U.S. Department 

of Transportation 

Federal Aviation 

Administration 

Advisory 

Circular 

Subject: Safety Management Systems for 

Aviation Service Providers 

Date: 1/8/15

Initiated by: AFS-900 

AC No: 120-92B 

Change: 

This advisory circular (AC) provides information for Title 14 of the Code of Federal Regulations 

(14 CFR) part 121 air carriers that are required to implement Safety Management Systems 

(SMS) based on 14 CFR part 5. Specifically, this document provides a description of regulatory 

requirements, guidance, and methods of developing and implementing an SMS. This AC may 

also be used by other aviation service providers interested in voluntarily developing an SMS 

based on the requirements in part 5. 

An SMS is an organization-wide comprehensive and preventive approach to managing safety. 

An SMS includes a safety policy, formal methods for identifying hazards and mitigating risk, 

and promotion of a positive safety culture. An SMS also provides assurance of the overall safety 

performance of your organization. An SMS is intended to be designed and developed by your 

own people and should be integrated into your existing operations and business decisionmaking 

processes. The SMS will assist your organization’s leadership, management teams, and 

employees in making effective and informed safety decisions. 

Part 5 specifies a basic set of processes integral to an effective SMS but does not specify 

particular methods for implementing these processes. In other words, the regulation defines 

“what” must be accomplished, not “how” it must be accomplished. This AC provides additional 

guidance on how the SMS may be developed to achieve the safety performance objectives 

outlined by your organization. As is demonstrated by this AC, there is no one-size-fits-all 

method for complying with the requirements of part 5. This design is intentional, in that the 

Federal Aviation Administration (FAA) expects each air carrier to develop an SMS that works 

for its unique operation. Thus, this AC provides guidance regarding designing and implementing 

acceptable methods of compliance with the requirements of part 5. These methods, however, are 

not the only means of compliance. 

John S. Duncan 

Director, Flight Standards Service 

1/8/15 AC 120-92B

CONTENTS

Paragraph Page

CHAPTER 1. INTRODUCTION

1-1. Purpose..............................................................................................................................1

1-2. Applicability .....................................................................................................................1

1-3. Scalability .........................................................................................................................2

1-4. Contact Information..........................................................................................................2

CHAPTER 2. SAFETY MANAGEMENT SYSTEM (SMS) FOUNDATIONS

2-1. Safety Culture and Safety Management. ..........................................................................3

2-2. SMS Fundamentals...........................................................................................................4

2-3. Conceptual Overview of SRM and SA.............................................................................5

2-4. Definitions.........................................................................................................................7

CHAPTER 3. SAFETY MANAGEMENT SYSTEM (SMS) COMPONENTS EXPLAINED

3-1. Overview of the Structure of Chapter 3............................................................................9

3-2. Subpart A: General .........................................................................................................10

3-3. Subpart B: Safety Policy.................................................................................................12

3-4. Subpart C: Safety Risk Management..............................................................................17

3-5. Subpart D: Safety Assurance ..........................................................................................29

3-6. Subpart E: Safety Promotion ..........................................................................................42

3-7. Subpart F: SMS Documentation and Recordkeeping .....................................................45

CHAPTER 4: IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT 

SYSTEM (SMS)

4-1. Process Overview............................................................................................................49

4-2. Mapping and Analyzing Your Organization...................................................................50

4-3. Conducting a Gap Analysis ............................................................................................50

4-4. Preparing an Implementation Plan..................................................................................51

4-5. Phased SMS Implementation Strategy............................................................................52

CHAPTER 5: INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY 

MANAGEMENT SYSTEM (SMS)

5-1. Purpose of this Chapter...................................................................................................57

5-2. Discussion of Individual Programs.................................................................................57

Page iii
1/8/15 AC 120-92B

Paragraph Page

APPENDIX 1. SMS CROSS REFERENCE FOR TRANSITIONING SMS PILOT 

PROJECT PARTICIPANTS (2 pages).............................................................1

APPENDIX 2. SAFETY RISK MANAGEMENT (SRM) WORKSHEETS (8 pages)...........1

APPENDIX 3. SAMPLE SAFETY POLICY STATEMENT (2 pages)...................................1

APPENDIX 4. IDENTIFYING THE ACCOUNTABLE EXECUTIVE (2 pages) .................1

APPENDIX 5. SAMPLE GAP ANALYSIS AND IMPLEMENTATION PLAN

EXCERPTS (2 pages) .........................................................................................1

