirements and verifying that the personnel
have received the planned training. Any training program should be
adapted to fit the needs and complexity of the airport in question. At
certificated airports this is already being done for training required
by 14 CFR Part 139.

The airport operator/safety manager should communicate safety goals and
procedures to all employees. The safety management system should be
visible in all aspects of the airport operation. Systems safety is a
good business practice and should be promoted accordingly. The safety
manager should communicate the health of the airport SMS program through
bulletins, briefings and training. The safety manager should ensure that
lessons learned from hazardous occurrence investigations and case
history or experiences, both internally and from other organizations,
are distributed widely. The communication should flow between the safety
manager to the organization. Systems safety improvement will occur most
efficiently if staff and employees are actively encouraged to identify
potential hazards and propose solutions. Some examples of organizational
communication are:

-   Safety seminars

```{=html}
<!-- -->
```
-   Safety letters, notices and bulletins

-   Safety lessons-learned

-   Bulletin boards, safety reporting drop boxes, and electronic
    reporting through web sites or email

-   A method to exchange safety-related information with other airport
    operators through regional offices or professional organizations

-   In the future, voluntary posting of safety-related information on an
    existing FAA web-based safety reporting system currently being used
    by air operators

As part of a continuous improvement process, the common element of many
quality programs, the evolution of systems safety is dependent upon the
SMS lifecycle. As hazards are identified, risks determined and mitigated
through corrective actions, system improvements through training and
revised policies and procedures, then follow-up begins the safety
process over again. The diagram in Figure 2‑1 gives a brief overview of
how the SMS lifecycle might look at a large airport using
tenant/operator safety committees.

# Safety Risk Management (SRM) {#safety-risk-management-srm .Style-Heading-1-+-14-pt}

## General. 

SRM is a fundamental component of SMS. To be truly effective a SMS must
have a formal risk assessment program that identifies and documents
hazards on the airport. An SMS:

-   determines associated risk(s)

```{=html}
<!-- -->
```
-   identifies the severity and probability of the occurring risk(s)

-   develops mitigation strategies as appropriate

-   applies, tracks, and monitors the mitigation strategy

-   assesses and modifies strategies as necessary

A hazard is a condition, object or activity with the potential for
causing damage, loss, or injury. A risk is the chance of loss or injury
measured in terms of severity and probability.

## SRM Background Information.

SRM is a systematic, explicit, and comprehensive approach for managing
safety risk at all levels throughout the airport. A comprehensive SMS
using SRM will develop layers of safety built upon the measures taken to
mitigate risk. These layers are examples of implemented protective
measures such as vehicle driver's training programs, marking and
lighting standards and reflective vests. An unsafe event can occur when
gaps occur in the system's protective layers. These gaps are not static
and may appear unexpectedly. In order for an incident or accident to
take place there is normally a succession of gaps in a system that will
line up and enable an event to occur.

## The Five Phases of SRM.

There are five phases to the SRM Process:

1.  Describe the system

2.  Identify the hazards

3.  Determine the risk

4.  Assess and analyze the risk

5.  Treat the risk (i.e., mitigate, monitor and track)

**Phase 1**: **Describe the system**. When considering the environment
of the airport system, consider all of the safety-related functions
already outlined in the ACM. The existing safety functions should steer
the focus of the risk management analysis and will assist in determining
potential mitigation strategies.

**Phase 2: Identify Hazards**. In this phase, hazards to the system
(i.e., operation, equipment, people, and procedures) are identified in a
systematic, disciplined way. There are many ways to do this, but all
require at least four elements:

-   Operational expertise

-   Training in SMS, and if possible, hazard analysis techniques

-   A simple, but well-defined, hazard analysis tool

-   Adequate documentation of the process

The hazard identification effort should mirror the management structure
and complexity of the airport in question. The airport manager at a
small airport could conduct it alone, while it may be conducted by a
committee or group at a larger airport. Regardless, the person or the
group will require sufficient operations expertise, safety experience,
and training to adequately conduct the assessment.

