U.S. Department of Transportation

Federal Aviation
Administration 

# Advisory
Circular

Subject: Safety Management Systems for
Aviation Service Providers Date: 1/8/15
Initiated by: AFS-900 AC No: 120-92B
Change:

This advisory circular (AC) provides information for Title 14 of the Code of Federal Regulations (14 CFR) part 121 air carriers that are require d to implement Safety Management Systems (SMS) based on 14 CFR part 5. Sp ecifically, this document provide s a description of regulatory requirements, guidance, and methods of devel oping and implementing an SMS. This AC may also be used by other aviation service providers interested in voluntarily developing an SMS based on the requirements in part 5.

An SMS is an organization-wide comprehensive and preventive approach to managing safety. An SMS includes a safety policy, formal method s for identifying hazards and mitigating risk, and promotion of a positive safety culture. An SMS also provides assurance of the overall safety performance of your organization. An SMS is intended to be designed and developed by your own people and should be integrated into your existing operations and business decisionmaking processes. The SMS will assist your organi zation’s leadership, management teams, and employees in making effective and informed safety decisions.

Part 5 specifies a basic set of processes inte gral to an effective SMS but does not specify particular methods for implementing these proce sses. In other words, the regulation defines “what” must be accomplished, not “how” it must be accomplished. This AC provides additional guidance on how the SMS may be developed to achieve the safety performance objectives outlined by your organization. As is demonstrat ed by this AC, there is no one-size-fits-all method for complying with the requirements of part 5. This design is intentional, in that the Federal Aviation Administration (FAA) expects each air carrier to develop an SMS that works for its unique operation. Thus, this AC provide s guidance regarding designing and implementing acceptable methods of compliance with the requirem ents of part 5. These methods, however, are not the only means of compliance.

John S. Duncan Director, Flight Standards Service1/8/15 AC 120

- 92B

CONTENTS Paragraph Page

CHAPTER 1. INTRODUCT ION

1

- 1. Purpose

................................ ................................ ................................ .............................. 1

1

- 2. Applicability

................................ ................................ ................................ ..................... 1

1

- 3. Scalability

................................ ................................ ................................ ......................... 2

1

- 4. Contact Information

................................ ................................ ................................ .......... 2

CHAPTER 2. SAFETY MANAGEMENT SY STEM (SMS) FOUNDATIO NS

2

- 1. Safety Culture and Safety Management

. ................................ ................................ .......... 3

2

- 2. SMS Fundamentals

................................ ................................ ................................ ........... 4

2

- 3. Conceptual Overview of SRM and SA

................................ ................................ ............. 5

2

- 4. Definitions

................................ ................................ ................................ ......................... 7

CHAPTER 3. SAFETY MANAGEMENT SY STEM (SMS) COMPONENT S EXPLAINED

3

- 1. Overview of the Structure of Chapter 3

................................ ................................ ............ 9

3

- 2. Subpart A : General

................................ ................................ ................................ ......... 10

3

- 3. Subpart B : Safety Policy

................................ ................................ ................................ . 12

3

- 4. Subpart C : Safety Risk Management

................................ ................................ .............. 17

3

- 5. Subpart D : Safety Assurance

................................ ................................ .......................... 2 9

3

- 6. Subpart E : Safety Promotion

................................ ................................ .......................... 4 2

3

- 7. Subpart F : SMS Documentation and Recordkeeping

................................ ..................... 4 5

CHAPTER 4: IMPLEMENT ATION: BUILDING A SAFETY MANAGEMENT

SYSTEM (SMS)

4

- 1. Process Overview

................................ ................................ ................................ ............ 4 9

4

- 2. Mapping and Analyzing Your Organization

................................ ................................ ... 50

4

- 3. Conducting a Gap Analysis

................................ ................................ ............................ 50

4

- 4. Preparing an Implementation Plan

................................ ................................ .................. 51

4

- 5. Phased SMS Implementation Strategy

................................ ................................ ............ 52

CHAPTER 5: INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY MANAGEMENT SYSTEM (S MS)

5

- 1. Purpose of this Chapter

................................ ................................ ................................ ... 5 7

5

- 2. Discussion of Individual Programs

................................ ................................ ................. 5 7

Page iii1/8/15 AC 120

- 92B

Paragraph Page

APPENDIX 1. SMS CROSS REFERENCE FOR TRANSITIONING SMS PILOT

PROJECT PARTICIPANTS (2 pages)

................................ ............................. 1

APPENDIX 2. SAFETY RISK MANAGEMENT (SRM) WORKSHEETS (8 pages)

........... 1

APPENDIX 3. SAMPLE SAFETY POLICY STATEMENT (2 pages)

................................ ... 1

APPENDIX 4. IDENTIFYING THE ACCOUNTABLE EXECUTIVE (2 pages)

................. 1

APPENDIX 5. SAMPLE GAP ANALYSIS AND IMPLEMENTATION PLAN

EXCERPTS (2 pages)

................................ ................................ ......................... 1

APPENDIX 6. REFERENCES AND ADDITIONAL INFORMATION (2 pages)

................ 1

LIST OF FIGURES

Figure 2

- 1. Safety Management Decisionmaking Processes

................................ ......................... 6 Figure 3

- 1

. Safety Risk Management Processes and Regulatory Requirements

......................... 18 Figure 3

- 2

. Sample Risk Matrix

................................ ................................ ................................ .. 2 6 Figure 3

- 3

. Safety Assurance Processes and Regulatory Requirements

................................ ..... 30 Figure 4

- 1. Recommended Safety Management System Implementation Levels

....................... 5 3 Figure 4

- 2. Safety Management System Development

................................ ............................... 54

Page iv1/8/15 AC 120-92B

CHAPTER 1. INTRODUCTION

1-1. PURPOSE.

a. General. This advisory circular (AC) provides information to assist Title 14 of the Code of Federal Regulations (14 CFR) part 121 certificate holders in developing a Safety Management System (SMS). It provides guidance material that aligns with the requirements, structure, and format of 14 CFR part 5, Safety Management Systems for Certificate Holders Operating under Part 121. It describes an acceptable means, but not the only means, to implement and maintain an SMS. Because complying with part 5 satisfies the SMS Standards of the International Civil Aviation Organization (ICAO), as published in ICAO Annex 19 for operations covered under Annex 6 Part I, the material in this AC is also consistent with those

ICAO standards. 1

b. Integration. An SMS is not meant to be a separate system built alongside or on top of your other business systems. An SMS should be integrated into your existing business structure. A properly integrated SMS fosters a fundamental and sustainable change in how you view and analyze data and information, how you make informed decisions, and how you develop new operational and business methods. SMSs are necessary to comply with part 5, but they are not substitutes for compliance with other Federal regulations. However, SMS s can assist service providers in meeting other regulatory requirements.

c. Scalability. The SMS requirements of 14 CFR part 5 are applicable to a wide variety of types and sizes of operators. Therefore, those requirements are designed to be scalable, allowin g operators to integrate safety management practices into their unique business models. An SMS should be tailored to each specific operator; therefore, this AC cannot provide a single means of compliance that applies to all certificate holders who are requ ired to develop and implement

an SMS.

1-2. APPLICABILITY.

a. This AC Applies to Part 121 Certificate Holders. This AC applies to businesses that are considering applying for, have applied for, or hold a part 121 certificate. Part 5, § 5.1 requires
a part 121 certi ficate holder to have an SMS that meets the requirements of part 5 and that is acceptable to the Administrator of the Federal Aviation Administration (FAA). Various methods of compliance may be accepted by the Administrator. The methods offered in this AC are not the only means of compliance with part 5; however, these have been found to be acceptable to

the FAA . Your SMS implementation plan is the mechanism used to evaluate your method

toward compliance.

1 ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data Analysis (FDA) program as part of their SMS. Part 5 will not require these programs. However, operators desiring to implement a Flight Operational Quality Assurance (FOQA, FAA equivalent to FDA) program on a voluntary basis can obtain FAA approval for these programs. For more information and a link to AC 120

- 82, go to https://www.faa.gov/about/initiatives/atos/air_carrier/foqa/

.

Par 1-1 Page 11/8/15 AC 120

- 92B

b. If You Hold a Certificate Other Than Part 121 or are Not Certificated. This AC may also be helpful if you hold a certificate other than part 121 or are not certificated because this AC can be used to voluntarily develop and implement an SMS.

c. If You are Applying for a Part 121 Certificate. For a discussion o f new applicants, refer to Chapter 4, subparagraph 4

- 1b.

1

- 3. SCALABILITY. The difference between a large, medium, and small organization ’ s SMS

is primarily one of size and complexity of the operations to be covered, volume of data available,

the size of the em ployee workforce, and the resources needed to manage the organization. The SMS requirements ( s afety p olicy, Safety Risk Management (SRM), Safety Assurance (SA), and

s afety p romotion) are the same regardless of the size of your organization. However, part 5 allows organizations of different sizes to meet those requirements in different ways. The SMS functions do not need to be extensive or complex to be effective. All businesses, regardless of size, may use existing systems, programs and resources to documen t and track safety issues to

resolution.

1

- 4. CONTACT INFORMATION. For additional information or suggestions, please contact the Flight Standards Service National Field Office (AFS

- 900) at

9

- NATL

- SMS

- ProgramOffice@faa.gov

.

Par 1

- 2 Page 21/8/15 AC 120

- 92B

CHAPTER 2. SAFETY MANAGEMENT SY STEM (SMS) FOUNDATIO NS

2

- 1. SAFETY CULTURE AND SAFETY MANAGEMENT. One key aspect that is essential to safety performance is the culture of the organization. “ Safety c ulture” is the term that we apply to those aspects of the organization’s culture that relate to s afety p erformance. The concept

of s afety c ulture underlies safety management and is the basis for the SMS requirements of

Title 14 of the Code of Feder al Regulations (14 CFR) part 5. 2

a. Interdependence. Because the culture of an organization includes the deeply ingrained and automatic psychological and behavioral aspect of human performance, there is a strong

correlation between s afety c ulture and accident prevention. Therefore, s afety c ulture and SMS are interdependent. Management’s constant attention, commitment, and visible leadership are essential to guiding an organization toward a positive s afety p erformance.

b. Safety Culture. C ulture s are the product o f the values and actions of the organization’s leadership as well as the result s of organizational learning. Cultures are not really “created” or “implemented ; ” they emerge over time and as a result of experience. Organizations cannot simply purchase a sof tware program, produce a set of posters filled with buzzwords, require their people to attend an hour of slide presentations, and instantly install an effective SMS. As with the development of any skill, it takes time, practice and repetition, the appropri ate attitude,

a cohesive approach, and constant coaching from involved mentors.

c. Management Framework. It is for this reason that a management framework that facilitates decisionmaking and shapes the environment in which employees work is crucial to organizational performance in all aspects of the organization’ s business, including safety.

A safety culture matures as safety management skills are learned and practiced and become second nature across the entire organization. The following have been found to be characteristics of organizations that consistently achieve safe results.

(1) Open Reporting. Policies an d processes that foster open reporting while, at the same time, stressing the need for continuous diligence and professionalism. The organization should encourage disclosure of error without fear of reprisal, yet it should also demand accountability on the part of employees and management alike.

(2) Just Culture. The organization should engage in identification of systemic errors, implement preventative corrective action, and exhibit intolerance of undesirable behaviors such as recklessness or willful disregard for established procedures. This is often referred to as

a “just culture.”

(3) Personnel Involvement. Involvement of line personnel and all levels of
management in functions dealing with aviation safety , including the accountable executive, is

critical to eff ective safety management throughout an organization.

2 While the concepts discussed in this section underlie the requirements of part 5, they are included solely for background purposes. The actual regulatory require ments of part 5 are discussed in Chapter 3.

Par 2

- 1 Page 31/8/15 AC 120

- 92B

(4) Use of Information. Effective use of all safety information assures informed management decisionmaking.

(5) Commitment to Risk Reduction. The organization expects direct management involvement in identifying hazards and managing risk.

(6) Vigilance. Processes that provide vigilance of ongoing operations and the environment to ensure effectiveness of risk controls and awareness of emerging hazards.

(7) Flexibility. Using information effectively to adjust and change to reduce risk, and

a willingness to commit resources to making changes necessary to reduce risk.

(8) Learning. The organization learns from its own failures and from those of allied and similar businesses. The organization actually uses acquired data to feed an alysis processes, the results of which yield information that can be acted upon to improve safety.

d. Management Involvement. Management leadership should demonstrate their visible commitment to and involvement in safe operation perform ing their daily work. S MS processes do not have to be expensive or sophisticated; however, active personal involvement of operational leaders is essential. Safety management must be accomplished by those managers who “own” the processes in which risk resides. Safety cultures als o cannot be “created” or “implemented” by management decree, no matter how sincere their intentions . Every organization has a safety culture

. I t is embodied in the way the organization and its members approach safety in their jobs. If positive aspects of c ulture are to emerge, the organization’s management must set up the policies and processes that create a working environment that fosters safe behavior. That is the purpose of the SMS processes.

2

- 2. SMS FUNDAMENTALS.

a. What I s an SMS? SMSs can be a complex topic with many aspects to consider, but the defining characteristic of an SMS is that it is a decisionmaking system. An SMS does not have to be an extensive, expens ive, or sophisticated array of techniques to do what it is supposed to do. Rather, an SMS is built by structuring your safety management around four components: s afety

p olicy, s afety r isk m anagement (SRM), s afety a ssurance (SA), and s afety p romotion. A brief description of these components is provided below.

b. Safety Policy. Safety p olicy is where you set objectives, assign responsibilities, and set standards. It is also where management conveys its commitment to the safety performance of the organization to its employees. As SRM and SA processes are developed, you will come back to

the s afety p olicy to ensure that the commitments in the p olicy are being realized and the standards are being upheld.

c. Safety Risk Management ( SRM )

. The SRM component provides a decisionmaking process for identifying hazards and mitigating risk based on a thorough understanding of the organization’s systems and their operating environment. SRM includes decisionmaking regarding management acceptance of risk to operations. The SRM c omponent is the organization’s way of fulfilling its commitment to consider risk in their operations and to reduce it to an acceptable level. In that sense, SRM is a design process, a way to incorporate risk

Par 2

- 1 Page 41/8/15 AC 120-92B

controls into processes, products, and services or to redesign controls where existing ones are not meeting the organization’s needs.

d. Safety Assurance ( SA ). SA provides you with the necessary processes to give you confidence that your system is meeting your organization’s safety objectives and that your mitigations, or risk controls, developed under SRM are working. In SA, your goal is to watch what is going on and review what has happened to ensure that your objectives are being met. Thus, SA requires monitoring and measuring safety performance of operational processes and continuously improving the level of safety performance. Strong SA processes will yield information used to maintain the integrity of risk controls. SA processes are thus a means of assuring the safety performance of the organization, keeping it on track, correcting it where necessary, and identifying needs for rethinking existing processes.

e. Safety Promotion. The last component, s afety promotion, is designed to ensure that your employees have a solid foundation regarding their safety responsibilities, the organization’s safety policies and expectations, reporting procedures, and a familiarity with risk controls. Thus, training and communi cation are the two key areas of s afety promotion.

f. Summary. An SMS does not have to be large, complex, or expensive in order to add value. If you have active involvement of the operational leaders, maintain open lines of communication up and down the organization and among peers, stay vigilant in looking for new operations, and ensure that your employees know that safety is an essential part of their job performance, you will have an effective SMS that helps you make better safety management

decisions.

