1/8 /15 8900.1 CHG 37 4

1 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using **VOLUME 17 SAFETY MANAGEMENT SY**  **STEM**

**CHAPTER 1 GENERAL**  **Section 1 Safe**  **ty Management System**

**– Overview**  **17 -**  **1 -**  **1 -**  **1 GENERAL**  **. A.**  **Purpose .**  This volume provides guidance for Federal Aviation Administration (FAA) Flight Standards Service (AFS) personnel on the a cceptance and continued oversight of Title 14 of the Code of Federal Regulations ( 14 CFR) part 121 certificate holders’ Safety Management Sy stem s (SMS) as required by 14 CFR part 5, § 5.1( a). **1)** This volume does not p rovide guidance on the approval of part 121 certificate holders’ SMS implementation plan s, as required by § 5.1(b) and (c). **2)** Implementation plan approval is the subject of Notice 8900. 281 , Safety Management S ys tems (SMS)

– Approval of Part 121 Certificate H olders’ SMS Implementation Plans. **3)** Advisory

Circular (AC) 120
- 92 , Safety Management Sy stems for Aviation Service Providers, has been developed to provide additional guidance on how c ertificate h olders may comply with the requirements of part 5 . The information in the AC is considered to be an acceptable means of compliance with part 5. While it is not mandatory for certificate holders to use this AC, they

are encouraged to work with their Certificate Management Team (CMT) when developing and implementing their SMS. 1 **B. Scope**  **.** This chapter explains the background for an SMS and part 5 and how existing programs such as an Aviation Safety Action Program (ASAP) and Continuing Anal ys is and Surveillance Sy stem (CASS) can be integrated into a certificate holder’s SMS, and provides an overview of SMS implementation strategies. **C. Background.**  **1)** The International Civil Aviation Organization (I CAO), in its March 2006 Amendment No. 30 to Annex 6, Part I, International Commercial Air Transport

– Aeroplanes, establish ed an international standard requiring member states to mandate SMS implementation for commercial operators. 2

**2)** The Airline Safety and Federal Aviation Administration Extension Act of 2010 (Public L aw 111
- 216, August 1, 2010), directed the FAA to conduct rul emaking to “require all 14 CFR part 121 air carriers to implement a safety management s ys tem.” Part 5 requires certificate holders authorized to conduct operations under part 121 to develop and implement an
1 See Letter to George Braly from Rebecca MacPherson, Assistant Chief Counsel for Regulations (Nov. 24, 2010). The letter may be found at: http://www.faa.gov/about/office_org/headquarters_offices/agc/pol_adjudication/agc200/interpretations/data/interps/ 2010/bra ly%20
- %20(2010)%20legal%20interpretation.pdf
. 2 SMS requirements were later transferred to a new Annex 19, Safety Management , in July 2013.1/8 /15 8900.1 CHG 37 4

2 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using SMS by March 9, 2018. For its SMS to be considered implemented, a certificate holder must have SMS documentation (manuals, etc.) and resources (hardware, software, personnel, etc.) in place and ready to perform their intended functions.

**3)** Part 5 harmonizes U.S. requirements for air carriers operating unde r part 121 with ICAO SMS standards. 3 **D. SMS Fundamentals.**  **1) What is an SMS?**  SMSs can be a complex topic with many aspects to consider, but the defining characteristic of an SMS is that it is a decisionmaking s ys tem. An SMS does not have to be an extensive, expensive, or sophisticated array of techniques in order to do what it is supposed to do. Rather, an SMS is built by structuring safety management around four components: S afety P olicy , S afety Risk M anagement (SRM) , S afety A ssurance (SA) , and S afety P romotion. A brief description of these components is provided below.

a) Safety

Policy . S afety P olicy consists of setting objectives, assign ing responsibilities , and setting standards. It is also where management conveys its commitment to the safety performance of the organization to its employees. As SRM and SA processes are developed , the organization should come back to the safety policy to ensure that the commitments in the policy are being realized and that the standards are being upheld
.

