1/8/15 8900.1 CHG 374

1

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

VOLUME 17 SAFETY MANAGEMENT SYSTEM

CHAPTER 1 GENERAL

Section 1 Safety Management System – Overview

17-1-1-1 GENERAL.

A. Purpose. This volume provides guidance for Federal Aviation Administration (FAA) 

Flight Standards Service (AFS) personnel on the acceptance and continued oversight of Title 14

of the Code of Federal Regulations (14 CFR) part 121 certificate holders’ Safety Management 

Systems (SMS) as required by 14 CFR part 5, § 5.1(a).

1) This volume does not provide guidance on the approval of part 121 certificate 

holders’ SMS implementation plans, as required by § 5.1(b) and (c).

2) Implementation plan approval is the subject of Notice 8900.281, Safety 

Management Systems (SMS) – Approval of Part 121 Certificate Holders’ SMS Implementation 

Plans.

3) Advisory Circular (AC) 120-92, Safety Management Systems for Aviation 

Service Providers, has been developed to provide additional guidance on how certificate holders 

may comply with the requirements of part 5. The information in the AC is considered to be an 

acceptable means of compliance with part 5. While it is not mandatory for certificate holders to 

use this AC, they are encouraged to work with their Certificate Management Team (CMT) when 

developing and implementing their SMS.1

B. Scope. This chapter explains the background for an SMS and part 5 and how existing 

programs such as an Aviation Safety Action Program (ASAP) and Continuing Analysis and 

Surveillance System (CASS) can be integrated into a certificate holder’s SMS, and provides an 

overview of SMS implementation strategies.

C. Background.

1) The International Civil Aviation Organization (ICAO), in its March 2006 

Amendment No. 30 to Annex 6, Part I, International Commercial Air Transport – Aeroplanes, 

established an international standard requiring member states to mandate SMS implementation 

for commercial operators.2

2) The Airline Safety and Federal Aviation Administration Extension Act of 2010 

(Public Law 111-216, August 1, 2010), directed the FAA to conduct rulemaking to “require all 

14 CFR part 121 air carriers to implement a safety management system.” Part 5 requires 

certificate holders authorized to conduct operations under part 121 to develop and implement an 

 

1

See Letter to George Braly from Rebecca MacPherson, Assistant Chief Counsel for Regulations (Nov. 24, 2010). 

The letter may be found at: 

http://www.faa.gov/about/office_org/headquarters_offices/agc/pol_adjudication/agc200/interpretations/data/interps/

2010/braly%20-%20(2010)%20legal%20interpretation.pdf.

2

SMS requirements were later transferred to a new Annex 19, Safety Management, in July 2013.
1/8/15 8900.1 CHG 374

2

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

SMS by March 9, 2018. For its SMS to be considered implemented, a certificate holder must 

have SMS documentation (manuals, etc.) and resources (hardware, software, personnel, etc.) in 

place and ready to perform their intended functions.

3) Part 5 harmonizes U.S. requirements for air carriers operating under part 121 with 

ICAO SMS standards.3

D. SMS Fundamentals.

1) What is an SMS? SMSs can be a complex topic with many aspects to consider, 

but the defining characteristic of an SMS is that it is a decisionmaking system. An SMS does not 

have to be an extensive, expensive, or sophisticated array of techniques in order to do what it is 

supposed to do. Rather, an SMS is built by structuring safety management around four 

components: Safety Policy, Safety Risk Management (SRM), Safety Assurance (SA), and 

Safety Promotion. A brief description of these components is provided below.

a) Safety Policy. Safety Policy consists of setting objectives, assigning

responsibilities, and setting standards. It is also where management conveys its commitment to 

the safety performance of the organization to its employees. As SRM and SA processes are 

developed, the organization should come back to the safety policy to ensure that the 

commitments in the policy are being realized and that the standards are being upheld.

b) SRM. The SRM component provides a decisionmaking process for identifying 

hazards and mitigating risk based on a thorough understanding of the organization’s systems and 

their operating environment. SRM includes decision making regarding management acceptance 

of risk to operations. The SRM component is the organization’s way of fulfilling its commitment 

to consider risk in their operations and to reduce it to as low a level as possible. In that sense, 

SRM is a design process, a way to incorporate risk controls into processes, products, and services 

or to redesign controls where existing ones are not meeting the organization’s needs.

c) SA. SA provides the organization with the necessary processes to give 

confidence that the systems meet the organization’s safety objectives and that mitigations or risk 

controls developed under SRM are working. In SA, the goal is to watch what is going on and 

review what has happened to ensure that objectives are being met. Thus, SA requires monitoring 

and measuring safety performance of operational processes and continuously improving the level 

of safety performance. Strong SA and safety data analysis processes will yield information used 

to maintain the integrity of risk controls. SA processes are thus a means of ensuring the safety

performance of the organization, keeping it on track, correcting it where necessary, and 

identifying needs for rethinking existing processes.