2-3. CONCEPTUAL OVERVIEW OF SRM AND SA.

a. Graphical Overview of SRM and SA Processes. Figure 2

- 1, Safety Management Decisionmaking Processes, provides an expanded view of the principal two sets of processes of the SMS: SRM and SA. In the discussion that follows, we’ll introduce some key terms and concepts related to SMS processes. A more detailed discussion of the SRM and SA processes is set out in Chapter 3, Safety Management System (SMS) Components Explained. Because safety management is a decisionmaking process, the SRM and SA processes follow a set of processes outlined in Figure 2-1. These processes work as follows. The Description and Context step requires the user of the process to gain an overall understanding and context of the operation that

either is being or will be performed. The Specific Information step requires the user of the process to obtain information about aspects of the systems and environments involved that may present risk. Under the Analysis step, the user analyzes or makes sense of that information. The Assessment step requires the user to make decisions regarding the acceptability or risk of system performance. Finally, under the Resolution step, the user takes necessary action.

Par 2-2 Page 51/8/15 AC 120-92B

FIGURE 2- 1. SAFETY MANAGEMENT DECISION MAKING PROCESSES.

b. SRM.

(1) In SRM, the first step, System Description (Analysis) , is used to understand the aspects of the operation that might cause harm. In most cases, Hazard Identification flows from this system analysis. Hazard identification requires you to ask: What hazards exist in the operational environment? What are the human factors issues of the operation (e.g., workload, distraction, fatigue, or system complexity)? What are the limitations of the hardware, software,

proc edures, etc.?

(2) While the diagram above depicts that processes as distinctly defined components, in practice they flow from one to the other. For example, in a careful discussion of how a system currently works (S ystem D escription (Analysis)), hazards will o ften become evident. Thus, the hazard identification step has also been at least partially accomplished.

Par 2-3 Page 61/8/15 AC 120

- 92B

(3) The process then progresses into a n a nalysis of the potential consequences of operation in the presence of the identified hazards ( Risk Analysis ) . This culminates in an assessment of the acceptability of operating with these hazards, Risk Assessment, or whether or not the risk of such operations can be mitigated to an acceptable level, Risk Control. For this reason, operational managers must be the ones who are accountable for these decisions.

(4) After a system has been designed or revised using the SRM process, special attention should be given to the new or revised system using the SA process. It should not be surprising to find at this time that there are still things that might not have been considered or that there are changes over time in the operational environment, requiring a return to SRM. Thus, the SRM and SA processes operate in a continuous exchange.

c. SA and Interactions with SRM.

(1) In SA, the proce ss continues with measuring and monitoring the performance of the
system operation, System Monitoring, with the designed risk con trols in place. This involves

a variety of data sources (Data Acquisition) that will be further explained in Chapter 3. As in SRM, the data will need to be analyzed in order for it to be used in decisionmaking, Analysis of Data. In the case of SA, the decisionmaking can result in several paths, System Assessment. If the data and analysis say that the system and its risk controls are functioning as intended, the result is confirmatory: the management now can have confidence in system safety performance.

(2) If this is not the case, the analysis needs to continue to determine if the shortfall is due to the fact that the controls are not being used as intended (e.g., required training not accomplished, procedures not followed, org improper tools or equipment provided), or if, even though the system is being used as intended, it is not producing the expected results. In the former case, action should be taken to correct the problem, Corrective Action. In the latter case, the system design should be reconsidered using the path back to the SRM process

.

(3) The path back to SRM is a par ticularly important part of the SA process, especially for carriers who are transitioning into SMS. Their operational systems have likely not been built using an SRM process, so they may lack formal or well understood risk controls. The SA process

covers t he day

- to

- day life of system operations, so, in many cases, the determination to review existing processes for hazard and risk may be the first time that these aspects of operation have

been considered.

(4) As in SRM, managers who are responsible for operational processes are the ones who are also responsible for assuring that they are performing as intended from a safety, as well as operational, standpoint. Moreover, correct design, performance, and risk con trol need to be

a concern of top management, including the accountable executive.

2

- 4. DEFINITIONS.

a. Hazard. A condition that could foreseeably cause or contribute to an aircraft accident

as defined in Title 49 of the Code of Federal Regulations (49 CFR) part 83 0, § 830.2.

b. Risk. The composite of predicted severity and likeliho od of the potential effect of

a hazard.

Par 2

- 3 Page 71/8/15 AC 120

- 92B

c. Risk Control. A means to reduce or eliminate the effects of hazards.

d. Safety Assurance (SA). Processes within the SMS that function systematically to

e nsure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.

e. Safety Management System (SMS). The formal, top

- down, organiza tion

- wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.

f. Safety Objective. A measurable goal or desirable outcome relate d to safety.

g. Safety Performance. Realized or actual safety accomplishment relative to the organization’s safety objectives.

h. Safety Policy. The certificate holder’s documented commitment to safety, which defines its safety objectives and the accountabilitie s and responsibilities of its employees in regard to safety.

i. Safety Promotion. A combination of training and communication of safety information to support the implementation and operation of an SMS in an organization.

j. Safety Risk Management (SRM). A process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk.

Par 2

- 4 Page 81/8/15 AC 120

- 92B

CHAPTER 3. SAFETY MANAGEMENT SY STEM (SMS) COMPONENT S EXPLAINED

3

- 1. OVERVIEW OF THE STRUCTURE OF CHAPTER 3. SMS requirements are organized around building blocks of safety management. These processes are essential for

an SMS. This chapter contains short descriptions of each SMS component and the processes

contained therein. After the title of each process are the following.

a. Specific Regulatory Requirement (SRR). The SRR for the process (where it may be

found in Title 14 of the Code of Federal Regulations (14 CFR) part 5).

b. Related Regulatory Requirements. Where applicable, to help put part 5 in conte xt of existing regulations and provide reference for interrelated requirements within part 5, e.g., requirements for management accountability related to a process.

c. Tracking Tags. 3 A reference to International Civil Aviation Organization (ICAO) / former Safe ty Management System Pilot Project (SMSPP)

- Component/Element tags. These do not denote legal requirements; they are provided solely as reference to facilitate

cross

- referencing and gap analysis on the part of SMSPP participants to assist them in revising their plans and systems to comply with part 5. The Federal Aviation Administration (FAA) emphasizes that fully complying with part 5 satisfies almost all 4 of the pertinent ICAO SMS requirements.

d. A Summary. A brief plain language overview of the process.

e. A n Objective. A brief explanation of the goal of the process.

f. A Regulatory Text Box. A copy of part 5 regulatory text, for reference, which should facilitate readers’ ability to relate regulatory requirements with explanations without the need to

cross

- refe rence additional documents.

g. A Discussion. A more detailed plain language explanation of the process as it relates to the SMS. It includes some examples, when appropriate, and offers optional R ecommended

D esign C haracteristics.

h. Scalability. A short discussion, where applicable, of scalability, providing examples of

how different

- sized carriers can meet the pertinent SMS requirements. Information on scalability

is broken down into small, medium, and large carriers. Small carriers are generall y defined as those carriers operating fewer than 10 airplanes; medium carriers are those with fewer than

48 airplanes; and large carriers are those with more than 48 airplanes.

3 These tags are included to assist carriers who originally developed their documentation in accordance with

AC 120

- 92A, Appendix 2, and for alignment with international standards. The items referenced as “compon ents” or

“elements” are also consistent with ICAO Annex 19, Appendix 2, the ICAO SMS Framework.

4 ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data Analysis (FDA) program as part of their SMS. Part 5 will not require these programs.

Par 3

- 1 Page 91/8/15 AC 120

- 92B

NOTE: The scalability discussions are for illustration only and impose neither requir ements nor resource allocation by a service provider.

3

- 2. SUBPART A : GENERAL.

a. Applicability: Requirements for Implementation.

(1) SRR. Part 5, § 5.1.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

(5) Discussion. The SMS required by this regulation is intended to cover only the aviation operational processes of the carrier. For example, the aviation operational processes in

a typical carrier may include:

• Flight operations,

• Operational control (dispatch/flight following),

• Maintenance and inspection,

• Cabin safety,

• Ground handling and servicing,

• Cargo handling, and

• Training.

NOTE: Information concerning implementation planning for 14 CFR
part 121 certificate holders and a pplicants for part 121 certificates is outlined in greater detail in Chapter 4 , Implementation: Building a Safety Management System (SMS)

.

b. General Requirements: Components of an SMS.

(1) SRR. Section 5.3(a).

(2) Related Regulatory Requirements. None. § 5.1 Applicability.

(a) A certificate holder under part 119 of this chapter authorized to conduct operations in accordance with

the requirements of part 121 of this chapter must have a Safety Management System that meets the requirements of this part and is acceptable to the Administrator by March 9, 2018

. (b) A certificate holder must submit an implementation plan to the FAA Administrator for review no later

than September 9, 2015

. The implementation plan must be approved no later than March 9, 2016

. (c) The implementation pl an may include any of the certificate holder ’ s existing programs, policies, or

procedures that it intends to use to meet the requirements of this part, including components of an existing

SMS.

Par 3

- 1 Page 101/8/15 AC 120

- 92B

(3) ICAO/SMSPP. N /A.

(4) Part 5 Requirements.

(5) Discussion. For a discussion on size, scope and complexity with regard t o SMS scalability, see paragraph 1

- 3 and the scalability examples in this chapter.

c. Recordkeeping Requirements.

(1) SRR. Section 5.3(b).

(2) Related Regulatory Requirements. Section 5.95.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

(5) Discussion. Documentation and recordkeeping requirements are in part 5, subpart F.

d. Compliance with Code of Federal Regulations (CFR).

(1) SRR. Section 5.3(c).

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements. § 5.3 General requirements.

(a) Any certificate holder required to have an SMS under this part must submit the Safety Management

System to the Administrator for acceptance. The SMS must be appropriate to the size, scope, and complexity of the certificate holder’s operation and include at least the following components: (1) Safety policy in accordance with the requirements of subpart B of this part; (2) Safety risk management in accordance with the requirements of subpart C of this part; (3) Safety assurance in accordance with the requirements of subpart D of this part; and (4) Safety promotion in accordance with the requirements of subpart E of this part.

§ 5.3 General requirements.

(b) The Safety Management System must be maintained in accordance with the recordkeeping requirements

in subpart F of this part.

§ 5.3 General requirements.

(c) The Safety Management System must ensure compliance with the relevant regulatory standards in chapter I

of Title 14 of the Code of Federal Regulations.

Par 3

- 2 Page 111/8/15 AC 120

- 92B

3

- 3. SUBPART B : SAFETY POLICY.

a. Introduction.

(1) SRR. Part 5, subpart B.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Summary. This section of the advisory circular (AC) provides guidance about how the accountable executive, in coordination with other senior managers, might define safety performance objectives, assign accountability, and allocate resources. The s afety p olicy should be appropri ate to the size, scope, and complexity of the operation. Additionally, the s afety p olicy component is where your management defines their commitment to managing safety throughout the organization.

b. Safety Policy.

(1) SRR. Section 5.21.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.1.

(4) Part 5 Requirements.

(5) Discussion. The s afety p olicy statement is a concise document from the accountable executive that conveys the organization’s basic commitments to s afety management. It provides

a basis for more detailed setting of objectives for planning and performance measurement, assignment of responsibility, and reporting, including clear statements regarding behavioral and performance expectations. The s afety p olicy may be supported by additio nal documents that expand in specific areas, and, where applicable, it may also set out procedures. An example of a § 5.21 Safety policy.

(a) The certificate holder must have a safety policy that includes at least the following:

(1) The safety objectives of the certificate holder. (2) A commitment of the certificate holder to fulfill the organization's safety objectives. (3) A clear statement about the provision of the necessary resources for the implementation of the

SMS. (4) A s afety reporting policy that defines requirements for employee reporting of safety hazards or

issues. (5) A policy that defines unacceptable behavior and conditions for disciplinary action. (6) An emergency response plan that provides for the safe transitio n from normal to emergency

operations in accord ance with the requirements of § 5.27. (b) The safety policy must be signed by the accountable executive described in § 5.25. (c) The safety policy must be documented and communicated throughout the certificate holder

organization. (d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains

relevant and appropriate to the certificate holder.

Par 3

- 3 Page 121/8/15 AC 120

- 92B

s afety p olicy statement can be found in Appendix 3, Sample Safety Policy Statement.

Section 5.21(a)(1) requires carriers to develop safety o bjectives as part of their s afety p olicy. The assessment process required by § 5.73 is where decisions are made regarding attainment of these objectives. In setting these objectives, this is a case where “starting with the end in sight” is

sound advice. Ob jectives can fall into a number of categories, including:

• Compliance with regulations. Compliance with all regulations is an expectation for all carriers and assurance of such compliance is an explicit requirement of the SMS (refer to § 5.3(b)).

• Milestones for implementation of safety

- related programs or initiatives.

• Reduction of error or incident rates.

• Tracking of safety events. Certain events such as ground damage, pilot deviations, weight and balance errors, or maintenance errors may be targets for

safe ty objectives and associated tracking and action. One caution with these types of measures is not to lose focus on risk factors that may be associated with potentially more serious events.

(6) Scalability. Safety p olicies would not be expected to vary between small, medium, and large organizations; however, the levels of management involved in preparation and implementation of the policy may vary.

(a) Small. The owner or most senior manager (the accountable exec utive) may personally perform this process. The policy can be a simple, often single

- page, written document, signed by the accountable executive. Small organizations typically operate in smaller networks of employees, so the policy may be posted in company work areas or included in company briefings or in training.

(b) Medium. The accountable executive, with the involvement of other senior managers, is likely to develop, publish, and communicate the s afety p olicy. The p olicy may be disseminated via company news letters, company Web sites, employee briefings, or existing indoctrination and recurrent training.

(c) Large. A large organization may require the accountable executive or other senior managers and technical staff to perform this process. While the regulations only require the accountable executive to sign the s afety p olicy, members of senior management may also sign the s afety p olicy. Large carriers may disseminate their policy using a variety of resources such as company Web sites, intranets, email, or existi ng indoctrination and recurrent training.

c. Safety, Accountability, and Authority.

(1) SRR. Section 5.23.

(2) Related Regulatory Requirements. Section 5.25 and 14 CFR part 119, § 119.65.

Par 3

- 3 Page 131/8/15 AC 120

- 92B

(3) ICAO/SMSPP. Element 1.2.

(4) Part 5 Requirements.

(5) Discussion. This SMS process requires defined accountability for achieving safety performance objectives within the organization’s s afety p olicy for the following individ uals:

NOTE: “ Accountability ” as used here, refers to active management and line employee involvement and action in managing and maintaining safety performance. A certificate holder defines accountability by ensuring that each of its management and line employees is aware of his or her specific role within SMS and actively participates in carrying out his or her SMS

- related duties. Once the accountabilities for these employees have been defined, Subpart D ( Safety Promotion ) requires that these accountabilities be

communicated t hroughout the organization.

(a) Accountable Executive. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are discussed in more detail in the discussion of § 5.25 below

.

(b) All Members of Management. Managers a re the individuals who are responsible for identifying hazards, conducting risk assessments, and developing risk controls for their areas of responsibility. They have the technical expertise and are the ones responsible for implementation and operation of risk controls (often in the form of operational procedures, specified tools, training, communication, etc.). A key element in your SRM process is to identify the levels of management with the authority to make risk decisions related to aviation safety

. Thu s, managers that have the authority to implement changes in systems and procedures must use the SMS processes in managing their area of operational responsibility. They are also responsible for assuring the continuing operational safety of risk controls. T hrough data collection methods and analytical processes in the SA component, managers are able to determine that risk controls are effective and that their safety performance is acceptable. For example, the D irector of M aintenance (DOM) is one of the manag ers accountable for SMS within his or her area of responsibility. § 5.23 Safety accountability and authority.

(a) The certificate holder must define accountability for safety within the organization ’ s safety policy for

the following individuals: (1) Accountable executive, as described in § 5.25. (2) All members of management in regard to developing, implementing, and maintaining SMS

processes within their area of responsibility, including, but not limited to: (i) Hazard identification and safety risk assessment. (ii) Assuring the effectiveness of safety risk controls. (iii) Promoting safety as requir ed in subpart E of this part. (iv) Advising the accountable executive on the performance of the SMS and on any need for

improvement. (3) Employees relative to the certificate holder’s safety performance. (b) The certificate holder must identify the levels of management with the authority to make decisions

regarding safety risk acceptance.