The hazard identification stage considers all the possible sources of
system failure. Depending on the nature and size of the system under
consideration, these should include:

-   The equipment (example: construction equipment on a movement
    surface)

```{=html}
<!-- -->
```
-   Operating environment (example: cold, night, low visibility)

-   Human element (example: shift work)

-   Operational procedures (example: staffing levels)

-   Maintenance procedures (example: nightly movement area inspections
    by airport electricians)

-   External services (example: ramp traffic by Fixed-Base Operator
    (FBO) or law enforcement vehicles)

**Phase 3**. **Determine the risk.** In this phase, each hazard in its
system context is identified to determine what risks exist, if any, that
may be related to the hazard. In this phase, there is no determination
of the severity or potential of the risk occurring. First, all potential
hazards are identified and documented. Next, the hazards are subjected
to an assessment of the possible severity and potential risk as
described in Phase 4.

In a very simple example, an airport may have identified the hazard of
Foreign Object Damage (FOD) on the ramp, with the associated risk of the
FOD being ingested into the engines of taxiing aircraft. That hazard and
the identified risk would be documented before moving to Phase 4, a
determination of the probability of that risk occurring, and the
severity if such an event were to occur.

**Phase 4**: **Assess and Analyze the Risk.** In this Phase, the airport
operator estimates the level of risk such as by using the predictive
risk matrix in Figure 3-1.

Risk is the composite of the predicted severity and likelihood of the
outcome or effect (harm) of the hazard in the worst credible system
state. In order to assess the risk of an accident or incident occurring,
severity and likelihood are first determined.

Severity is determined by the worst credible potential outcome. Less
severe effects may be considered in addition to this, but at a minimum,
the most severe effects are considered. Determination of severity is
independent of likelihood, and likelihood should not be considered when
determining severity. Over time, quantitative data may support or alter
the determinations of severity and probability, but the initial risk
determinations will most likely be qualitative in nature, based on
experience and judgment more than data.

The risk levels used in the matrix can be defined as:

-   **High risk** -- Unacceptable level of risk: The proposal cannot be
    implemented or the activity continued unless hazards are further
    mitigated so that risk is reduced to medium or low level. Tracking
    and management involvement are required, and management must approve
    any proposed mitigating controls. Catastrophic hazards that are
    caused by:

(1) single-point events or failures

(2) common-cause events or failures

(3) undetectable latent events in combination with single point or
    common cause events are considered high risk, even if extremely
    remote

-   **Medium risk** -- Acceptable level of risk: Minimum acceptable
    safety objective; the proposal may be implemented or the activity
    can continue, but tracking and management are required.

-   **Low risk** -- Target level of risk: Acceptable without restriction
    or limitation; the identified hazards are not required to be
    actively managed, but are documented.

Hazards are ranked according to the severity and the likelihood of their
risk, which is illustrated by where they fall on the risk matrix.
Hazards with high risk receive higher priority for treatment and
mitigation.

**NOTE:** *At U.S. airports, many of the airport operators' actions are
governed by standards issued by the FAA. The FAA would not expect an
airport operator to conduct an independent risk analysis of an action or
condition directed by a mandatory FAA standard or specification. Any
discretionary action or decision by the airport operator in the
application of the standards should still be analyzed.*

![](media/image4.wmf){width="4.466666666666667in" height="4.79375in"}

[]{#__RefHeading___Toc160187696 .anchor}Figure 3 - . Predictive Risk
Matrix

**Phase 5**: **Treat the risk.** In this phase, the airport operator
develops options to mitigate the risk and alternative strategies for
managing a hazard's risk(s). These strategies can be used to reduce the
hazard's effects on the system. It should be noted that the majority of
risk management strategies address medium and high-risk hazards.
Low-risk hazards may be accepted after considering risk.

The risk management activity should identify feasible options to control
or mitigate risk. Some options could include:

-   Avoidance: selecting a different approach or not participating in,
    or allowing, the operation or procedure

```{=html}
<!-- -->
```
-   Assumption: accepting the likelihood, probability, and consequences
    associated with the risk

-   Control: development of options and alternatives that minimize or
    eliminate the risk

-   Transfer: shifting the risk to another area

Prior to operational use, a mitigation strategy is validated and
verified (as operational experience or data may support). Once
validated, verified, and accepted, it then becomes an existing element
of the system or operation.

Next, the effect of the proposed mitigation measure on the overall risk
is assessed. If necessary, the process is repeated until a measure or
combination of measures is found that reduces the risk to an acceptable
level.

When risk is determined to be unacceptable, it is necessary to identify
and evaluate risk mitigation measures by which the probability of
occurrence and/or the severity of the hazard could be reduced. When risk
mitigation strategies cross organizations, risk acceptance and approval
from stakeholder organizations is necessary.