d) Safety Promotion. The last component, Safety Promotion, is designed to 

ensure that an organization’s employees have a solid foundation regarding their safety 

 

3

ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data 

Analysis (FDA) program as part of their SMS. Part 5 will not require these programs. However, operators desiring 

to implement a Flight Operational Quality Assurance (FOQA) (FAA equivalent to FDA) program on a voluntary 

basis can obtain FAA approval for these programs. For more information and a link to AC 120-82, go to: 

https://www.faa.gov/about/initiatives/atos/air_carrier/foqa/.
1/8/15 8900.1 CHG 374

3

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

responsibilities, the organization’s safety policies and expectations, reporting procedures, and a 

familiarity with risk controls. Thus, training and communication are the two key areas of Safety 

Promotion.

2) Summary. An SMS does not have to be large, complex, or expensive in order to 

add value. If there are active involvement of the operational leaders, open lines of 

communication up and down the organization and among peers, vigilance in looking for new 

operations, and assurance that employees know that safety is an essential part of their job 

performance, the organization will have an effective SMS that helps decision makers at all 

levels.

E. Conceptual Overview of SRM and SA.

1) Graphical Overview of SRM and SA Processes. Figure 17-1, Safety 

Management Decisionmaking Processes, provides an expanded view of the two key components

of the SMS: SRM and SA. In the discussion that follows, we will introduce some key terms and 

concepts related to SMS processes. A more detailed discussion of the SRM and SA processes is 

set out in the current edition of Advisory Circular (AC) 120-92, Safety Management Systems for 

Aviation Service Providers, Chapter 3, Safety Management Systems (SMS) Components 

Explained. Because safety management is a decisionmaking process, the SRM and SA processes 

follow a set of “Decision Steps” outlined in Figure 17-1. These Decision Steps work as follows.

The “Description and Context” step requires the user of the process to gain an overall 

understanding and context of the operation that is being or will be performed. The “Specific 

Information” step requires the user of the process to obtain information about aspects of the 

systems and environments involved that may present risk. Under the “Analysis” step, the user 

analyzes or makes sense of that information. The “Assessment” step requires the user to make 

decisions regarding the acceptability or risk of system performance. Finally, under the “Action: 

Problem Resolution” step, the user takes necessary action.
1/8/15 8900.1 CHG 374

4

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

Figure 17-1. Safety Management Decisionmaking Processes

2) SRM.

a) In SRM, the first step “System Description (Analysis)” is used to understand 

the aspects of the operation that might cause harm. In most cases, “Hazard Identification” flows 

from this system analysis. Hazard identification requires an organization to ask: What hazards 

exist in the operational environment? What are the human factors issues of the operation 

(e.g., workload, distraction, fatigue, system complexity)? What are the limitations of the 

hardware, software, procedures, etc.?

b) While the diagram above shows a nice flow from box to box, it should be 

evident that, in practice, processes flow seamlessly from one to the other through each element 

of the system. For example, in a careful discussion of how a system currently works (system 

description and analysis), hazards will often become evident. Thus, the hazard identification step 

has also been at least partially accomplished.

SRM SA

Design Performance

Risk

Assessment

System

Assessment

System

Description

(Analysis)

System

Monitoring

Data

Acquisition

Hazard

Identification

Risk

Analysis

Analysis

Of

Data

Risk

Control

Corrective

Action

Description

and Context

Specific

Information

Analysis

Assessment

Action: Problem

Resolution

Decision 

Steps
1/8/15 8900.1 CHG 374

5

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

c) The “Hazard Identification” process then progresses into a “Risk Analysis” of 

the potential consequences of operation in the presence of the identified hazards. This culminates 

in an assessment of the acceptability of operating with these hazards (Risk Assessment) or 

whether or not the risk of such operations can be mitigated to an acceptable level (Risk Control).

For this reason, operational managers must be the persons who are accountable for these 

decisions.

d) After a system has been designed or revised using the SRM process, special 

attention should be given to the new or revised system using the SA process. It should not be

surprising to find at this time that there are still things that have not been considered or that there 

are changes over time in the operational environment, requiring a return to SRM. Thus the SRM 

and SA processes operate in a continuous exchange.