b) SRM. The SRM component provides a decisionmaking process for identifying hazards and mitigating risk based on a thorough understanding of the organization’s systems and their operating environment. SRM includes decision making regarding management acceptance of risk to operations. The SRM component is the organization’s way of fulfilling its commitment to consider risk in their operations and to reduce it to as low a level as possible. In that sense, SRM is a design process , a way to incorporate risk controls into processes, products, and services or to redesign controls where existing ones are not meeting the organization’s needs.

c) SA. SA provides the organization with the necessary proces ses to give confidence that the sy stem s meet the organization’s safety objectives and that mitigations or risk controls developed under SRM are working. In SA , the goal is to watch what is going on and review what has happened to ensure that objectives are being met . Thus, SA requires monitoring and measuring safety performance of operational processes and continuously improving the level of safety performance. Strong SA and safety data anal ys is processes will yield information used to maintain the integrity of risk controls. SA processes are thus a means of ensuring the safety performance of the organization, keeping it on track, correcting it where necessary , and identifying needs for rethinking existing processes.

d) Safety

Promotion. The last component, S af ety P romotion, is designed to ensure that an organization’s employees have a solid foundation regarding their safety

3 ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data Analy sis (FDA) program as part of their SMS. Part 5 will not require these programs. However, operators desiring to implement a Flight Operational Quality Assurance (FOQA) ( FAA equivalent to FDA) program on a voluntary basis can obtain FAA approval for these pr ograms. For more information and a link to AC 120
- 82, go to: https://www.faa.gov/about/initiatives/atos/air_carrier/foqa/
.1/8 /15 8900.1 CHG 37 4

3 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using responsibilities, the organization’s safety policies and expectations, reporting procedures, and a familiarity with risk controls. Thus, training and communication are the two key areas of S afety P romotion. **2) Summary.**  An SMS does not have to be large, complex, or expensive in order to add value. If there are active involvement of the operational leaders, open lines of communication up and down the organization and among peers, vi g i l ance in looking for new operations, and assurance that employees know that safety is an essential part of their job performance , the organization will have an effective SMS that helps d ecision makers at all levels
. **E. C**  **onceptual O**  **verview of SRM**  **and SA.** 

**1) Graphical Overview of SRM and SA Processes**  **.** Figure 17
- 1 , Safety Management Decisionm aking Processes, provides an expanded view of the two key components of the SMS : SRM and SA . In the discussion that follows, we wi ll intro duce some key terms and concepts related to SMS processes. A more detailed discussion of the SRM and SA processes is set out in the current edition of Advisory Circular (AC) 120
- 92, Safety Management Sy stems for Aviation Service Providers, Chapter 3 , Safety M anagement Sy stem s (SMS) Components Explained
. Because safety management is a decisionmaking process, the SRM and SA processes follow a set of “ D ecision S teps ” outlined in Figure 1 7
- 1
. These D ecision S teps work as follows. The “ Description and Context ” step requires the user of the process to gain an overall understanding and context of the operation that is being or will be performed
. The “ Specific In formation ” step requires the user of the process to obtain information about aspects of the sy stems and environments involved that may present risk. Under the “ Anal ysis ” step, the user anal yz es or makes sense of that information. The “ Assessment ” step requires the user to make decisions regarding the acceptability or risk o f sy stem performance. Finall y, und er the “Action: Problem Resolution ” step, the user takes necessary action.1/8 /15 8900.1 CHG 37 4

4 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using **Figure 17**  **- 1.**  **Safety Management Decision m**  **aking Processes** 

**2) SRM.**  a) In SRM, the first step “ Sy stem Description (Analy sis)” is used to understand the aspects of the operation that might cause harm. In most cases, “Hazard Identification” flows from this sy stem anal ys is. Hazard identification requires an organization to ask: What hazards exist in the operational environment? What are the human factors issues of the operation ( e.g. , workload, distraction, fatigue, s ys tem complexity ) ? What are the limitations of the hardware, software, procedures, etc.?

b) While the diagram above shows a n ice flow from box to box, it should be evident that, in practice, processes flow seamlessly from one to the other through each element of the sy stem . For example, in a careful discussion of how a s ys tem currently works (sy stem description and analy sis), hazards will often become evident. Thus, the hazard identification step has also been at least partially accomplished. 