Par 3

- 3 Page 141/8/15 AC 120

- 92B

(c) Employees. All employees should be aware of the company’s safety policies, as well as the processes, procedures, and tools relevant to their responsibilities. They need to know

how the confi dential employee reporting system works. Employees have a duty and responsibility to follow an organization’s processes and procedures.

(6) Scalability. The method for meeting these requirements is not expected to vary greatly between different organizations. Rather, the numbers and relationships of personnel will be unique to each organization.

d. Designation and Responsibilities of Required Safety Management Personnel. This section of the regulation addresses two processes: (1) Designation and Responsibilities o f the Accountable Executive, and (2) D esignation and Responsibilities of Safety Management

Personnel.

(1) Designation and Responsibilities of the Accountable Executive.

(a) SRR. Sections 5.25(a) and (b).

(b) Relate d Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 1.3.

(d) Part 5 Requirements.

(e) Discussion.

1. Designation. Section 5.25(a) requires the organization to identify an already

existing person in the organization who holds the ultimate decisionmaking authority over the § 5.25 Designation and responsibilities of required safety management personnel.

(a) Designation of the accountable executive. The certificate holder must identify an accountable

executive who, irrespective of other functions, satisfies the following:

(1) Is the final authority over operations authorized to be conducted under the certificate

holder’s certificate(s). (2) Controls the financial resources required for the operations to be conducted under the

certificate holder’s certificate(s). (3) Controls the human resources required for the operations authorized to be conducted under

the certificate holder’s certifica te(s). (4) Retains ultimate responsibility for the safety performance of the operations conducted under

the certificate holder’s certificate. (b) Responsibilities of the accountable executive. The accountable executive must accomplish the

following:

(1) En sure that the SMS is properly implemented and performing in all areas of the certificate

holder’s organization. (2) Develop and sign the safety policy of the certificate holder. (3) Communicate the safety policy throughout the certificate holder ’ s organiza tion. (4) Regularly review the certificate holder's safety policy to ensure it remains relevant and

appropriate to the certificate holder. (5) Regularly review the safety performance of the certificate holder’s organization and direct

actions necessary to address substandard safety performance in accordance with § 5.75.

Par 3

- 3 Page 151/8/15 AC 120

- 92B

certif icate holder’s operations. This person is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financ ial , and other resources necessary for safe flight operations. A flowchart outlining a process for des ignating an accountable executive is available in Appendix 4, Identifying the Accountable Executive.

2. Responsibilities. As the ultimate authority in the organization, the accountable executive is responsible for the proper functioning of the SMS. This entai ls, among other things, keeping an open line of communication with the designated management personnel, providing sufficient resources for the SMS to function properly, and being actively involved in the SA component of SMS, discussed below

.

3. Scalability. In smaller organizations, the accountable executive may personally participate in or directly supervise operational processes. This individual may serve in multiple positions within the company. In larger organizations, the accountable executive is

respons ible for ensuring that management personnel are clearly designated for ensuring the safety of operational and safety management processes.

(2) Designation and Responsibilities of Required Safety Management Personnel.

(a) SRR. Section 5.25(c).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 1.3.

(d) Part 5 Requirements.

(e) Discussion. This section of the regulation requires the company to ensure that sufficient personnel are available to provide support for essential SMS functions, such as analysis, assistance to operational managers in meeting their safety management responsibilities, and acting as a safety advisor to the accountable executive. These responsibilities may be carried out as collateral duties by managers referred to in § 5 .23(a)(2), or the carrier could assign the tasks of supporting SMS functions to other personnel. For example some organizations may choose to use their existing required management personnel under § 119.65 to fulfill these responsibilities. Other organizat ions may organize a Safety Department with a number of persons or use existing personnel within each operational division. § 5.25 Designation and responsibilities of required safety management personnel.

(c) Designation of management personnel. The accountable executive must designate sufficient

management personnel who, on behalf of the accountable executive, must be responsible for the following: (1) Coordinate implementation, maintenance, and integration of the SMS throughout the

certificate holde r’s organization. (2) Facilitate hazard identification and safety risk analysis. (3) Monitor the effectiveness of safety risk controls. (4) Ensure safety promotion throughout your organization as required in subpart E of this part. (5) Regularly report to the accountable executive on the performance of the SMS and on any need

for improvement.

Pa r 3

- 3 Page 161/8/15 AC 120-92B

NOTE: The final rule preamble states: “Personnel designated to perform

this function must be in positions in the organization of sufficient independence to have direct access to the accountable executive to report on the safety performance of the operation and recommend and necessary improvements .”

e. Coordination of Emergency Response Planning.

(1) SRR. Section 5.27.

(2) Related Regulatory Requirements

. None.

(3) ICAO/SMSPP. Element 1.4.

(4) Part 5 Requirements.

(5 ) Discussion. The plan should provide procedures for management decisionmaking and action in an emergency. This should include a line of succession of management authority sufficient to respond to emergencies. Coordination of your emergency response plans with the

emer gency response plans of other organizations might include first responders to accidents or incidents, airport authorities, and hazardous material s (hazmat) authorities. The plan might also address how you return or transition to normal operations after the emergency condition subsides. Many organizations already have emergency response plans that may be used to fulfill this requirement.

3-4. SUBPART C : SAFETY RISK MANAGEMENT.

a. Introduction.

(1) SRR. Part 5, Subpart C.

(2) Related Regulatory Requirements. Section 5.23(a)(2).

(3) ICAO/SMSPP. Component 2.0.

(4) Summary. SRM is a formal system for identifying and mitigating risk. There are five processes necessary to control and mitigate risk. These p rocesses are featured in Figure 3-1, Safety Risk Management Processes and Regulatory Requirements, and are discussed in more

detail below. These are: § 5.27 Coordination of emergency response planning. Where emergency response procedures are necessary, the certificate holder must develop and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following:

(a) Delegation of emergency authority throughout the certificate holder’s organization; (b) Assignment of employee responsibilities during the emergency; and (c) Coordination of the certificate holder’s emergency response plans with the emergency response plans

of other organizations it must interface with during the provision of its services.

Par 3-3 Page 171/8/15 AC 120-92B

• System description and analysis.

• Hazard identification.

• Safety risk analysis.

• Safety risk assessment.

• Safety risk controls.

FIGURE 3- 1. SAFETY RISK MANAGEMENT PROCESSES AND REGULATORY REQUIREMENTS

b. A pplicability: Requirements to Apply SRM.

(1) SRR. Section 5.51.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Component 2.0.

(4) Objective. To determine situations where the SRM process must be applied. System Analysis (Design)

Hazard

Ident

Risk
Control

Risk

Assmt

Risk Analysis

Start **Inputs:** 5.51

• New System

• System Change

• New Operational Procedure

**Outputs:** To SA Subpart D **Inputs From SA:** 5.71(b) 5.53(a)&(b)

5.53(c)

5.55(b)

5.55(c) 5.55(a)

Evaluate
Controls 5.55(c)(1) 

## 5.53 System Analysis &

Hazard

Identification

5.55 Risk

Assessment
& Control 

# SRM

(Subpart c)

Par 3-4 Page 181/8/15 AC 120

- 92B

(5) Part 5 Requirements.

(6) Discussion.

(a) To know when SRM process may be required, it is important to know what

a system is. Systems could be people, hardware, software, information, procedures, facilities, services, and other support facets which are directly related to the organization’s aviation safety activities. Examples of broad

- based systems could includ e:

• Flight operations,

• Operational control (dispatch/flight following),

• Maintenance and inspection,

• Cabin safety,

• Ground handling and servicing,

• Cargo handling, and

• Training.

(b) Within these systems there are subsystems. Some examples of subsystems include crew scheduling systems, training curricula, maintenance control, deicing, fueling, aircraft fleet, ground operations, and hazmat training.

(c) Under § 5.51, the SRM process is triggered when proposed new sys tems or changes to systems are being considered. For example, changes to your operation could include the addition of new routes, opening or closing of line stations, adding or changing contractual arrangements for services, additions of new fleets or majo r modifications of existing fleets, addition of different types of operations such as Extended Operations (ETOPS)

, or any one of many different types of operations. The SRM process is not triggered solely by major changes to
a system ; it is triggered by an y revision of an existing system. However, the level of SRM documentation needed for smaller changes to a system may be significantly smaller than for major changes.

NOTE: It is not the intent of part 5 to require the application of SRM processes and procedures to activities that are not related to aviation operations

.

c. System Analysis and Hazard Identification. This section of the regulation addresses the following two processes: (1) System Description and Analysis, and (2) Hazard Identification. § 5.51 Applicabi lity A certificate holder must apply safety risk management to the following:

(a) Implementation of new systems. (b) Revision of existing systems. (c) Development of operational procedures. (d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D

of this part.

Par 3

- 4 Page 191/8/15 AC 120

- 92B

NOTE: Appendix 2, Safe ty Risk Management (SRM) Worksheets, contains

a set of worksheets that may be useful for conducting SRM.

(1) System Description and Analysis.

(a) SRR. Section 5.53(a) and (b).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 2.1/Process 2.1.1.

(d) Objective. To gain an understanding of the components and elements of operational systems, processes, procedures and the operational environment.

(e) Part 5 Requirements.

(f) Discussion. Systems analysis is the primary means of proactively identifying and addressing potential problems before the new or revised systems or procedures are put into place. The system analysis should explain the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify hazards and perform risk analyses. The process is started by describing the system (this can be as simple

as flowchart ing the system or writing a short narrative).

1. An example of system description and analysis might involve the need in your operations for a new aircraft (or fleet of aircraft) to meet your company or corporate goals. Several of your organizational “systems” would be affected: flight operations, maintenance, station, ground, etc. As part of your examination of the flight operations system, you would need to consider changes to pilot qualifica tions, pilot and mechanic training, scheduling, crew rest, union participation, and several other areas. This is a process normally done as part of your

business activities.

2. Your system analysis should identify and consider activities and resources

necessa ry for the system to function. For example, in the scenario of adding aircraft to your fleet, you would identify for the pilot training system, as one of the affected systems, the activities and resources necessary for pilot training to pilot the additiona l aircraft. The se may include simulators, training curriculum, training aids, and instructors. § 5.53 System analysis and hazard identification.

(a) When applying safety risk management, the certificate holder must analyze the system s

identified in § 5.51. Those safety analyses must be used to identify hazards under paragraph (c) of this section, and developing and implementing risk controls related to the system under § 5.55(c). (b) In conducting the system analysis, the following information must be considered:

(1) Function and purpose of the system. (2) The system ’ s operating environment. (3) An outline of the system ’ s processes and procedures. (4) The personnel, equipment, and facilities necessary for operation of the system.

Par 3

- 4 Page 201/8/15 AC 120

- 92B

3. The above example of adding aircraft to your fleet would entail consideration of several systems and a variety of procedures due to the number of processes that would be affected. However, in a simpler case, such as a change in the procedure for arming cabin doors prior to pushback, only those elements of the systems that would be affected by the change would need to be considered. The carrier would not be expecte d to perform a comprehensive analysis of the entire cabin safety system.

4. The system description and analysis process frequently includes representatives from management, safety staff, subject matter experts (SME), employees, and representation groups ( e.g.
, unions) formed into workgroups such as safety committees, safety roundtables, safety action groups, or similar titles. Since many

, if not most

, system changes involve allocation of resources, the accountable executive or other managers with the authority to commit resources should be included in the process.

5. The outputs could be recorded in a simple recording medium such as

a worksheet or a notebook, common desktop software, or a Web

- Based Application Tool (WBAT), ( see Appendix 6). Appendix 2 provides an example of a set of worksheets that could be used as paper records or converted to a variety of software applications, including desktop spreadsheets or WBAT s

.

(g) Scalability.

1. Small. System description and analysis could be performed by the owner/manager and/or another assigned employee(s). An analysis could consist of a discussion among managers such as the Director of Operations (DO) and/or Chief Pilot or other individuals designate d by them.

2. Medium. System description and analysis could be performed by a member of management or one of the designated SMS management representatives with a small workgroup of company SMEs and stakeho lders.

3. Large. System description and analysis might be performed at multiple organizational levels (e.g., corporate, division, or department) and facilitated by the Safety Department /division or its equivalent. The organization might have standing committe es of SMEs and stakeholders participating at various levels.

(2) Hazard Identification.

(a) SRRs. Section 5.53(c).

(b) Related Regulatory Requirements.

• Section 5.23(a)(2)(i): Accountabilities of members of management; and

• Section 5.25(c)(2): Responsibilities of safety management personnel.

(c) ICAO/SMSPP. Element 2.1/Process 2.1.2.

Par 3

- 4 Page 211/8/15 AC 120

- 92B

(d) Objective. To examine operational systems, operations, processes, and the operational environment in order to identify conditions that could result in an aircraft accident.

(e) Part 5 Requirements.

(f) Discussion. The hazard identification process flows from the system analysis. In hazard identification, you would ask: What could go wrong with your processes, under typical or abnormal operational conditions, that could cause an accident?

1. Most often the same individuals or groups conducting the system analysis process (sa fety committees, safety roundtables, etc.) would conduct hazard identification. You use your experience, FAA requirements, manufacturers’ technical data, and knowledge of your operations to identify hazards to your operation. For example, a newly modified component of

an aircraft cabin door might require new arming and disarming procedures by flight attendants and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. Hazards could include the effectiveness of new procedur e training, employees missing training, failing to read or understand newly published procedures, supervisors failing to monitor the new procedures, etc. While identification of every conceivable hazard is unlikely, you are expected to exercise due diligen ce in identifying hazards that could foreseeably lead to an aircraft accident.

2. The output of hazard identification could be recorded in a simple recording medium such as a spreadsheet or paper files, or software such as a WBAT.

(g) Scalability.

1. Small. Hazard identification could be performed by the owner/manager and/or another employee(s), often as part of the system analysis.

2. Medium. As in the system analysis, hazard identification could be performed by a member of management or a designated SMS m anagement representative with a small workgroup of company SMEs and stakeholders.

3. Large. Hazard identification might be performed at multipl e organizational levels (e.g., corporate, division, or department levels) and facilitated by a Safety Department /division or its equivalent. The organization might have standing committees of SMEs and stakeholders participating at various levels.

d. Safety Ri sk Analysis and Control. This section of the regulation addresses the following three processes: (1) Safety Risk Analysis, (2) Safety Risk Assessment, and (3) Safety

Risk Control

. § 5.53 System analysis and hazard identification.

(c) The certificate holder must develop and maintain processes to identify hazards within the

context of the system analysis.

Par 3

- 4 Page 221/8/15 AC 120

- 92B

(1) Safety Risk Analysis.

(a) SRRs. Section 5.55(a).

(b) Related Regulatory Requirements. Section 5.25(c)(2), Responsibilities of Safety Management Personnel.

(c) ICAO/SMSPP. Element 2.2/Process 2.2.1.

(d) Objective. To estimate the severity and likelihood of a potential accident due to exposure to an identified hazard.

(e) Part 5 Requirements.

(f) Discussion. For each identified hazard, define t he potential for injury and damage that may result from an accident related to operating while exposed to the hazard. In order to determine potential for injury and damage, you need to define the likelihood of occurrence of an accident and severity of the injury or damage that may result from the aircraft accident. It is important to remember that the likelihood and severity do not refer to the hazard but of a potential occurrence (accident or incident) related to the hazard.

1. The risk analysis also needs to consider the basis for the estimates of severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in combination, which could result in an accident? Have you changed equipment that your employees must use, the procedures fo r using it, the layout of the facility, etc., in ways that could increase the likelihood of errors resulting in an accident? For e xample, if, in the process of

a merger, flight deck procedures from one of the partner airlines become the standard across the merged carrier and if the change in procedures has been identified as a hazard, what is it about the new procedures that would lead to errors?