3) SA and Interactions with SRM.

a) In SA, the process continues with measuring and monitoring the performance 

of the system operation (System Monitoring) with the designed risk controls in place. This 

involves a variety of data sources. As in SRM, the data will need to be analyzed in order for it to 

be useful in decision making (Risk Analysis). In the case of SA, the decision making (System 

Assessment) can result in several paths. If the data and analysis show that the system and its risk 

controls are functioning as intended, the result is confirmatory: the management now can have 

confidence in system safety performance.

b) If this is not the case, the analysis needs to continue to determine if the 

shortfall is due to the fact that the controls are not being used as intended (e.g., required training 

not accomplished, procedures not followed, improper tools or equipment provided, etc.) or if, 

even though the system is being used as intended, it is not producing the expected results. In the 

former case, action should be taken to correct the problem (Corrective Action). In the latter case, 

the system design should be reconsidered, using the path back to SRM.

c) The path back to SRM is a particularly important part of the SA process, 

especially for carriers who are transitioning into SMSs. Their operational systems likely have not 

been built using an SRM process, so they may lack formal or well understood risk controls. The 

SA process covers the day-to-day life of system operations, so, in many cases, the determination 

to review existing processes for hazard and risk may be the first time that these aspects of 

operation have been considered.

d) As in SRM, managers who are responsible for operational processes are the 

persons who are also responsible for assuring that they are performing as intended from a safety, 

as well as operational, standpoint. Moreover, correct design, performance, and risk control need 

to be concerns of top management, including the accountable executive.
1/8/15 8900.1 CHG 374

6

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

F. Interface Considerations. The following interfaces are available/appropriate during 

a certificate holder’s SMS development, implementation, and acceptance processes.

1) Flight Standards National Field Office, AFS-900.

a) Safety Management System Program Office (SMSPO). The SMSPO is 

responsible within AFS for SMS policy and guidance development and maintenance. The 

SMSPO may be contacted for advice on SMS policy and as a starting point to contact other FAA 

services and offices when their additional guidance and other expert opinion may be required.

b) Implementation Support Team (IST). Part of the SMSPO, the IST is the 

primary interface between the SMSPO and principal inspectors (PI), CMT personnel, field 

offices, and divisional SMS specialists. The IST provides briefings, orientation sessions, 

meetings, and/or seminars, as required. SMS IST members will provide guidance, facilitation, 

and suggestions on SMS issues to both the CMT and certificate holder. The IST is expected to be 

available as a resource throughout the part 5 SMS implementation period. SMSPO assistance can 

be obtained by emailing the SMSPO National Coordinator at

9-NATL-SMS-ProgramOffice@faa.gov.

2) Regional Points of Contact (RPOC). Most FAA regional Flight Standards 

division (RFSD) offices have an SMS RPOC. RPOCs are part of the regional staff and, with the 

assistance of the SMSPO, stay abreast of the latest SMS developments and information.

3) CMT and the Certificate Holder. During SMS implementation, the CMT should 

periodically review the certificate holder’s implementation progress and provide informal 

feedback. This communication between the certificate holder and the CMT ensures that 

requirements in part 5 are addressed in a timely manner to allow course corrections during the 

implementation process.

17-1-1-3 GENERAL CONSIDERATIONS DURING CERTIFICATE HOLDER’S SMS 

IMPLEMENTATION.

A. Scalability. Section 5.3(a), requires that “The SMS must be appropriate to the size, 

scope, and complexity of the certificate holder’s operation....” This means that resource 

commitment to SMS by different-sized organizations may vary, as those organizations will find 

different ways to satisfy the requirements of part 5. An SMS will include the parts of the 

organization that have direct impact on aviation safety, including operational lines of business 

(LOB) (flight operations, maintenance, cabin, cargo, etc.) as well as the organizational leadership 

(corporate, divisional, departmental, etc.). As the certificate holder develops and implements an 

SMS into its organization, it is necessary that part 5 requirements exist across all lines of 

business and leadership that have a direct effect on aviation safety. AC 120-92, Chapter 3, has 

additional discussion and examples of scalability for most part 5 requirements.

B. Oversight Considerations.

1) CMT Oversight. The CMT is responsible for certificate management of the 

certificate holder; therefore, the CMT manager will approve the certificate holder’s SMS 

implementation plan and ultimately accept their SMS as required by part 5.
1/8/15 8900.1 CHG 374

7

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

2) During SMS Implementation. As an SMS cannot be a substitute for other 

regulations, the CMT will continue all of its normal oversight and certificate management duties. 

Once the certificate holder’s SMS implementation plan is approved, the certificate holder will 

follow that plan and begin to design, develop, modify, or align SMS processes to fit their 

business model and operational environment. Any changes to the plan will have to be submitted 

for and go through the FAA approval process.