### SRM **SA Design**  **Performance**

Risk Assessment Sy stem Assessment Sy stem Description (Anal ys is) Sy stem Monitoring
Data Acquisition Hazard Id entification
Risk Analy sis Analy sis Of Data

Risk Control Corrective Action Description

and Context Specific In formation Analy sis

Assessment

Action: Problem Resolution 

### Decision **Steps**1/8 /15 8900.1 CHG 37 4

5 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using c) The “H azard I dentification ” process then progresses into a “Risk Analy sis” of the potential consequences of operation in the presence of the identified hazards. This culminates in an assessment of the acceptability of operating with these hazards ( Risk Assessment) or whether or not the risk o f such operations can be mitigated to an acceptable level ( Risk Control ). For this re ason, operational managers must be the persons who are accountable for these decisions. d) After a s ys tem has been designed or revised using the SRM process, special attention should be given to the new or revised s ys tem using the SA process. It should not be surprising to find at this time that there are still things that have not been considered or that there are changes over time in the operational environment, requiring a return to SRM. Thus the SRM and SA processes operate in a continuous exchange.

**3) SA and**  **Interactions with SRM.** a) In SA, the process continues with measuring and monitoring the performance of the sy stem operation ( Sy stem Monitoring) with the designed risk controls in place. This involves a variety of data sources. As in SRM, the data will need to be analyzed in order for it to be use ful in decision making ( Risk Anal ys is ) . In the case of SA, the decision making (S ys tem Assessment) can result in several paths
. If the data and anal ys is show that the sy stem and its risk controls are functioning as intended, the result is confirmatory : the management now can have confidence in sy stem safety performance. b) If this is not the case, the anal ys is needs to continue to determine if the shortfall is du e to the fact that the controls are not being used as intended (e.g. , required training not accomplished, procedures not followed, improper tools or equipment provided, etc.) or if, even though the s ys tem is being used as intended, it is not producing the expected results. Inthe former case, action should be taken to correct the problem (Corrective Action). In the latter case, the sy stem design should be reconsidered, using the path back to SRM.

c) The path back to SRM is a particularly important part of the SA process, especiall y for carriers who are transitioning into SMS s . Their operational systems likel y have not been built using an SRM process , so they may lack formal or well understood risk controls. The SA process covers the day
- to - day life of s ys tem op erations , so, in many cases, the determination to review existing processes for hazard and risk may be the first time that these aspects of operation have been considered.

d) As in SRM, managers who are responsible for operational processes are the persons wh o are also responsible for assuring that they are performing as intended from a safety, as well as operational , standpoint. Moreover, correct design, performance, and risk control need to be concern s of top management, including the accountable executive.1/8 /15 8900.1 CHG 37 4

6 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using **F. Interface Considerations.**  The following interfaces are available/appropriate during a certificate holder’s SMS development, implementation, and acceptance processes.

**1) Flight Standards National Field Office, AFS**  **- 900.**  a) Safety

Management Sy stem Program Office (SMSPO). The SMSPO is responsible within AFS for SMS policy and guidance development and maintenance. The SMSPO may

be contacted for advice on SMS policy and as a starting point to contact other FAA services and offices when their additional guidance and o ther expert opinion may be required. b) Implementation Support Team (IST). Part of the SMSPO, the IS T is the primary interface between the SMSPO and principal inspectors (PI), CMT personnel, field offices, and divisional SMS specialists. The I ST provides brie fings, orientation sessions, meetings, and/or seminars, as required. SMS IST members will provide guidance, facilitation, and suggestions on SMS issues to both the CMT and certificate holder. The IS T is expected to be available as a resource throughout the part 5 SMS implementation period
. SMSPO assistance can be obtained b y emailing the SMSPO National Coordinator at 9
-NATL
- SMS
- ProgramOffice@faa.gov
.