2. This is one reason why the system analysis is an essential foundational step in risk management. If risk analysis is not based upon a thorough understanding of the system,

you may miss important details that could cause the system to fail. The knowledge ga ined in the system analysis and subsequent risk analysis will later be used to develop a mitigating strategy. Risk controls will target the conditions that we think will cause an accident or affect its severity

or likelihood.

3. Risk analyses in operational c ontexts are often based on expertise and expert judgment, but they should also use data from the carrier’s own experience or those of others in the industry where available. Review of accident statistics, failure data, error data (e.g., runway

incursion re ports or information from the National Aeronautics and Space Administration (NASA)’s Aviation Safety Reporting System (ASRS)) or equipment reliability data may help in determining likelihood. § 5.55 Safety risk assessment and control.

(a) The certificate holder must develop and maintain processes to analyze safety risk associated with

the hazards identified in § 5.53(c).

Par 3

- 4 Page 231/8/15 AC 120

- 92B

4. The type of consequence (e.g., error, failure, accident, or inci dent) that is envisioned normally drives the estimate of severity. For example, if the hazard could result in controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not catastrophic. Conversely, tire failures, while poten tially leading to a fatal accident, more often lead only to aircraft damage.

5. Even where the best estimate has to be based on reasonable expert judgment,

effective risk mana g ement can be accomplished by applying a disciplined analysis. The outputs

could be recorded in a simple recording medium such as a notebook, basic desktop software,

a WBAT, 5 or a spreadsheet application.

(g) Scalability.

1. Small. Risk analysis could be performed by the owner/manager, and/or another employee(s). I t might be performed in conjunc tion (by the same individual/group) with system description and analysis, hazard identification, risk assessment

, and risk control.

2. Medium. Risk analysis could be performed by a member of management and/or the designated management representative with a sm all workgroup of company SMEs and

stakeholders.

3. Large. Risk analysis might be performed at multiple organizational levels, (e.g., the corporate, division

, or department levels) and facilitated by the S afety D epartment or specially trained analytical person nel shared with other departments. The organization might have standing committees of SMEs and stakeholders participating at various levels.

(2) Safety Risk Assessment.

(a) SRRs. Section 5.55(b).

(b) Related Regula tory Requirements.

• Section 5.23(a)(2)(i): Accountabilities of members of management, and

• Section 5.23(b): Decision authority regarding safety risk acceptance.

(c) ICAO/ SMSPP

. Element 2.2/Process 2.2.2.

(d) Objective. To make a decision regarding the acceptability of operation in the presence of an identified hazard.

5 The Web

- Based Analysis Tool (WBAT) is a federally developed and funded software system that may be used to

assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which

s upports the air carrier’s implementation of SMS.

Par 3

- 4 Page 241/8/15 AC 120

- 92B

(e) Part 5 Requirements.

(f) Discussion. Once the risk is analyzed, you must assess whether the risk is acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix provides you with a way to integ rate the effect of severity of the outcome and the probability of

occurrence, which enabl es you to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.

1. If a risk matrix is used, the carrier should develop criteria for severity and likelihood that are appropriate for their type of operations and their operational scenario. For example, severity levels are sometimes defined in terms of a dollar value of potential damage. In this case, different types of airplanes operated and their relative values would dictate different scales between carriers. Likewise, the method that the carrier uses to estimate likelihood will have an effect on how likelihood scales are defined. If the carrier pref ers to use quantitative estimates (e.g., probability), the scales would be different than one that prefers to use qualitative estimates. Figure 3

- 2 below depicts a sample risk matrix. § 5.55 Safety risk assessment and control.

(b) The certificate holder must define a process for conducting risk assessment that allows for the

determination of acceptable safety risk.

Par 3

- 4 Page 251/8/15 AC 120-92B

FIGURE 3

- 2. SAMPLE RISK MATRI X

2. R isk assessment is based on judgment, experience, and input from data collection tools (DCT) and previous processes. If the risk is acceptable, it may be done with the SRM process. If this is the case, then the system may be placed into operation and monitored in the SA process. If you decide the risk is not acceptable, you will need to follow the next step in SRM, which is developing risk controls.

3. Risk assessments must also involve the levels of management with the authority to make risk decisions, deciding what is or is not an acceptable risk for the systems within their area of operational responsibility. For example, dispa tching a flight that presents a medium or high risk might require the Chi ef P ilot or DO to approve or authorize the flight. For large scale operational decisions, the accountable executive may be the only appropriate person to make these risk acceptance decisions. Thus, the person responsible for making these risk acceptance de cisions will depend on the scope of the proposed change to the operation and the level of risk presented to the operation.

4. The outputs of this process could be recorded on paper or via an electronic medium, such as a WBAT.

(g) Scalability.

1. Small. Risk assessme nt could be performed by the owner/manager, and/or another employee(s) making the risk decisions. Risk acceptance would also probably be conducted by this individual/group. These processes could be similar to a flight risk management process, or you could use a risk matrix.

2. Medium and Large. SRM should be coordinated across the divisional and geographic units of the company to assure integrated decisionmaking and communication. Decisions involving multiple systems may require joint decisionmaking among depa rtments or managers responsible for those systems. Many companies have standing committees made up of senior managers, who are the decision makers, supported by working groups of technical

Par 3-4 Page 261/8/15 AC 120

- 92B

personnel. For example, the accountable executive could make compan y

- level decisions and department managers could make the decisions for their operations. A risk matrix may be useful

to determin e who makes the risk decision, whether the risk is acceptable, or to determine the priority for mitigating risk.

(3) Safety Risk Con trol.

(a) SRRs. Sections 5.55(c) and (d).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 2.2/Process 2.2.3.

(d) Objective. To develop a risk control that reduces risk to an acceptable level.

(e) Part 5 Requirements.

(f) Di scussion.

1. After hazards and associated risk are fully understood, risk controls must be designed for risks that the carrier deems unacceptable

. This is accomplished using their risk
assessment process

, as specified in § 5.55(b). Examples of risk controls i nclude new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, changes to staffing arrangements, or any of a number of other system changes. In short, anything that would lessen the likelihood or severity of a potential incident/accident.

2. Next, look at the system with the proposed control in place to determine if the level of risk is now acceptable and the proposed control does not introduce unintended consequences or new hazards. This is commonly referred to a s substitute risk. Section 5.55(d) requires you to evaluate whether the risk will be acceptable with the proposed safety risk control applied. The risk that remains is often called residual risk.

(g) Scalability.

1. Small. The risk control process could be a docu mented activity performed by the owner/manager and/or another employee(s) designing and evaluating the risk controls. It might be performed in conjunction (by the same individual/group) with system description and analysis, hazard identification, risk anal ysis, and risk assessment.

2. Medium and Large. The risk control proces s could be performed by

a member of management or SMS management representatives with a small workgroup of company SMEs and stakeholders to design the risk controls. There would be interdepartmental § 5.55 Safety risk assessment and control.

(c) The certificate holder must develop and maintain processes to develop safety risk controls that

are necessary as a result of the safety risk assessment process under paragraph (b) of this section. ( d ) The certificate holder must evaluate whether the risk will be acceptable with the proposed safety

risk control applied, before the safety risk control is implemented.

Par 3

- 4 Page 271/8/15 AC 120

- 92B

coordination before the controls are implemented. After the control is approved, it is implemented and documented through the company’s publication system. Implementation of risk controls may include distribution of manual revisions and training of company personnel.

e. SRM Example. The scenario below illustrates how these SRM processes wou ld be applied in an operational context.

(1) An airline receives notification that the instrument landing system (ILS) at one of its destination airports is scheduled to be out of service for a period of time and, therefore, the flights will have to use a less familiar N onprecision A pproach (NPA) procedure. Concern is expressed by the flightcrews about the procedure and the differences between fleets that will affect operational procedures and the currency of training. Under § 5.51, this triggers the SRM

proces ses and procedures.

(2) Pursuant to § 5.53(a) and (b), the SRM process starts with an analysis of the systems involved, with the addition of a new procedure for the aircraft fleet. This would include analysis of the flight operations and training program. In this case, the company has two fleets of airplanes that are operated to the destination airport in question. The equipment, and therefore the procedures and flig htcrew training in these two fleets, differs. By analyzing the system, they

iden tify a hazard (per § 5.53(c)), in that the pilots are not properly trained to fly the procedures that are required for that specific airport.

(3) To analyze the risk associated wit h this hazard (as required by § 5.55(a)), a team is assembled with representatives from management, the training and standardization organization, the flight safety organization, the organization responsible for dispatch and operational control, and the pi lot’s union. Representatives of the FAA C ertificate M anagement T eam (CMT) also attend the work team’s meetings. The risk analysis consists of documented discussions among

the assembled SMEs.

(4) As a result of the risk analysis, a risk assessment is done (per § 5.55(b)). As part of the assessment, it is determined that the existing operational procedures and training used by one of the fleets are not acceptable for safe operation into the airport without revision and additional training. A management decision i s made that the procedures and associated training currently in use will not provide an acceptable level of safety (ALoS) for operations into the airport.

(5) After determining that the risk is unacceptable, risk controls are designed under § 5.55(c). The risk control in this case consists of a change to operational procedures, including programming of the flight management system (FMS) and associated approach procedure training for flightcrew members. Prior to implementation of the risk controls, the company

c hecks the resulting procedures in flight simulators to ensure that the risk control will mitigate risk to an acceptable level, as required by § 5.55(d).

(6) Per § 5.23(b), the solution is submitted to the fleet C hief P ilots for management review and acceptance of the mitigated risk. Division

- level management and top management are briefed on the operation at regular management reviews. Once the controls are approved by all concerned, they are implemented operationally. Per the SA requirements, these controls ar e

Par 3

- 4 Page 281/8/15 AC 120

- 92B

specifically targeted for performance monitoring by the operational control/dispatch organization and the flight operations organization line checks.

3

- 5. SUBPART D : SAFETY ASSURANCE.

a. Introduction.

(1) SRR. Part 5, subpart D.

(2) Related Regulatory Requirements.

• Section 5.23(a)(2) Accountabilities of members of management,

• Section 5.25(a)(4) Accountable Executive

— Ultimate responsibility for safety performance, and

• Section 5.25(b)(1) Accountable Executive

— Responsibility to ensure SMS implementation and performance.

(3) ICAO/SMSPP. Component 3.0.

(4) Summary. SA consists of the following five processes, divided into three sections of the regulation.

(a) Safety Performance Monitoring a nd Measurement § 5.71.

• System monitoring,

• Data acquisition, and

• Analysis.

(b) Safety Performance Assessment § 5.73. System assessment.

(c) Continuous Improvement § 5.75. Continuous improvement.

NOTE: Figure 3

- 3, Safety Assurance Processes and Regulatory Requirements, depicts the SA processes and their associated regulatory requirements.

Par 3

- 4 Page 291/8/15 AC 120-92B

FIGURE 3

- 3. SAFETY ASSURANCE PROCESSES AND REGULATORY REQUIREMENTS

b. S afety Performance Monitoring and Measurement: Overview. This section of the regulation consists of the following pr ocesses: Monitoring of Operational Processes (subparagraph 3- 5c(1)), Monitoring of the Operational Environment (subparagraph 3-5c(2), Data Acquisition (subparagraphs 3-5c(3)–(7)), and Analysis of Data (subparagraph 3-5d).

(1) SRR. Section 5.71.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 3.1.

c. Safety Performance Monitoring and Measurement: Required Data Acquisition

Processes. This subsection consists of the following seven data acquisition processes: Monitoring of Operational Processes, Monitoring of the Operational Environment, Auditing of Operational Processes , Evaluation of the SMS and Operational Processes, Investigations: Accidents and Incidents, an d Investigation: Potential Noncompliance and Confidential Employee Reporting System.

(1) Monitoring of Operational Processes. System Operation/ Monitoring

Analysis

Data Acquisition

& Process

Preventive/
Corrective

Action System

Assmt 5.71(a)(3) Internal Audits 5.71(a)(4) Internal Evaluation

5.71(a)(5)&(6) Investigations 5.71(a)(7) Employee Reporting

**Outputs To SRM:** 5.73(b) 5.71(b) Analysis of Data

5.75 5.73(a) System Assessment 5.73(a) Management Review 

# *

* Note: Each data source should be traceabl e through analysis 5.71(b) assessment 5.73(a) And Corrective Action 5.75 where necessary. **Inputs From SRM:** 5.71(a) 

### 5.71Safety

Performance

Monitoring

and Measurement 

## SA

How is this going to be analyzed? By whom?



### 5.73 Safety

Performance

Assessment 5.75 Continuous Improvement

(Subpart c)

5.71(a)(1)&(2) Monitoring

Par 3-5 Page 301/8/15 AC 120

- 92B

(a) SRR. Section 5.71(a)(1).

(b) Related Regulatory Requirements.

• Part 121, § 121.703, Service Difficulty Reports, and

• Section 121.705, Mechan ical Interruption Summary Reports.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.1.

(d) Objective. To observe the day to day, flight by flight, job by job performance of operational systems and their associated risk controls.

(e) Part 5 Requirements.

(f) Discussion. Monitoring operational proces ses is what supervisors do on

a day

- to

- day basis (e.g., direct supervision of employee activities, monitoring of pilo t currency, and monitoring Minimum Equipment List (MEL) status). Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance (e.g., duty logs, crew reports, work cards, process sheets, and reports from the employee safety feedback system). This may include monitoring products and services from outside sources that are used in the certificate holder’s operations.

(g) Scalability.

1. Small. Most of the data/information

- gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel who are directly involved in the day

- to

- day operations. For exampl e, regularly reviewing (e.g., weekly, monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of monitoring and could be conducted during the normal course of duties.

2. Medium. Line managers and departmental or key management pe rsonnel may observe and review day

- to

- day activity, noting work task inconsistencies and potential safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit (LOSA) programs may also be sources of information to monitor operations.

3. Large. Monitoring may involve multiple levels of management, safety professionals, functional area managers (such as DO

, DOM

, C hief I nspector, and C hief P ilot), trained auditors/analysts , and teams/groups of line managers. As in medium

- size carriers, FOQA and LOSA programs may be employed. Operational processes may need to be coordinated across adjacent work function boundaries, so effective monitoring may also need to be

coordinated. § 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: ( 1 ) Monitoring of operational processes.

Par 3

- 5 Page 311/8/15 AC 120

- 92B

(2) Monitoring of Operational Environment.

(a) SRR. Section 5.71(a)(2).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.1.

(d) Objective. To monitor the operational environment to identify new or changed

conditions.

(e) Part 5 Requirements.

(f) Discussion. Monitoring of the operational environment involves practices that are similar to those of monitoring operational processes. The context for monitoring the operational environment of a system is developed from the system analysis that is conducted

under SR M. Once the scope of the operational environment is defined under SRM, the operational environment must be monitored to assess impacts on aviation safety. For example, increases in the price of fuel may require airlines to change their scheduling, routes, and aircraft

utilization.

(3) Auditing of Operational Processes and Systems.

(a) SRR. Section 5.71(a)(3).

(b) Related Regulatory Requirements. Section 5.23(a)(2)(ii).

(c) ICAO/SMSPP. Element 3.1/Processes 3.1.2 and 3.1.4.

(d) Objective. To provide the process owners with a means to obtain information about the performance of systems in their area of responsibility.

(e) Part 5 Requirements. § 5.71 Safety performance monitoring and mea surement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

... (2) Monitoring of the operational environment to detect changes.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must inclu de, at a minimum, the following:

... (3) Auditing of operational processes and systems.

Par 3

- 5 Page 321/8/15 AC 120

- 92B

(f) Discussion.

1. Audits are a means of collecting data to confirm whether or not actual practices are being followed within a department. Audits should typically involve the operational management responsible for the system(s) being audited. Procedures for auditing should describe your audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits. Auditors should not audit their own work, but may audit the work of others around them in the same department. Audit procedures should include the responsibilities and expectations for planning, conducting, reporting results of audits, maintaining records of audit results, and processes for auditing contractors and vendors, as necessary.