Risk mitigation may require a management decision to approve, fund,
schedule, and implement one or more risk mitigation strategies. The
objective of this phase is to implement appropriate and cost-effective
risk mitigation plans to mitigate hazards. Appropriate risk mitigation
strategies are developed, documented, selected, and implemented. Hazard
tracking is the core of this risk management phase. Each medium and
high-risk hazard is tracked until its risk is mitigated to an acceptable
level and the effectiveness of the controls mitigating the risk is
verified. The hazard record is kept for the lifecycle of the system
change.

When assessing risk using a group or committee, remember that
interactions between safety-group participants with varying experience
and knowledge tend to lead to broader, more comprehensive, and more
balanced consideration of safety issues than if an individual conducts
the assessment. Thus, if possible, group analysis by appropriate subject
matter experts, is recommended.

Utilization of safety risk management increases the level of safety in
airport operations, maintenance, and new systems. Through SRM, hazards
are assessed, mitigated, documented, tracked, and operational data are
continuously monitored to provide feedback on hazards. Understanding the
consequences of risk increases the ability to anticipate and control the
impacts of internal and/or external events on a program.

Accountability is the foundation of an effective SMS. By accepting the
safety risk mitigation strategy, the appropriate management official is
certifying acceptance and accountability.

**Applying the Concept of SRM:** Appendix 1 provides an example of how
Safety Risk Management could be applied to enhance safety during
airfield construction.

**Intentionally left blank.**

#  {#section .Style-Heading-1-+-14-pt .unnumbered}

# Appendix 1: Example: Application of SRM to a Safety During Construction Plan {#appendix-1-example-application-of-srm-to-a-safety-during-construction-plan .Style-Heading-1-+-14-pt .unnumbered}

**NOTE:** *Because of the many variables within the development of a
construction plan this case will focus on only one hazard and risk
example.*

XYZ Airport has two runways and is planning to install drainage near the
approach end of the secondary runway. Construction vehicles must cross
the primary runway to gain access to the construction site. Because
there are numerous operations during the day, a decision is made to do
work at night during lighter traffic. The Airport Safety Manager
understands a need to develop a plan for night construction to avoid
interruption of day operations. It is clear that there are many
challenges in developing such a plan.

To begin formulating the plan, the Airport Safety Manager consults with
a designated Construction Safety Committee and follows the guidance
outlined in the FAA Advisory Circular 150/5370-2, *Operational Safety on
Airports During Construction*. One area of concern found during this
process was the movement of construction vehicles to and from the work
site in a way that would avoid runway incursions. In evaluating this
process, the committee decides to follow the concept of systems safety
and apply SRM to evaluate their decisions.

**Phase 1. Describe the System:**

-   Runway environment during construction at night, including a high
    volume of construction vehicle traffic between the ramp and the
    construction site

-   Existing driver training program and the use of escorts for
    construction vehicles

-   Air Traffic Control Tower, but no radio communications with
    construction vehicles, which are not radio-equipped

-   Signs, markings and lighting for the taxiways, runways, and
    construction area

**Phase 2. Identify the Hazards:**

-   Construction vehicles crossing primary runway

**Phase 3. Determine the Risk:**

-   Aircraft hitting a construction vehicle on the primary runway

**Phase 4. Assess and Analyze the Risk:**

-   Using the Predictive Risk Matrix, it is the opinion of the committee
    there is a *remote* chance a construction vehicle will deviate from
    prescribed guidelines and cross the primary runway without an
    escort. There are night air carrier operations at the airport, so
    there is a remote chance that an aircraft would conflict with a
    crossing vehicle. The likelihood that a construction vehicle crossed
    the runway and caused an aircraft accident is therefore *remote* or
    *extremely improbable*, but the committee understands that the
    severity of such an incident could be *catastrophic*

-   The committee agrees that the proposed means of getting construction
    vehicles to the construction site is unacceptable and must be
    mitigated

**Phase 5. Treat the Risk:**

-   The committee decides to *control* the risk by using an existing
    airport perimeter road to gain access to the construction site. All
    construction vehicles will then be escorted on the perimeter road.
    Use of the perimeter road may delay construction vehicles due to
    driving distance but it's in the best interest of safety

-   The committee documents this decision process for future follow-up
    with the Airport Safety Manager