**2) Regional Points of Contact (RPOC)**  **.** Most FAA regional Flight Standards division (RFSD) offices have an SMS RP OC. RPOCs are part of the regional staff and, with the assistance of the SMSPO, stay abreast of the latest SMS developments and information. **3) CMT and the**  **Certificate H**  **older.** During SMS implementation, the CMT should periodicall y review the certificate holde r’s implementation progress and provide informal feedback . This c ommunication between the certificate holder and the CMT ensures that requirements in part 5 are addressed in a timely manner to allow course corrections during the implementation process
. **17 -**  **1 -**  **1 -**  **3 GENERAL CONSIDERATIONS DURING CERTIFICATE HOLDER’S SMS**  **IMPLEMENTATION. A.**  **Scalability.** Section 5.3(a), requires that “The SMS must be appropriate to the size, scope, and complexity

of the certificate holder’s operation ....” This means that resource commitm ent t o SMS by

different
- sized organizations may vary , as those organizations will find different way s to satisfy

the requirements of part 5. An SMS will include the parts of the organization that have direct impact on aviation safety, including operational line s of business (LOB) (flight operations, maintenance, cabin, cargo, etc.) as well as the organizational leadership (corporate, divisional, departmental, etc.). As the certificate holder develops and implements an SMS into its organization, it is necessary that part 5 requirements exist across all lines of business and leadership that have a direct effect on aviation safety . AC 120
- 92, Chapter 3, has additional discussion and examples of scalability for most part 5 requirements. **B. Oversight Considerations.**  **1) CMT**  **Oversight.** The CMT is responsible for certificate management of the certificate holder; therefore , the CMT manager will approve the certificate holder’s SMS implementation plan and ultimately accept their SMS as required b y part 5.1/8 /15 8900.1 CHG 37 4

7 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using **2) During SMS**  **I mplementati**  **on.** As an SMS cannot be a substitute for other regulations, the CMT will continue all of its normal oversight and certificate management duties. Once the certificate holder’s SMS implementation plan is approved, the certificate holder will follow that plan and begin to design, develop, modify , or align SMS processes to fit their business model and operational environment. Any changes to the plan will have to be submitted for and go through the FAA approval process.

**3) Evaluation of**  **C ompliance.**  CMT s will assess the certificate holder’s SMS implementation to include monitoring conformance to the plan ’ s schedule , evaluating needs for changes to the plan, and evaluation of compliance with part 5. Evaluation of the carrier ’ s SMS processes will utilize A ir Transportation Oversight Sy stem (ATOS ) 4 Safety Attribute Inspections ( SAI ) 8.1.1, 8.2.1, 8.3.1, and 8.4.1, National SMS Implementation Constructed Dy namic Observation Reports ( ConDOR) and Design Assessment Supplement (DAS) ConDOR s, per Volume 17 , Chapter 2, Section 1, paragraph 17
- 2
- 1
- 5, SMS Acceptance Tools.