2. The results of audits can be recorded in paper format such as a common logbook

- style binder, or in electronic media such as a desktop spreadsheet program or a program

such as a WBAT.

(g) Scalability.

1. Smal l. The auditing process could be carried out periodically by the accountable executive/owner, key management person, or a trained employee as a collateral duty. Audits may also be carried out as a subfunction of normal business processes. For example,

compar isons of deferred maintenance logs and repair part receipts are a form of safety auditing that are probably already accomplished routinely.

2. Medium. In a medium

- size organization, the auditing process can be accomplished by operational departmental personne l, on a periodic basis, as determined by the needs of operational decision makers.

3. Large. In a large organization, the auditing processes are typically fulfilled by divisional auditors on a consistent basis. Large companies may already have safety and safety/quality auditors who perform this function or, in smaller divisions, they may be performed by personnel from inside the divisions.

(4) Evaluation of SMS and Operational Processes and Syste ms.

(a) SRR. Section 5.71(a)(4).

(b) Related Regulatory Requirements. Section 5.25(c)(3), Responsibilities of safety management personnel.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.3.

(d) Objective. To provide a source of information to the organization regarding the safety performance of operational systems and the SMS.

Par 3

- 5 Page 331/8/15 AC 120

- 92B

(e) Part 5 Requirements.

(f) Discussion. An evaluation is typically an independent review of the company’s processes, procedures, and systems. The evaluation process builds on the concepts of audit and inspection. An evaluation is an internal oversight tool that provides the accountable executiv e with a snapshot of the safety performance of the carrier’s operational processes and systems, as well as SMS processes. The evaluation should include all available data about the organization, including information from the audits conducted by the operat ional management.

1. Conducting evaluations at planned intervals will help the carrier’s management to determine if its safety management methods and practices are meeting safety objectives and expectations set out in the s afety p olicy. Evaluation planning sh ould take into account the safety criticality of the processes that are being evaluated and the results from previous evaluations. The scope, content, and frequency of evaluations should be based on the

decision maker’s need for information to assess the h ealth of operational processes and the SMS. You will also need to define criteria for selecting evaluators.

2. The results of evaluations can be recorded in a paper or electronic medium in a common logbook

- style binder, an electronic file folder, or a secure email account.

(g) Scalability.

1. Small. The evaluation process could be carried out periodically by the

accountable executive/owner , a key management person, or designated employees as a collateral duty under the direction of the accountable executive.

2. Medium. This process could be accomplished by the D irector of S afety (DOS) or S afety D epartment on a monthly, quarterly, or other periodic basis, as determined by

t he information needs of the accountable executive or other senior management decision makers. Personnel resources to perform the observations and data collection for evaluations could be from a small, dedicated department or selected line personnel as a co llateral duty.

3. Large. Evaluations could be accomplished by a Safety Department or an Internal Evaluation Program (IEP) office on a quarterly, annual, or other periodic basis, as determined by the information needs of the accountable executive or other seni or management
decision makers. Most part 121 companies have IEPs

, and their outputs can be integrated into the SMS. Analysis of evaluations is typically performed by a S afety D epartment. The resulting data would be acted upon by the appropriate operational department with the S afety D epartment managing the data and assisting the responsible division(s) in resolving their issues. Most large organizations have standing management committees that consider results of evaluations and any

corrective action needed. § 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, produc ts, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

... (4) Evaluations of the SMS and operational processes and systems.

Par 3

- 5 Page 341/8/15 AC 120

- 92B

(5) Investigation of Incidents and Accidents.

(a) SRR. Section 5.71(a)(5).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.5.

(d) Objective. To gather informat ion on accidents and incidents to identify potential weaknesses in operational systems.

(e) Part 5 Requirements.

(f) Discussion. Investigatio ns should be treated as an opportunity for organizational learning to prevent a repeat of errors and/or change company processes so that mistakes do not recur. Investigations should focus on what went wrong rather than who caused the error and emphasize im provement of safety performance. The organization should include investigation data, if available, from outside sources such as FAA or National Transportation Safety Board (NTSB) investigations and may, w here appropriate, participate as a party to official investigations. The results of investigations can be recorded in paper or electronic medium in

a common logbook

- style binder, an electronic file folder, or other electronic system such as

a WBAT or another suitable system

.

(g) Scalability.

1. Small. Investigations can be conducted by the accountable executive or assigned employees.

2. Medium. Investigations can be conducted by a Safety Department , with additional assigned line personnel providing technical expertise.

3. Large. Investigations, depending on the situation, can be conducted by safety teams with specialized disciplines

.

(6) Investigation of Potential Noncompliance.

(a) SRR. Section 5.71(a)(6).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.5. § 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

... (5) Investigations of incidents and accidents.

Par 3

- 5 Page 351/8/15 AC 120

- 92B

(d) Objective. To obtain information to determine compliance with regulations as well as underlying policies and procedures.

(e) Part 5 Requirements.

(f) Discussion. This subject is very similar to the one described above in that the focus of the investigation should reveal information that, when utilized correctly, will concentrate on objective facts to identify system deficiencies

, help p revent future recurrences

, and improve system reliability. It is not as important to identify “who did it” as it is for you to learn why it happened. Within this process, it is important to distinguish between error and intentional/willful noncompliant act ions. Investigations of reports regarding potential noncompliance with regulatory standards or of inadequate safety risk controls established by the certificate holder should be mitigated through the SRM process established in part 5, subpart B.

Instances of noncompliance with an FAA regulation may be reported through the Voluntary Disclosure Reporting Program (VDRP), where applicable. For instances involving individual employee noncompliance with FAA regulations, these employees may use an Aviation Safety Action Program (ASAP), if one is available.

(g) Scalability. Methods of conducting investigations of potential noncompliance can be accomplished in a manner similar to that for investigations of accidents and incidents.

(7) Confidential Employee Reporting System.

(a) SRR. Section 5.71(a)(7).

(b) Related Regulatory Requirements

. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.6.

(d) Summary. To provide a means for employees to communicate safety information to management.

(e) Part 5 Requirements. § 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

... (6) Investigations of reports regarding potential non

- compliance with regulatory standards or

other safety risk controls established by the certificate holder through the safety risk management process established in subpart B of this part.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with

respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

... (7) A confidential emp loyee reporting system in which employees can report h azards, issues,

concerns, occurrences, incidents, as well as propose solutions and safety improvements.

Par 3

- 5 Page 361/8/15 AC 120

- 92B

(f) Discussion. The workforce is an important information source that should be

included in the data

- gathering process. Audits and evaluations bring decision makers important information and are essential to a proactive SA approach. However, these tools can be limited by the scope and content of their design. Front

- line employees may observe aspects of th e operation or environment that were not expected and were not included in audit or evaluation protocols. In this respect, the employee reporting system can fill in important gaps in the company’s data collection process.

1. In order to be effective, the orga nization needs to establish and maintain an environment in which employees feel comfortable to report hazards, issues, and concerns, as well as occurrences, incidents, etc., and propose safety solutions and improvements. The accountable executive and manag ement team need to encourage employees to report safety issues and not fear reprisals from management. Policies that assure employees of fair treatment

and clear standards of behavior are an essential part of the reporting process.

2. A key aspect of the conf idential reporting system is that it is confidential. Therefore, you must define methods for employee reporting and de

- identification of sources without losing essential information. As you develop and employ the confidential reporting procedures and inclu de this inva luable input in safety decision making, employees will begin to trust the system to work toward elimination of systemic problems. This, in turn, will stimulate greater participation in employee reporting of safety concerns.

3. ASAPs can be used as part of the employee reporting system for the employee groups covered by the ASAPs. However, the confidential employee reporting system required by part 5 must include all employees in the company. Companies that do not have ASAPs may consider providing employees with a hotline, a suggestion box, or information and forms for the NASA ASRS. If a WBAT is used, this system provides a portal for ASRS reporting. ASRS provides certificated employees with limited immunity in the form of waivers of sanctions for reported events with certain restrictions.

(g) Scalability.

1. Small. An employee reporting system for a small company need not be highly sophisticated to be effect ive . The employees might report a hazard either orally or in

a note or email to their supervisor. Collection tools could be a suggestion box, voice mail “hotline,” etc.

2. Medium and Large. A medium

- or large

- sized company will most likely have an existing on line employee reporting system or ASAPs for some employee groups. Data collection for the reporting system can take many forms, from a simple suggestion box to company Web sites or intranets

, or a dedicated email address. Data management can be accomplishe d with common desktop spreadsheet or database software or specialized software,

such as a WBAT.

Par 3

- 5 Page 371/8/15 AC 120

- 92B

d. Analysis of Data.

(1) SRR. Section 5.71(b).

(2) Related Regulatory Requirements. Section 5.25(c)(2), Responsibilities of safety management personnel.

(3) ICAO/SMSPP. Elemen t 3.1/Process 3.1.7.

(4) Objective. To organize and examine data to determine its meaningfulness in making safety decisions.

(5) Part 5 Requirements.

(6) Discussion. Analysis involves examining data acqu ired from various sources in § 5.71(a) in order to make inferences about the safety performance of operational systems and

the SMS.

(a) It is common for organizatio ns to treat each employee report, audit finding, or investigation in isolation. Often, system problems may not be seen if data points are examined in isolation. Thus, analysis processes should also look across individual reports and among various

data sour ces for patterns or trends.

(b) For example, in a recent case, examination of data from an airline’s FOQA program showed several instances of unstabilized approaches and exceeding of flap and landing gear speeds on approach. It would be easy to assume that pil ot technique was the cause and then counsel or retrain the pilots. However, upon closer analysis and comparison of the events, the airline found that all of the instances were at one specific airport. Contacts with other airlines indicated similar experien ces at the same airport. After further conversations with air traffic control (ATC), the parties concluded that, due to the traffic handling practices, it was common for flights to be vectored close and high, which resulted in the approach problems. After further conversations with ATC management, the problem was resolved.

(c) The following is a starting point for an analysis process.

1. Establish the context: Understand the safety performance objectives of the system, operations, or SMS. For system impacts, and t o analyze risk controls developed under SRM, you would also need to review the system analysis conducted under SRM.

2. Identify the objective of the analysis: Are you analyzing the safety performance of a system, of an operation, or the SMS itself? § 5.71 Safety performance monitoring and measurement.

( b ) The certificate holder must develop and maintain processes that analyze the data acquired through the

processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services.

Par 3

- 5 Page 381/8/15 AC 120

- 92B

3. Secure app ropriate data: Section 5.71(a) provides a framework for data sources. The data needed may be already on hand, or additional data

- gathering may be needed, such as conducting a special audit with focus on a specific problem.

4. Select an appropriate data analys is method: Analysis need not be sophisticated to yield valuable results. For example, analysis of employee reports or qualitative analysis by SMEs may be the best method. If desired, several classification systems exist to help convert subjective, qualitat ive data into quantitative data for tracking and trend analysis. For routine reporting, analysis may consist of tracking such things as dispatch reliability per month, system or part failure rates, crew utilization/duty time, and events such as minor incid ents, diversions, and precautionary engine shutdowns.

5. R ecommendation: At this point, the person conducting the analysis may compare performance against relevant company safety objectives. Unless the decision maker is personally conducting the analysis, an assessment recommendation may be made. In the case that a potential regulatory violation is discovered during analysis, the carrier may initiate a

self

- disclosure under voluntary reporting procedures.

6. Documentation: Prepare reports and records in a format appropriate to your operation.

(d) The outputs from data analysis could be recorded in a simple recording medium

such as a notebook

, paper files, common desktop software, or specialized systems such as

a WBAT.

(7) Scalability.

1. Small. Analysis of the data gathered could be done by the accountable executive, the DOS , other individual managers, or other designated e mployees as a collateral

du ty.

2. Medium. Analysis of data could be done by the DOS , other individuals

within a Safety Department , or a person(s) within each department, and then shared with other departments and management during regularly scheduled meetings.

3. Large. Operational depart ments may have their own data analysis group reviewing data and analyzing the data by SMEs within the respective department, possibly supported and coordinated by a Safety Department

.

e. Safety Performance Assessment.

(1) SRR. Section 5.73.

(2) Related Regulatory Req uirements. Sections 5.23(a)(2)(ii) and 5.25(b)(1).

(3) ICAO/SMSPP. Element 3.1/Processes 3.1.8, 3.2, and 3.3.2.

Par 3

- 5 Page 391/8/15 AC 120

- 92B

(4) Objective. To make decisions regarding safety performance with reference to safety objectives and regulatory compliance.

(5) Part 5 Requirements.

(6) Discussion. Under § 5.71, collected safety performance data is analyzed and the results are used for informed decisionmaking. The assessment process is where these decisions

are made. Decisions are mad e by personnel with assigned responsibility and authority. T he SA

process should consider who makes the decisions regarding whether the company’s safety performance is effective and whether the company is meeting its safety objectives and expectations that are identified in the s afety p olicy required by § 5.21. The conclusions of the safety assessments are reported to the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary.

(a) Assessments can have one of the following general outcomes:

• Performance is acceptable and objectives are being met

.

• Performance is not acceptable, and analysis suggests that the problem lies with conformity with regulations or company policy and procedures, or necessary resources have not been provided. In the event this occurs, corrective action under § 5.75 would be w arranted

.

• Conformity with the risk controls and regulations appears to be satisfactory; however, desired results are not being obtained. In the event that this occurs, the SRM processes would be triggered

.

• New or uncontrolled hazards are discovered. This m ay be due to new hazards having arisen since the system was designed or discovery of factors

that were overlooked. In this case, as in the previous, the SRM processes

must be followed.

(b) The results of assessments can be recorded in a paper or electronic med ium in

a common logbook

- style binder, an electronic file folder, common desktop software, or specialized system, such as a WBAT. § 5.73 Safety performance assessment

.

(a) The certificate holder must conduct assessments of its safety performance against its safety objectives,

which include reviews by the accountable executive, to: (1) Ensure compliance with the safety risk controls est ablished by the certificate holder; (2) Evaluate the performance of the SMS. (3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any

ineffective controls. (4) Identify changes in the operational environment that may introduce new hazards. (5) Identify new hazards. (b) Upon completion of the assessment, if ineffective controls or new hazards are identified under

paragraph (a)(2) through (a)(5) of this section, the certificate holder must use the safety risk

ma nagement process described in subpart C of this part.

Par 3

- 5 Page 401/8/15 AC 120

- 92B

(7) Scalability.

(a) Small and Medium. As an organization grows in size, it is normal to have additional personnel performing safety, quality, or internal evaluation functions. An SMS does not change the number and types of personnel in these situations as much as it may change the way in which these persons and organizations work and interact. For example, safety performance an d assessment could be a documented activity performed by the accountable executive or a coordinated activity between the accountable executive and other operational managers, supported and coordinated by the DOS . Risk acceptance would also normally fall to managers within this group.

(b) Large. This process is best addressed at the highest level in the organization and involves the accountable executive, division vice presidents, and other defined leaders and

decision makers. At each level, the company would de fine who is responsible for making risk acceptance decisions and what actions should be taken to either correct the problem or design new risk controls. Larger companies typically have standing management committees at the functional organization level (e. g., flight operations, technical operations/maintenance, in

- flight services, dispatch/operational control) and a second body at the corporate level to assure integration, coordination, and review by the accountable executive.

f. Continuous Improvement.

(1) SRR. Section 5.75.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 3.3/Process 3.3.1.

(4) Objective. To provide the organization’s decision makers with a means to correct safety performance deficiencies identified in the safety performance assessment process.

(5) Part 5 Requirements.

(6) Discussion.

(a) The final step within SA is continuous improvement. This process is designed to ensure that you are correcting substandard safety performance identified during the safety performance assessment in order to continuously improve safety performance.