3) Evaluation of Compliance. CMTs will assess the certificate holder’s SMS 

implementation to include monitoring conformance to the plan’s schedule, evaluating needs for 

changes to the plan, and evaluation of compliance with part 5. Evaluation of the carrier’s SMS 

processes will utilize Air Transportation Oversight System (ATOS)

4

Safety Attribute Inspections 

(SAI) 8.1.1, 8.2.1, 8.3.1, and 8.4.1, National SMS Implementation Constructed Dynamic 

Observation Reports (ConDOR) and Design Assessment Supplement (DAS) ConDORs, per 

Volume 17, Chapter 2, Section 1, paragraph 17-2-1-5, SMS Acceptance Tools.

4) After the SMS is Implemented. Normal oversight will incorporate assessment of 

the certificate holder’s safety management design and performance per Volume 10, Air 

Transportation Oversight System.

17-1-1-5 INTEGRATION OF EXISTING PROGRAMS. Certificate holders can voluntarily

choose to integrate their existing programs into their SMS. However, they must ensure that those 

programs, as applied to the SMS, satisfy the requirements of part 5 or are revised as necessary. 

Potential integration of existing programs is discussed in the part 5 preamble and examples are 

provided in AC 120-92, Chapter 5, Integrating Existing Safety Programs into the Safety 

Management System (SMS).

17-1-1-7 OVERVIEW OF CERTIFICATE HOLDER USING THE “PHASED” SMS 

IMPLEMENTATION STRATEGY. All part 121 certificate holders must submit their SMS 

implementation plan to the FAA for approval. While there is no structured regulatory

requirement for the SMS implementation process itself, if a company elects to use a phased 

implementation process, they may refer to AC 120-92, Chapter 4, Implementation: Building a 

Safety Management System (SMS), for advisory guidance.

17-1-1-9 REFERENCES AND JOB AIDS.

A. References. The CMT may find the following documents to be helpful in evaluating 

an SMS.

1) FAA Documents (current editions):

 AC 120-92, Safety Management Systems for Aviation Service Providers.

 Information for Operators (InFO) 08022, FAA Safety Management System 

(SMS) developments- No. 1.

 Order 8000.368, Flight Standards Service Oversight.

 Order 8000.369, Safety Management System.

 

4

As ATOS is replaced by the Safety Assurance System (SAS), equivalent SAS tools and processes will be utilized in place of ATOS.
1/8/15 8900.1 CHG 374

8

UNCONTROLLED COPY WHEN DOWNLOADED

Check with FSIMS to verify current version before using

 Order FS 1100.1, Flight Standards Service Organizational Handbook.

 Order VS 8000.367, Aviation Safety (AVS) Safety Management System 

Requirements.

 Order VS 8000.370, Aviation Safety (AVS) Safety Policy.

2) International Publications:

 Annex 6 to the Convention on International Civil Aviation, International 

Commercial Air Transport – Aeroplanes.

 ICAO Document 9859, ICAO Safety Management Manual (SMM).

3) Additional Guidance. The following references may be of value to users of this 

document:

 AC 00-46, Aviation Safety Reporting System.

 AC 00-58, Voluntary Disclosure Reporting Program.

 AC 120-54, Advanced Qualification Program.

 AC 120-59, Air Carrier Internal Evaluation Programs.

 AC 120-66, Aviation Safety Action Program (ASAP).

 AC 120-79, Developing and Implementing an Air Carrier Continuing 

Analysis and Surveillance System.

 AC 120-82, Flight Operational Quality Assurance (FOQA).

 AC 120-90, Line Operations Safety Audit.

B. Job Aids. This task may require access to the following job aids:

 ATOS SMS SAI Data Collection Tools (DCT) for Element 8.1.1, Safety Policy

(OPS/AW); Element 8.2.1, Safety Risk Management (OPS/AW); Element 8.3.1,

Safety Assurance (OPS/AW); and Element 8.4.1, Safety Promotion (OPS/AW).

 The ATOS National SMS Implementation Constructed Dynamic Observation 

Report (ConDOR) DCTs.

 The ATOS SMS DAS ConDOR and/or the SMS Performance Assessment 

Supplement (PAS) ConDOR DCTs.

 The Web-Based Application Tool (WBAT), SMS Implementation Plan Manager 

Module.

 Detailed Gap Analysis Tool for certificate holders in the Safety Management 

System Pilot Project (SMSPP) who have chosen to continue using the tool, their 

current implementation plan and Notice N 8900.281, Appendix A, Safety

Management System Pilot Project Participant Bridging Tool, as their new 

implementation plan.

 Title 14 CFR Part 5 Gap Analysis Tool for any certificate holder that chooses to 

use it for their part 5 implementation plan development.

 Notice N 8900.281, Appendix A, Safety Management System Pilot Project 

Participant Bridging Tool.

17-1-1-11 through 17-1-1-25 RESERVED.