**4) After the SMS is**  **I mplemented.**  Normal oversight will incorporate assessment of the certificate holder’s safety management design and performance per Volume 10, Air Transportation Oversight Sy stem. **17 -**  **1 -**  **1 -**  **5 INTEGRATION OF EXISTING PROGRAMS**  **.** Certificate holder s can voluntarily choose to integrate their existing programs into their SMS. However, they must ensure that those programs, as applied to the SMS, satisfy the requirements of part 5 or are revised as nec essary . Potential integration of existing programs is discussed in the part 5 preamble and examples are provided in AC 120
- 92, Chapter 5, Integrating Existing Safety Programs into the Safety Management S ys tem (SMS). **17 -**  **1 -**  **1 -**  **7 OVERVIEW OF CERTIFICATE HOLDER USING T**  **HE “PHASED” SMS IMPLEMENTATION STRATEGY**  **.** All part 121 certificate holders must submit their SMS implementation plan to the FAA for approval. While there is no structured regulatory requirement for the SMS implementation process itself , if a company elects to use a phased implementation process, they may refer to AC 120
- 92, Chapter 4, Implementation: Building a Safety Management Sy stem (SMS) , for advisory guidance. **17 -**  **1 -**  **1 -**  **9 REFERENCES AND JOB AIDS.**  **A. References.**  The CMT may find the following documents to be helpful in evaluating an SMS
. **1) FAA Documents (current editions)**  **:**

 AC 120
- 92, Safety Management Systems for Aviation Service Providers
.  In formation for Operators ( InFO ) 08022 , FAA Safety Management Sy stem (SMS) developments
- No. 1
.  Order 8000.368, Flight Standards Service Oversight
.  Order 8000.369, Safety Management S ys tem.
4 As ATOS is replaced by the Safety Assurance System (SAS), equivalent SAS tools and processes will be utilized in place of ATO S.1/8 /15 8900.1 CHG 37 4

8 UNCONTROLLED COPY WHEN DOWNL OADED Check with FSIMS to verify current version before using  Order FS 1100.1, Flight Standards Service Organizational Handbook
.  Order VS 8000.367, Aviation Safety (AVS) Safety

Management S ys tem Requirements.  Order VS 8000.370, Aviation Safety (AVS ) Safety

P olicy
. **2) International Publications**  **:**
 Annex 6 to the Convention on International Civil Aviation, International Commercial Air Transport

– Aeroplanes.  ICAO Document 9859, ICAO Safety Management Manual (SMM). **3) Additional Guidance.**  The following references may be of value to users of this document:

 AC 00
- 46 , Aviation Safety Reporting Sy stem.

 AC 00
- 58, Voluntary Disclosure Reporting Program.  AC 120
- 54, Advanced Qualification Program.  AC 120
- 59, Air Carrie r Internal Evaluation Program s .  AC 120
- 66, Aviation Safety Action Program (ASAP).  AC 120
- 79 , Developing and Implementing an Air Carrier Continuing An aly sis and Surveillance Sy stem .  AC 120
- 82, Flight Operational Quality Assurance (FOQA).  AC 120
- 90, Line Operations Safety Audit
. **B. Job**  **Aids .**  This task may require access to the following job aids:

 ATOS SMS SAIData Collection Tools (DCT) for Element 8.1.1, Safety P olicy (OPS/AW); Element 8.2.1 , Safety Risk Management (OPS/AW); Element 8.3.1 , Safety Assurance (OPS/AW); and Element 8.4.1 , S afety Promotion (OPS/AW).  The ATOS National SMS Implementation Constructed Dy namic Observation Report (ConDOR) DCTs.  The ATOS SMS DAS ConDOR and/or the SMS Performance Assessment Supplement (PAS ) ConDOR DCTs.  The Web
- Based Application Tool (WBAT), SMS Impl ementation Plan Manager Module.  Detailed Gap Anal ys is Tool for certificate holders in the Safety Management Sy stem Pilot Project (SMSPP) who have chosen to continue using the tool, their current implementation plan and Notice N 8900. 281 , Appendix A, Safety Management S ys tem Pilot Project Participant Bridging Tool , as their new implementation plan
.  Title 14 CFR Part 5 Gap Analy sis Tool for any certificate holder that chooses to use it for their part 5 implementation plan development
.  Notice N 8900. 281 , Appendix A, Safety Management Sy stem Pilot Project Participant Bridging Tool
. **17 -**  **1 -**  **1 -**  **11 through 17 -**  **1 -**  **1 -**  **25 RESERVED.**