(b) As discussed in subparagraph 3

- 5e

, S afety P erformance A ssessment) , the corrective action process of § 5.75 is triggered when conformity with risk controls has been

found to be deficient. In th is case, it is not necessary to conduct a new safety risk analysis. Risk has already been assessed as being unacceptable without satisfactory completion of the risk control. For example, if it has been found that an Airworthiness Directive (AD) has not bee n § 5.75 Continuous improvement

. The certificate holder must establish and implement processes to correct safety performance deficien cies identified in the assessments conducted under § 5.73.

Par 3

- 5 Page 411/8/15 AC 120

- 92B

applied to a particular aircraft, the only correct action is to comply with the risk control (in this case, the AD). The risk of flying the airplane without the AD has already been assessed as unacceptable.

(7) Scalability. Continuous improvement decisionmak ing is an output of the performance assessment process. Therefore, the arrangements discussed for assessment apply to scalability for continuous improvement activities. The managers, committees, or working groups

that make assessment decisions would also l ay out courses of corrective action.

g. An SA Example. This example builds on the scenario discussed in the SRM example

, which can be found in the SRM section, subparagraph 3

- 4e. In that example, an airline addresse d the unacceptable risk of an airport approach procedure by imposing risk controls consisting of a change to operational procedures, including programming of the FMS and associated approach procedure training for flightcrew members.

(1) As required by §§ 5.71(a)(1) and 5.73(a)(1) and (a)(3), the air carrier specifically

monitor ed the flight operations and the associated controls at the airport by the operational

contr ol/dispatch organization as part of their normal activities. This organization was tasked with assuring that crews assigned to the specific flights were appropriately qualified (thus verifying that this part of the risk control was being employed), and tha t the airplanes scheduled for the flights had appropriate operational equipment. As required by § 5.71(a)(2), the air carrier also

monitor ed the airport to determine whether the altered approach procedure was still necessary.

(2) Another part of the risk contr ol monitoring and auditing was conducted using

structured line checks pursuant to § 5.71(a)(3). This method was used to conduct audits of specific flight operations ( in addition to the airline’s normal checking procedures ) , thus providing data to verify th at the procedures put in place provide d risk controls that are effective, as required by § 5.73(a)(3). At the same time, per § 5.71(a)(7), the airline’s employee reporting
system was available for pilots to submit their concerns to the company. Line check and employee reporting data were collected and analyzed under § 5.71, and then assessed by management under § 5.73.

(3) If any deficiencies were found, an analysis would have be en conducted to ascertain whether the deficiencies should be addressed through SRM (per § 5.73(b)) or a correction (per § 5.75). If the root cause of the deficiencies was shortfall s in compliance with the designed operational process (e.g., required training was not completed), the deficiency should be

addre ssed through a correction

, per § 5.75. However, if the deficiency was associated with the basic design of the control (e.g., inadequate training curriculum), the SRM process would be repeated to revise the procedure in the areas wh ere it was found deficient, per § 5.73(b).

3

- 6. SUBPART E : SAFETY PROMOTION.

a. Introduction.

(1) SRR. Part 5, subpart E, Safety Promotion

(2) Related Regulatory Requirements. Section 5.23(a)(2)(ii), Accountabilities of members of management.

Par 3

- 5 Page 421/8/15 AC 120

- 92B

(3) ICAO/SMSPP. Component 4.0.

(4) Objective. To provide employees with effective SMS tr aining commensurate with their safety responsibilities, and to create a means to deliver organization

- wide safety

communication.

(5) Discussion. Because a key component of SMSs is the effective control of risk, every member in your organization must understand and take responsibility for the role they play in controlling risk by their actions and behavior. These member s should also have access to

up

- to

- date safety information so that they can properly fulfill their roles.

b. Competencies and Training.

(1) SRR. Section 5.91.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 4.1/Processes 4.1.1 and 4.1.2.

(4) Objective. To assure that employees are competent to perform their SMS

- related

duties.

(5) Part 5 Requirements.

(6) Discussion. Your organization will need to train its employees. Your employees may receive initial safety training for them to understand and perform their safety duties.

Recurrent trainin g may also be necessary to reinforce these skills. For example, a Safety Department employee will probably need more detailed SMS training (such as safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than will a baggage handler. Line managers may need to know the potential consequences of safety failures and system failure modes more so than line employees will. Line employees may only need an overview of safety management fundamentals for their operationa l department (e.g., instructions on how to identify and report safety concerns).

(a) Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they successfully perform work

fu nctions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. By training your employees, you should establish competencies for all employees, commensurate with their duties relevant t o the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests, and then measured periodically during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As § 5.91 Competencies and training. The certificate holder must provide training to each individual identified in § 5.23 to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS.

Par 3

- 6 Page 431/8/15 AC 120

- 92B

part of SA, organizations should periodically review their training program(s) to ensure that those programs meet the objectives set out in the s afety p olicy.

(b) It is the responsibility of your organization to determin e its own training needs based on competency requirements. Management personnel, specifically designated by the accountable executive to ensure the SMS is fully implemented, may need to be trained first and may also need specialized training to fulfill the ir responsibilities. Determining the organization’s training needs starts with a careful review of the safety policy, processes, and objectives. Everyone working within the scope of SMS should receive training commensurate with their position in the organi zation.

(7) Scalability. Organizations of all sizes may choose to either train their employees in house or to contract out the training to outside vendors. Whichever option is taken, the training must be specific to your company’s SMS and operations.

c. Safety Co mmunication.

(1) SRR. Section 5.93.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 4.2.

(4) Objective. To assure that employees have current and pertinent safety information.

(5) Part 5 Requirements.

(6) Discussion.

(a) Effective communication involves adjusting the content of the communication and manner in which the information is delivered to match the target employee’s role in the organization. The accountable executive must ensure that communication mechanisms are available and are effectively utilized. The delivery system should be appropriate according to the size and complexity of the organization.

(b) Safety policy and information could be provided as text, visual media such as posters or short videos, orally, or through examples. Messages should be consistent and in a form employees at each level can relate to, and be delivered using whichever media the organization

has available. For example, hazard communications regarding birds for flightcrew members § 5.93 Safety communication. The certificate holder must develop and maintain means for communicating safety informat ion that, at

a minimum:

(a) Ensures that e mployees are aware of the SMS policies, processes, and tools that are relevant to their

responsibilities. (b) Conveys hazard information relevant to the employee’s responsibilities. (c) Explains why safety actions have been taken. (d) Explains why safety p rocedures are introduced or changed.

Par 3

- 6 Page 441/8/15 AC 120

- 92B

(regarding new bird strike avoidance techniques) may be in a “Notices” section of the Flight Operations Manual (FOM), and may be reinforced by recurrent training. Hazard communicatio ns made to line maintenance technicians (regarding birds roosting and nesting in flight controls, auxiliary power unit (APU) intakes, and engine cowlings) may be conveyed by posters and changes to daily inspection procedures. Hazard communications regardin g birds made to ground service personnel may be in the form of posters, videos, and demonstrations (cleaning and removing bird droppings from windshields)

.

(7) Scalability.

(a) Small. Communicating safety considerations to employees will probably be simple and dir ect. For example, the company owner or the organization could conduct regular

all

- hands/employee meetings

, such as “hangar talk sessions.” Additionally, communication could include regular and periodic briefings to the employees, posting the status of safe ty issues on bulletin boards, emails to employees, and face

- to

- face meetings with division management

teams.

(b) Medium. Communication methods may be more structured than in small organizations. Safety information may be published throughout the company by pri nted or electronic means. Safety meetings are likely more structured and formal. Communication and feedback may be formalized in order to provide information to individual employees as well as organization

- wide information for cross

- boundary issues and/or common hazards.

(c) Large. Communication is more likely to be formal and a tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. Information technology (IT) approaches, such as email broadcasts or intranet Web sites, may be considered to facilitate directing the flow of safety information and recording its accomplishment for evaluation and auditing purp oses.

3

- 7. SUBPART F : SMS DOCUMENTATION AND RECORDKEEPING.

a. Introduction.

(1) SRR. Part 5, Subpart F.

(2) Related regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.5.

(4) Discussion. You must establish and maintain SMS information, in either paper or electronic form, des cribing the safety

- related processes and procedures. Additionally, you must maintain the SMS records discussed below for a specified period of time.

b. SMS Documentation.

(1) SRR. Section 5.95.

(2) Related Regulatory Requirements. None.

Par 3

- 6 Page 451/8/15 AC 120

- 92B

(3) ICAO/SMSPP. Element 1.5.

(4) Part 5 Requirements.

(5) Discussion. You must establish and maintain SMS i nformation, in either paper or electronic form, describing the safety

- related processes and procedures and interfaces between these. You should also implement a distribution system to ensure that the documents dealing with these processes and procedures ar e promptly updated whenever there is a change in one or more of these processes or procedures.

(6) Scalability.

(a) Small and Medium. The owner/manager or designee may be responsible for maintaining and distributing current versions of guidance documents. Document ation may consist of a set of typewritten documents, spreadsheets, and forms that are kept in file cabinets or binders. Managers of medium

- size companies need the same type of information to make decisions, although the volume is typically larger than that of a small company and smaller than that of a large organization.

(b) Large. Documentation and recordkeeping processes for a large organization may use a WBAT, unique software applications, or development of new database tools to support risk reporting and analysis. These organizations should examine existing tools and

infrastruct ure, as it is likely that these can be leveraged (modified) to meet SMS requirements.

c. SMS Records.

(1) SRR. Section 5.97.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.5. § 5.95 SMS documentation. The certificate holder must develop and maintain SMS documentation that describes the certificate

holder’s :

(a) Safety policy. (b) SMS processes and procedures.

Par 3

- 7 Page 461/8/15 AC 120

- 92B

(4) Part 5 Requirements.

(5) Discussion. The timeline associated with the retention of the documents required by the regulation for outputs of SRM processes would be for as long as they remain relevant to the operation. For risk assessments, this may mean for as long as the air carrier engages in the activity for which the risk assessment was conducted. For risk controls, it may mean for as long

as the risk control remains in effect.

(6) Scalability.

(a) Small. The owner/manager or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, and completed forms that are kept in file cabinets or binders.

(b) Medium. An individual or small staff may coordinate document maintenance and retention. This staff may use a combination of paper and electronic media to administer the process. Some records may be retained by depart ment heads in accordance with a procedure deleg ating this responsibility.

(c) Large. The organization may have a dedicated records staff or department

whose duties include document distribution and records retention. Due to the size and complexity of the organization, the use of technology is probably more pronounced. § 5.97 SMS records.

(a) The certificate holder mus t maintain records of outputs of safety risk management pr ocesses as

described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation. (b) The certificate holder must maintain records of output s of safety assurance pr ocesses as described in

subpart D of this part. Such records must be retained for a minimum of 5 years. (c) The certificate holder must maintain a record o f all training provided under § 5.91 for each individual.

Such records must b e retained for as long as the individual is employed by the certificate holder

. (d) The certificate holder must retain records of all communications provided under § 5.93 for

a minimum of 24 consecutive c alendar

- months.

Par 3

- 7 Page 47 (and 48)1/8/15 AC 120-92B

CHAPTER 4. IMPLEMENTATION: BUIL DING A SAFETY MANAGEMENT SYSTEM (SMS)

4-1. PROCESS OVERVIEW.

a. Existing Title 14 of the Federal Code of Regulations (14 CFR) Part 121 Certificate

Holders. For existing part 121 certificate holders, the process of creating an SMS and

an implementation plan consists of the following:

• Mapping and analyzing your existing organization,

• Determining the extent to which your organization already complies with the requirements of 14 CFR part 5,

• Developing a plan to comply with the requirements of part 5 with which your organization does not already comply, and

• Submitting the plan to the Federal Aviation Administration (FAA) for approval.

NOTE: Existing part 121 certificate holders who wish to use their implementation plan that has been validated through SMS Pilot Project (SMSPP) / SMS Voluntary Program (SMSVP) must update their implementation plan to ensure compliance with part 5.

b. New Certification. SMS implementation for a certificate applicant is different than that for a certificate holder. The implementation plan requirement and the specific deadline for full SMS implementation is dependent on when your organization ’s formal application for a part 121 certificate is accepted by the FAA

.

(1) Applicants Completing Formal Application After March 9, 2015. According to

14 CFR part 119, § 119.8, applicants that have not completed formal application prior to

March 9, 2015 must demonstrate t hat they meet the full requirements of 14 CFR part 5 prior to being issued a certificate. The application process for a part 121 certificate can be found in FAA

Order 8900.1, Volume 10 (ATOS) , Chapter 6, Section 2, Certification Process Document or Volume 2, Chapter 3 for Safety Assurance System (SAS)

.

(2) Applicants Completing Formal Application Prior to March 9, 2015. Applicants that have completed formal application prior to March 9, 2015 may be issued certificates; however, they are still responsible for me eting the deadlines set out in §§ 119.8 and 5.1.

(a) Applicants Completing All Other Certification Requirements Prior to September 9, 2015. These applicants can be certificated without an SMS implementation plan. However, they must submit an SMS implementation plan prior to September 9, 2015 for approval by the FAA.

(b) Applicants Completing All Other Certification Requirements Prior to March 9, 2016. These applicants must submit an SMS implementation plan for review by the FAA prior to being issued a certificate. They must have an approved implantation plan prior to March 9, 2016.

Par 4-1 Page 491/8/15 AC 120

- 92 B

(c) Applicants Completing All Other Certification Requirements After

March 9, 2016

. Prior to receiving a part 121 certificate, these applicants will be required to have an approved SMS implementation plan for completion of all part 5 requirements prior to

March 9, 2018.

(d) Applicants Unable to Complete All Certification Requirements P rior to March 9, 2018. These applicants will be required to demonstrate compliance with all requirements for SMS prior to being issued a certificate.

4

- 2. MAPPING AND ANALYZING YOUR ORGANIZATION. The first step in developing an SMS is mapping out and analyzing your organization. The initial mapping and analysis starts by describing and documenting your organizational structure, operational environment, and specific functions of each department.

a. Organizational Description. An organizational description should det ail your company’s departments by operations, as well as management personnel responsible for the company’s systems (e.g.

, flight operations, training, ground operations, cabin safety, dispatch, maintenance). The organizational description may include, for example, discussion of using contractors for fueling and deicing operations, maintenance functions, etc. It is also common for unions of various employee groups to be discussed and described during the organizational description process.

b. Analysis. Following the organizational description, an analysis should describe and document what each department does, identify responsible and/or accountable personnel, and record who has the authority to modify processes and procedures and accept risk for each department. Typical timeframes: A small service provider may complete an organizational description in a few days; a medium

- size service provider may do so within a co uple of weeks, and a large organization may need a month or more.

4

- 3. CONDUCTING A GAP ANALYSIS. To build an implementation plan, you need to understand your current state of compliance with part 5, as well as programs you may already

have that could be used t o satisfy the requirements of part 5. A gap analysis involves analyzing and assessing your existing programs, systems, processes, and activities with respect to SMS requirements found in part 5. Your company may use any technique to identify what needs to be done to implement an SMS. If you chose to utilize a gap analysis, the completed gap analysis will provide input for development of your implementation plan.

a. Organizational Processes. Most certificate holders have many of the elements of

an SMS in their current operational processes, although those processes may not entirely fulfill the requirements of part 5 (e.g., they may be limited in scope (do not cover the entire organization) and interoperability (do not interface sufficiently to form a “system”)). A list of regulatory and voluntary programs that may be appropriate for inclusion in your SMS to satisfy the requirements of part 5 can be found in Chapter 5, Integrating Existing Safety Programs into the Safety Management System (SMS).

b. Gap Analysis. In o rder to establish overall organizational compliance, the certificate holder should compare its current organizational proce sses to part 5 requirements.

Par 4

- 1 Page 501/8/15 AC 120

- 92B

An implementation plan is then prepared to fill the gaps identified in the analysis. An optional FAA Gap Analysis Tool has been developed to assist certificate holders in their gap analysis

efforts

. A n example is available in Appendix 5, Sample Gap Analysis and Implementation Plan Excerpts , but any method and/or tool that en sures complete coverage of part 5 requirements may be used by the certificate holder.

NOTE: If you determine that a process in your organization satisfies part 5, your gap analysis should identify how that process meets the requirements of
part 5.

4

- 4. PREPARING AN IMPLEMENTATION PLAN.

a. What is an Imp lementation Plan?

(1) An implementation plan is a document that outlines the steps the air carrier plans to take to ensure that it has an SMS that is acceptable t o the FAA by March 9, 2018.

(2) The requirements for an implementation plan are in §§ 5.1(b) and (c).

(3) To ensure that resources are being allocated and to monitor the development and implementation of the SMS, your accountable executive should be designated prior to the development of the implementation plan. The accountable executive is ultimately responsible for implementation and performance of the SMS.

b. What an Implementation Plan Should Cover. The implementation plan must cover the functions of your organization that directly impact aviation safety and the complete timeline of SMS development.

(1) It should include milestones for the development of the processes and procedures required by part 5.

(2) I t should be updated as necessary as SMS implementation progresses.

(3) It should show a reference to each applicable part 5 section requirement and include a brief description explaining either:

• How you already comply with the specified requirement

, or

• How you plan to comply with the requirement.

(4) The implementation plan should assign responsibility for completing implementation tasks/actions.

NOTE: An SMS process is considered “ implemented ” and in compliance with part 5 when : all process documentation (manuals) is co mplete and published; all process personnel are available and trained; all hardware/software is available and in the location of its intended use; and the Certificate Management Team (CMT) has validated the process.

Par 4

- 3 Page 511/8/15 AC 120

- 92B

(5) The implementation plan need not be comp lex or excessively detailed, but should provide a basic roadmap to meet part 5 requirements. The implementation plan may consist of more than one document, combined with the gap analysis document, or created in a format useful to your company. A n implement ation plan can be found in Appendix 5 , Sample Gap Analysis and Implementation Plan Excerpts . If you are a part 121 certificate holder, your implementation plan must be approved by your respective CMT.

(6) Similar to the gap analysis process, you should receive input from the managers of all your organizational divisions and functional areas covered by the SMS. This is necessary to form a plan filling in all the gaps discovered during the gap analysis.

4

- 5. PHASED SMS IMPLEMENTATION STRATEGY.

a. Introduction. One recommended, but not required, way to implement an SMS is through a phased implementation approach. The sample SMS i mplementation strategy has

four phases. For example, t he four levels of phased implementation could be :

• Level 1

- Planning and organization

,

• Level 2

- Basic safety management

,

• Level 3

- Fully functional SMS

, and

• Level 4

- Continuous improvement.

NOTE: Uti lizing this method, the overall complexity of the task is divided

int o smaller, more manageable subcomponents.

b. Implementation Levels

— Overview. The overall objective of the levels is to develop and implement an integrated, comprehensive SMS for your entire organization. Phased implementation can be thought of as organization al learning

— the same building block approach often used in training and education of personnel. The recommended SMS development levels, as follows, are suggested but not required. Your organization may determine and develop your own phases, levels, divis ional implementation strategies, etc. Thi s four

- level approach is only a representative template. Figure 4

- 1, Recommended Safety Management System (SMS) Implementation Levels, illustrates the recommended levels of SMS development and implementation.

Par 4

- 4 Page 521/8/15 AC 120-92B

FIGURE 4- 1. RECOMMENDED SAFETY MANAGEMENT SYSTEM

IMPLEMENTATION LEVEL S

(1) I mplementation Level 1: Planning and Organization. Level 1 begins when your management team commits to providing the resources necessary for full SMS implementation.

Level 1 includes a thorough understanding of your organizational structure and a comparison (gap analysis) between the part 5 requirements and your organizational structure. Your organization will develop an implementation plan to bridge your identified gaps. The final implementation plan must be approved by your CMT.

(2) Implementation Level 2: Basic Safety Management. Level 2 is where you develop and implement basic Safety Risk Management (SRM) and Safety Assurance (SA) processes and apply those processes to existing systems. This is often called the “reactive phase.” At this phase, your company is able to identify hazards and address unacceptable risk. Level 2 implementation, depending on the size and complexity of the organization, typically takes 12 months to complete.

(3) Implementation Level 3 : Functional SMS. Level 3 is where your SRM process will be applied to the initial design of systems, processes, organizations, and services; development of new or changed operational procedures; and planned changes to operational processes. This is the “proactive/predictive” ph ase, where risks in future planned operations are addressed. Both the SRM and SA processes developed at Level 2 are now applied in a predictive

manner —applying safety management to something that you have not done before. At the completion of Level 3, you have a fully implemented SMS.

(4) Implementation Level 4 : Continuous Improvement. At Level 4, you are monitoring your SMS and operational processes. By the time you reach this level, all required SMS processes are already in place. A major objective of a succ essful SMS is to attain and maintain this continuous improvement status for the life of the organization.

c. SMS Implementation Layout. Figure 4-2, Safety Management System Development, shows an example of a high- level phased implementation la yout. An impleme ntation plan prepared according to this layout would apply milestones, responsibilities, resources, and

documentation. 4

1 2 3

Basic Safety Management Fully Functional
SMS Continuous Improvement

Planning & Organization

Par 4-5 Page 531/8/15 AC 120-92B

FIGURE 4- 2. SAFETY MANAGEMENT SYSTEM DEVELOPMENT

SMS Processes should be implemented by the indicated Level of Implementation Implementat ion

Level

SMS Processes 1 2 3 Part 5, Subpart B

- Safety Policy (SMSPP 1.0) X § 5.21

- Safety Policy (SMSPP 1.1) X § 5.23

- Safety Accountability and Authority (SMSPP 1.2) X § 5.25

- Designation and responsibilities of required safety management personnel (SMSPP 1.3) (*1) X § 5.27

- Coordination of emergency response planning (SMSPP 1.4) X Part 5, Subpart C

- Safety Risk Management (SRM) (SMSPP 2.0) (*4) X § 5.51

- Applicability

- (SMSPP 2.0) X § 5.53

- System analysis and hazard identification (SMSPP 2.1) (*4) X § 5.53(a) and (b)

- System analysis (SMSPP 2.1.1) X § 5.53(c)

- Hazard Identification (SMSPP 2.1.2) X § 5.55

- Safety Risk Assessment and Control (SMSPP 2.2) X § 5.55(a)

- Analyze Safety Risk (SMSPP 2.2.1) X § 5.55(b)

- Safety Risk Assessment (SMSPP 2.1.2) X § 5.55(c)

- Safety Risk Control (SMSPP 2.1.3) X Part 5, Subpart D

- Safety Assurance (SA) (SMSPP 3.0) (*3) X § 5.71

- Safety Performance Monitoring and Measurement (SMSPP 3.1) X § 5.71(a)(1) and (2)

- Monitoring (SMSPP 3.1.1) X § 5.71(a)(3)

- Auditing (SMSPP 3.1.2 and 3.1.4) X § 5.71(a)(4)

- Evaluations (SMSPP 3.1.3) X § 5.71(a)(5) and (6)

- Investigations (SMSPP 3.1.5) X § 5.71(a)(7)

- Confidential Employee Reporting System
(SMSPP 3.1.6) X § 5.71(b)

- Analyze Data (SMSPP 3.1.7) X § 5.73

- Safety Performance Assessment (SMSPP 3.1.8) (*3) X § 5.75

- Continuous Improvement (SMSPP 3.3) X § 5.75

- Correct Safety Performance (SMSPP 3.3.1) X Part 5, Subpart E

- Safety Promotion (SMSPP 4.0) X § 5.91

- Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X § 5.93

- Safety Communication (SMSPP 4.2) X Part 5, Subpart F

- SMS Documentation and Recordkeeping
(SMSPP 1.5) X § 5.95

- SMS Documentation (SMSPP 1.5) X § 5.97

- SMS Records (SMSPP 1.5) X (*1) Level 1

- Implement

- § 5.25 (c)(1) only (*2) Level 1 - A training plan is expected for all personnel (*3) Level 2 - Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards (No need to baseline entire organization). Do not implement § 5.73a(4) and (5) (*4) Level 2 - Implementation of § 5.53, will be limited in level 2 by the lack of the system analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)

Par 4-5 Page 541/8/15 AC 120

- 92B

SMS Processes should be implemented by the indicated Level of Implementation Implementat ion

Level

SMS Processes 1 2 3 Part 5, Subpart B

- Safety Policy (SMSPP 1.0) X § 5.21

- Safety Policy (SMSPP 1.1) X § 5.23

- Safety Accountability and Authority (SMSPP 1.2) X § 5.25

- Designation and responsibilities of required safety management personnel (SMSPP 1.3) (*1) X § 5.27

- Coordination of emergency response planning (SMSPP 1.4) X Part 5, Subpart C

- Safety Risk Management (SRM) (SMSPP 2.0) (*4) X § 5.51

- Applicability

- (SMSPP 2.0) X § 5.53

- System analysis and hazard identification (SMSPP 2.1) (*4) X § 5.53(a) and (b)

- System analysis (SMSPP 2.1.1) X § 5.53(c)

- Hazard Identification (SMSPP 2.1.2) X § 5.55

- Safety Risk Assessment and Control (SMSPP 2.2) X § 5.55(a)

- Analyze Safety Risk (SMSPP 2.2.1) X § 5.55(b)

- Safety Risk Assessment (SMSPP 2.1.2) X § 5.55(c)

- Safety Risk Control (SMSPP 2.1.3) X Part 5, Subpart D

- Safety Assurance (SA) (SMSPP 3.0) (*3) X § 5.71

- Safety Performance Monitoring and Measurement (SMSPP 3.1) X § 5.71(a)(1) and (2)

- Monitoring (SMSPP 3.1.1) X § 5.71(a)(3)

- Auditing (SMSPP 3.1.2 and 3.1.4) X § 5.71(a)(4)

- Evaluations (SMSPP 3.1.3) X § 5.71(a)(5) and (6)

- Investigations (SMSPP 3.1.5) X § 5.71(a)(7)

- Confidential Employee Reporting System
(SMSPP 3.1.6) X § 5.71(b)

- Analyze Data (SMSPP 3.1.7) X § 5.73

- Safety Performance Assessment (SMSPP 3.1.8) (*3) X § 5.75

- Continuous Improvement (SMSPP 3.3) X § 5.75

- Correct Safety Performance (SMSPP 3.3.1) X Part 5, Subpart E

- Safety Promotion (SMSPP 4.0) X § 5.91

- Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X § 5.93

- Safety Communication (SMSPP 4.2) X Part 5, Subpart F

- SMS Documentation and Recordkeeping
(SMSPP 1.5) X § 5.95

- SMS Documentation (SMSPP 1.5) X § 5.97

- SMS Records (SMSPP 1.5) X (*1) Level 1

- Implement

- § 5.25 (c)(1) only (*2) Level 1

- A training plan is expected for all personnel (*3) Level 2

- Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards (No need to baseline entire organization). Do not implement § 5.73a(4) and (5) (*4) Level 2

- Implementation of § 5.53, will be limited in level 2 by the l ack of the system analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)

Par 4

- 5 Page 55 (and 56)1/8/15 A C 120

- 92B

CHAPTER 5. INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY MANAGEMENT SYSTEM (S MS)

5

- 1. PURPOSE OF THIS CHAPTER. This chapter explains how your existing safety programs may be integrated into the SMS Safety Assurance (SA) processes. The Federal Aviation Administration (FAA) encourages the continued use of your current safety programs as part of overall safety management. Expanding your current safety programs across your entire organization is one way to provide a comprehensive systems approach to SA.

5

- 2. DISCUSSION OF INDIVIDUAL PROGRAMS.

a. Safety Programs and the SMS. Certificate holders are encouraged to be creative in utilizing safety programs to meet the specifications of the SMS rule. These programs collect data on the performance of the safety system, so most can be used to help satisfy some of the SA requirements

.

b. FAA

- Sanctioned Programs. The following are FAA

- sanctioned programs, but they are not the only programs available.

(1) Continuing Analysis and Surveillance System (CASS).

(a) Program. CASS is required by Title 14 of the Code of Fe deral Regulations (14 CFR) part 1 21, § 121.373. CASS is a quality assurance (QA) system that monitors and analyzes the performance and effectiveness of the air carrier’s Continuous Airworthiness Maintenance Program (CAMP).

(b) Integration. A CASS overlaps some of the SMS SA functions (14 CFR part 5, § 5.71). CASS could be a standalone system, or a subsystem within an SMS. CASS may be maintained separately; however, it would probably be beneficial to integrate CASS within the SMS. However accomplished, it is imperative to understand that CASS s hould supply information to the SMS. The SMS may even support CASS through the use of Safety Risk Management (SRM) and SA processes applied to CASS needs. An SMS may evaluate the CASS to ensure that all critical CASS elements are being performed and contro lled and all outcomes are acceptab le in accordance with FAA Order 8900.1, Volume 3, Chapter 44, Assess Continuing Analysis an d Surveillance System for Parts 121 and 135, and the current edition of Advisory Circular (AC) 120

- 79, Developing and Implementing an Air Carrier CASS.

(2) Aviation Safety Action Program (ASAP).

(a) Program. The ASAP is meant to encourage voluntary reporting of safety issues and events that come to the attention of participating certificate holders’ employees. ASAPs include processes for intake of data from employees, analysis of the data, and development of corrective actions within a confidential environment. ASAP is accepted by the FAA but is not required. ASAP development, implementation, acceptance, and operation are detailed in the

current edition of AC 120

- 66, Aviation Safety Action Program (ASAP).

(b) Inte gration. ASAP can be used to satis fy some SMS requirements ( § 5.71)

. F or example

, the ASAP can be used to partially satisfy the requirement for a confidential

Par 5

- 1 Page 571/8/15 AC 120

- 92B

reporting system. Employee groups not covered by an ASAP would need some type of confidential emp loyee reporting system. In the event of termination of an ASAP program, those covered employees would be required to have a confidential employee reporting system. ASAP requires analysis and corrective action; however, it does not require analysis of patte rns or trends across reports that would identify systemic problems. This information should be a nalyzed through the SA process.

(3) Aviation Safety Reporting System (ASRS).

(a) Program. The FAA ASRS util i zes the National Aeronautics and Space Administration (NASA) as a third party to receive aviation safety reports. The ASRS does not provide an explicit requirement for corrective actions, nor does it provide sufficient detailed data with which to adequately analyze specific systems or processes.

(b) Integration. Trend and global systemic information may be appropriate for SA analysis under SMS. Additional information on these policies can be obtained in AC 00

- 46, Aviation Safety Reporting Program.

(4) Flight Operational Quality Assurance (FOQA).

(a) Program. FOQA is a voluntary program for the routine collection and analysis of digital flight data generated during aircraft operations. The FOQA program is another potential tool in an operator’s SMS to monitor operational data and provide s data analysis and assessment. FOQA program development, implementation, acceptance, and operation are

covered in the current edition of AC 120

- 82, Flight Operational Quality Assurance.

(b) Integration. F OQA can be used to satisfy some SMS SA requirements (§ 5.71). FOQA requires data collection and analysis but stops short of requiring corrective action. Thus, this requirement would be dependent on the configuration of the specific operator’s program

—

a s ubject of the gap analysis. FOQA, if present, must interface with the operator’s other safety programs and their SMS.

(5) Voluntary Disclosure Reporting Program (VDRP).

(a) Program. The VDRP provides incentives for a certificate holder to voluntarily identify, rep ort, and correct instances of regulatory noncompliance. The FAA will review, accept, and oversee corrective actions and conduct followup surveillance. The FAA’s acceptance of the voluntary disclosure foregoes legal enforcement action, and protects from rel ease, when specific criteria are met, qualifying disclosures and corrective actions. Additional information on

the VDRP can be obtained in the current edition of AC 00

- 58, Voluntary Disclosure Reporting Program.

(b) Integration. VDRP data is not normally a sou rce of safety information. However, the data gathered during an investigation, subsequent development, and implementation of a fix could be integrated into the data analysis, assessment, and validation processes of a carrier’s SMS SA.

Par 5

- 2 Page 581/8/15 AC 120

- 92B

(6) Internal Evaluation P rogram (IEP).

(a) Program. The IEP can be a safety process that , through inspections, audits, and evaluations, assesses the adequacy of managerial controls and processes in critical safety systems. The FAA encourages (and the Department of Defense (DOD) requir es) using an IEP to increase awareness management and employees’ responsibility to follow company safety practices and comply with all regulatory requirements. IEP is the subject of the current editions

of AC 120

- 59, Air Carrier Internal Evaluation Program , and AC 145

- 5, Repair Station Internal Evaluation Programs.

(b) Integration. An IEP can be part of an SA process. If used by a certificate holder, an IEP can satisfy the internal evaluation requirement of § 5.71. Since an IEP is not covered by a standalone re gulation or formal voluntary program approval process, its use within an SMS is dependent on the configuration.

(7) Line Operations Safety Audit (LOSA).

(a) Program. The Line Operations Safety Audit (LOSA) is a formal process where qualified observers ride the jum p seat during regularly scheduled flights to collect safety

- related data on various weather and visibility conditions, operational complexities, and flightcrew performance. A LOSA program is not formally approved or accepted by the FAA. LOSA i s the subject of the current edition of AC 120

- 90, Line Operations Safety Audits.

(b) Integration. A LOSA program could be used to satisfy part of the internal audit requirements of § 5.71. A gap analysis would be required to ensure that it meets SMS standards.

LOSA result s, if present, should be included in the SA data acquisition process.

(8) Advanced Qualification Program (AQP).

(a) Program. The AQP is a systematic methodology for developing training program components for air carrier crewmembers and dispatchers. An AQP incorporates

data

- driven quality control processes for validating and maintaining the effectiveness of curriculum content. AQP is the subject of the current edition of AC 120

- 54, Advanced Qualification Program.

(b) Integration. The AQP can be used to satisfy a portion of the SMS SA monitoring requirement (§ 5.71(a)(1)). The certificate holder may elect to use or develop

an AQP, depending on their unique operational complexities.

Par 5

- 2 Page 59 (and 60)1/8/15 AC 120

- 92B Appendix 1

APPENDIX 1. SMS CROS S

- REFERENCE FOR TRANSITIONING SMS PILOT

PROJECT PARTICIPANTS

The following table provides a cross reference between Advisory Circular (AC) 120

- 92A, Appendix 1, Safety Management System Framework: Fun ctional Expectations, and Title 14 of

the Code of Federal Regulations (14 CFR) part 5. It is an aid to service providers who have implemented all or part of an SMS under AC 120

- 92A. The FAA emphasizes that this

cross

- reference chart does not mean that an existing process automatically satisfies the pertinent

par t 5 requirements. Certificate holders should conduct a gap analysis, or a similar procedure, to ascertain whether changes need to be made to their existing processes in order to satisfy the requirements of part 5.

FIGURE A1

- 1. SAFETY MANAGEMENT SYSTEM PILO T PROJECT 6

AC 120

- 92A

– PART 5 CROSS

- REFERENCE

AC 120

- 92A, Appendix 1 (SMSPP)

Framework Title 14 CFR P art 5

Component 1.0 Safety Policy and Objectives § 5.3(a)(1), Subpart A, General Requirements Element 1.1 Safety Policy § 5.21, Safety Policy, Subpart B Safety Policy Element 1.2 Management Commitment and Safety Accountabilities § 5.23

, Safety Accountability and Authority, § 119.65 Requirements, § 121.135 Manual Contents, and § 121.369 Manual Requirements Element 1.3 Key Safety Personnel § 5.25

, Designat ion and Responsibilities of Required Safety Management Personnel, § 119.65 Requirements Element 1.4 Emergency Preparedness and Response § 5.27

, Coordination of Emergency Response Planning

Element 1.5 SMS Documentation and

Records Subpart F, SMS Documenta tion and Recordkeeping, §§ 5.95, 5.97 and 121.135 Component 2.0 Safety Risk Management Subpart C, Safety Risk Management, § 5.51 Applicability Element 2.1 System Analysis & Hazard

Identification § 5.53

, System Analysis and Hazard

Identification

Process 2.1.1 System Description and Task Analysis § 5.53(a) and (b)

Process 2.1.2 Identify Hazards § 5.53(c)

Element 2.2 Risk Assessment and Control §5.55(a), Safety Risk Assessment and Control Process 2.2.1 Analyze Safety Risk § 5.55(a) Process 2.2.2 Assess Safety Risk § 5.55(b) Process 2.2.3 Control/Mitigate Safety Risk § 5.55(c)

6 This cross

- reference is included to assist carriers who originally developed their documentation in accordance with

AC 120

- 92A, Appendix 2, and for alignment with international standards. The items referen ced as “components” or “elements” are also consistent with International Civil Aviation Organization (ICAO) Annex 19, Appendix 2, the

ICAO SMS Framework.

Page 11/8/15 AC 120

- 92B Appendix 1

AC 120

- 92A, Appendix 1 (SMSPP)

Framework Title 14 CFR P art 5

Component 3.0 Safety Assurance Subpart D, Safety Assurance Element 3.1 Safety Performance Monitoring

and Measurement § 5.71, Safety Performance Monitoring and

Measurement Process 3.1.1 Continuous Monitoring § 5.71(a)(1) and (2) Process 3.1.2 Internal Audits by Operational Departments § 5.71(a)(3)

Process 3.1.3 Internal Evaluation § 5.71(a)(4) Process 3.1.4 External Auditing of the SMS § 5.71(a)(3)

Proce ss 3.1.5 Investigation § 5.71(a)(5) and (6) Process 3.1.6 Employee Reporting and Feedback System § 5.71(a)(7)

Process 3.1.7 Analysis of Data § 5.71(b) Process 3.1.8 System Assessment § 5.73(a), Safety Performance Assessment Element 3.2 Management of Change § 5.73(b) and (a)(2)

– (5) Element 3.3 Continuous Improvement § 5.75

, Continuous Improvement

Process 3.3.1 Preventive/Corrective Action § 5.75 Process 3.3.2 Management Review § 5.73(a) Component 4.0 Safety Promotion Subpart E, Safety Promotion Element 4.1 Competencies and Training § 5.91

, Competencies and Training Process 4.1.1 Personnel Requirements (Competence) § 5.91

Process 4.1.2 Training § 5.91

Element 4.2 Communication and Awareness § 5.93

, Safety Communication

Page 21/8/15 AC 120-92B Appendix 2

APPENDIX 2. SAFETY RISK MANAG EMENT (SRM) WORKSHEETS

The worksheets in this appendix are provided to illustrate the SRM process and a possible way to develop and do cument the SRM processes required under Title 14 of the Code of Federal Regulations (14 CFR ) part 5, subpart C. These worksheets are provided for illustrative purposes only. Carriers may develop their own record keeping systems and should determine the amount and depth of documentation and recordkeeping that are needed to show compliance. Not all situations will require the same degree of detail.

FIGURE A2

- 1. SAFETY RISK MANAG EMENT TRIGGERING CON DITIONS AND

SUMMARY

NOTE: Refer to part 5, § 5.51

Title:

Reason for Risk Assessment

New System Design
Change to Existing System Design
New Operational Procedure
Modification to an Existing Operation or Procedure
Operational Environment Change

Ineffective Risk Control

Brief Summary

Where signed below, the authorized manager has determined that no new hazards have been introduced by this change:

Name: Signature:

Page 11/8/15 AC 120

- 92B Appendix 2

FIGURE A2

- 2. SYSTEM ANALYSIS

NOTE: Refer to § 5.53(a) and (b).

Responsible Manager:

Authority for Implementation and Risk Acceptance:

Function and Purpose of the System or Change:

Description of Operating Environment Related Hazards

Personnel

Equipment

Facilities

Page 21/8/15 AC 120

- 92B Appendix 2

FIGURE A2

- 3. H AZARD LIST

NOTE: Refer to §§ 5.53(c) and 5.23 (a)(1).

System/Project:

__________________________

Responsible Manager:

__________________________

Hazard Potential Consequence(s)

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

Page 31/8/15 AC 120-92B Appendix 2

FIGURE A2

- 4. RISK ANALYSIS

NOTE: Refer to § 5.55(a).

Pre -Control Post -Control

H azard Potential Consequences Severity Likelihood Substitute

Risk? Severity Likelihood

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

P age 41/8/15 AC 120-92B Appendix 2

FIGURE A2

- 5. RISK ANALYSIS AND ASSESSMENT SUMMARY

NOTE: Refer to §§ 5.55(b) and 5.23(b).

Acceptance Authority (Sign here and Initial Appropriate Columns): ___________________

Pre -Control Accept? Post -Control Accept?

H azard Potential Consequences Severity Likelihood Severity Likelihood

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

P age 51/8/15 AC 120-92B Appendix 2

FIGURE A2

- 6. RISK CONTROL

NOTE: Refer to § 5.55(c) and (d).

System/Project: ___________________________________________________________

Responsible Manager: ___________________________________________________________

H azard Control Substitute Risk Residual Risk

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

P age 61/8/15 AC 120-92B Appendix 2

FIGURE A2 -7

. RISK C ONTROL DO CUMENTATION

NOTE: Refer to 14 CFR p art 5, subpart F.

S ystem/Project: ___________________________________________________________

H azard Procedure Documentation

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

P age 7 (and 8)1/8/15 AC 120

- 92B Appendix 3

APPENDIX 3. SAMPLE SAFETY POLICY STATEMENT

The Executive Management of [Certificate Holder’s name] recognizes that an effective Safety Management System (SMS) is vital to the success and longevity of the Company. Therefore the Executive Management is com mitted to implementing and maintaining a fully functional SMS and to the continuous improvement of the level of safety throughout [Certificate Holder’s name].

• Executive Management of [Certificate Holder’s name] will establish specific safety

- related object ives and will periodically publish and distribute to all employees those objectives and plans.

• These safety objectives will be monitored, measured, and tracked to ensure overall corporate safety objectives are met. All employees and individuals in the comp any have the responsibility to perform their duties and activities in the safest practical manner.

• [Certificate Holder’s name] Executive Management is committed to providing the necessary financial, personnel, and other resources to establish and maintain a fully

functional SMS.

• [Certificate Holder’s name] Executive Management is dedicated to establishing

a confidential employee reporting system to report all hazards, accidents, incidents, and safety issues without fear of reprisal.

• Activities involving int entional disregard for FAA regulations, company policies and procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary

action.

• As a component of the SMS, [Certificate Holder’s name] Executive Management is

committed to establis hing, maintaining, and periodically exercising an emergency response procedure and plan that provides for the safe transition from normal to emergency operations.

Executive Management will convey this expectation to all employees through postings, intranet site, company newsletter, and any other means to ensure all employees are aware of the company’s SMS, their duties and responsibilities, and our s afety p olicy.

This s afety p olicy will be periodically reviewed by Executive Management to ensure it remains relevant and appropriate to the company.

[Signed],

Accountable Executive [Additional management personnel optional]

Page 1 ( and 2)1/8/15 AC 120

- 92B Appendix 4

APPENDIX 4. IDENTIFYING THE ACCO UNTABLE EXECUTIVE

To assist the organization with the selection of their accountable executive, Figures A4

- 1 and 2 provide flowcharts wit h a series of questions. Figure A4

- 1 identifies different organiz ational structures and how those structures may determine the accountable executive.

FIGURE A4

- 1 . ACCOUNTABLE EXECUT IVE DECISION PROCESS

.

Page 11/8/15 AC 120

- 92B Appendix 4

FIGURE A4

- 2 . VERIFYING THE ACCO UNTABLE EXECUTIVE.

Once the accountable executive is identified (Figure A4

- 1 ), the questions in Figure 9 will assist in verifying that the selected person i s the correct choice. In Figure A4

- 2 , all questions must

receive a “yes” answer. Should any of the questions result in a “no” answer, you should start the selection process again with a new candidate.

Page 21/8/15 AC 120

- 92B Appendix 5

APPENDIX 5. SAMPLE GAP ANALYS IS AND IMPLEMENTATIO N PLAN

EXCERPTS

FIGURE A5

- 1 . AIR CARRIER GAP ANALYSIS TOOL

Page 11/8/15 AC 120

- 92B Appendix 5

FIGURE A5

- 2 . SAMPLE WORK BREAKOUT SCHEDU LE

Page 21/8/15 AC 120

- 92B Appendix 6

APPENDIX 6. REFERENCES AND ADDITIONAL INFORMATI ON

a. Safety Management System (SMS)

- Related Web S ites. For additional information regarding Safety Management Systems you may want to visit the following Web sites:

(1) FAA Public SMS Web site: http://www.faa.gov/about/initiatives/sms/specifics_by_aviation_industry_type/

(2) ICAO Publications and Resources Web site: http://www.icao.int/anb/safetymanagement/Documents.html

(3) ICAO SMS Training Web site: http://www.icao.int/anb/safetymanagement/training/tr aining.html

(4) Transport Canada SMS Web site: http://www.tc.gc.ca/civilaviation/sms/menu.htm

(5) Transport Canada Process to Assess Industry SMS Web site: http://www.tc.gc.ca/CivilAviation/SMS/Training/Module9/menu.htm

(6) Australian Government Civil Aviation Safety Authority SMS Training Web site: http://www.casa.gov.au/scripts/nc.dll?WCMS:STANDARD:1779027664:pc=PC_91435

(7) Civil Aviation Authority of New Zealand SMS Web site: http://www.caa.govt.nz/SMS/SMS_home.htm

(8) WBAT (Web

- Based Application Tool): WBAT (maintained by Universal Technical Resource Services, Inc. (UTRS)) provides aviation service providers with a secure, fully customizable system that promotes safety and accountability across five employee groups. UTRS developed WBAT with funding from the FAA, and will d eliver free on

- site training and electronic support to Certificate Holders. The UTRS point of contact can be reached at info@wbat.org.

(9) Advisory Circulars ( AC ) 00.2 and AC 00

- 44: The current edition of AC 00.2, Advisory Circular Checklist and Status of Othe r FAA Publications, contains a listing of all ACs.

The current edition of AC 00

- 44, Status of Federal Aviation Regulations, contains a listing of the

Code s of Federal Regulations (CFR) and current prices.

(10) ACs Online: You can get copies of this and other AC s online at http://www.faa.gov/regulations_policies/advisory_circulars.

(11) Regulations Online: You can also obtain a copy of current regulations online at http://www.gpoaccess.gov/ecfr.

(12) FAA Web Site: Our Web site is at http://www.faa.gov. The Flight Standards Information Management System (FSIMS) Web site is located at http://fsims.faa.gov.

Page 11/8/15 AC 120

- 92B Appendix 6

b. Related Reading Material. The following documents (current editions), may be helpful in developing an SMS:

• Title 14 CFR Part 5, Safety Management Systems for Certificate Ho lders Operating

under 14 CFR Part 121.

• AC 120

- 59, Air Carrier Internal Evaluation Programs (IEP).

• AC 120

- 66, Aviation Safety Action Programs (ASAP).

• AC 00

- 58, Voluntary Disclosure Reporting Program (VDRP).

• AC 120

- 79, Developing and Implementing a Continuin g Analysis and Surveillance System (CASS).

• AC 120

- 82, Flight Operational Quality Assurance (FOQA).

• Annex 6 to the Convention on Int ernational Civil Aviation, Part 1, International Commercial Air Transp ort, Aeroplanes (with Amendment 33).

• FAA Order 8000.369 , Safety Management System Guidance.

• FAA Order VS 8000.367, Aviation Safety (AVS) Safety Management System Requirements.

• International Civil Aviati on Organization (ICAO) Document 9859, ICAO Safety Manageme nt Manual (SMM, Second Edition, 2009).

Page 2