APPENDIX 6. REFERENCES AND ADDITIONAL INFORMATION (2 pages) ................1

LIST OF FIGURES

Figure 2-1. Safety Management Decisionmaking Processes.........................................................6

Figure 3-1. Safety Risk Management Processes and Regulatory Requirements.........................18

Figure 3-2. Sample Risk Matrix ..................................................................................................26

Figure 3-3. Safety Assurance Processes and Regulatory Requirements .....................................30

Figure 4-1. Recommended Safety Management System Implementation Levels.......................53

Figure 4-2. Safety Management System Development ...............................................................54

Page iv
1/8/15 AC 120-92B 

CHAPTER 1. INTRODUCTION

1-1. PURPOSE.

a. General. This advisory circular (AC) provides information to assist Title 14 of the

Code of Federal Regulations (14 CFR) part 121 certificate holders in developing a Safety 

Management System (SMS). It provides guidance material that aligns with the requirements, 

structure, and format of 14 CFR part 5, Safety Management Systems for Certificate Holders 

Operating under Part 121. It describes an acceptable means, but not the only means, to 

implement and maintain an SMS. Because complying with part 5 satisfies the SMS Standards of 

the International Civil Aviation Organization (ICAO), as published in ICAO Annex 19 for 

operations covered under Annex 6 Part I, the material in this AC is also consistent with those 

ICAO standards.1

b. Integration. An SMS is not meant to be a separate system built alongside or on top of

your other business systems. An SMS should be integrated into your existing business structure. 

A properly integrated SMS fosters a fundamental and sustainable change in how you view and 

analyze data and information, how you make informed decisions, and how you develop new 

operational and business methods. SMSs are necessary to comply with part 5, but they are not 

substitutes for compliance with other Federal regulations. However, SMSs can assist service 

providers in meeting other regulatory requirements. 

c. Scalability. The SMS requirements of 14 CFR part 5 are applicable to a wide variety of

types and sizes of operators. Therefore, those requirements are designed to be scalable, allowing 

operators to integrate safety management practices into their unique business models. An SMS 

should be tailored to each specific operator; therefore, this AC cannot provide a single means of 

compliance that applies to all certificate holders who are required to develop and implement 

an SMS.

1-2. APPLICABILITY.

a. This AC Applies to Part 121 Certificate Holders. This AC applies to businesses that

are considering applying for, have applied for, or hold a part 121 certificate. Part 5, § 5.1 requires 

a part 121 certificate holder to have an SMS that meets the requirements of part 5 and that is 

acceptable to the Administrator of the Federal Aviation Administration (FAA). Various methods 

of compliance may be accepted by the Administrator. The methods offered in this AC are not the 

only means of compliance with part 5; however, these have been found to be acceptable to 

the FAA. Your SMS implementation plan is the mechanism used to evaluate your method 

toward compliance.

1 ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data 

Analysis (FDA) program as part of their SMS. Part 5 will not require these programs. However, operators desiring 

to implement a Flight Operational Quality Assurance (FOQA, FAA equivalent to FDA) program on a voluntary 

basis can obtain FAA approval for these programs. For more information and a link to AC 120-82, go to 

https://www.faa.gov/about/initiatives/atos/air_carrier/foqa/. 

Par 1-1 Page 1 
1/8/15 AC 120-92B

b. If You Hold a Certificate Other Than Part 121 or are Not Certificated. This AC 

may also be helpful if you hold a certificate other than part 121 or are not certificated because 

this AC can be used to voluntarily develop and implement an SMS.

c. If You are Applying for a Part 121 Certificate. For a discussion of new applicants, 

refer to Chapter 4, subparagraph 4-1b.

1-3. SCALABILITY. The difference between a large, medium, and small organization’s SMS 

is primarily one of size and complexity of the operations to be covered, volume of data available, 

the size of the employee workforce, and the resources needed to manage the organization. The 

SMS requirements (safety policy, Safety Risk Management (SRM), Safety Assurance (SA), and 

safety promotion) are the same regardless of the size of your organization. However, part 5

allows organizations of different sizes to meet those requirements in different ways. The SMS 

functions do not need to be extensive or complex to be effective. All businesses, regardless of 

size, may use existing systems, programs and resources to document and track safety issues to 

resolution.

1-4. CONTACT INFORMATION. For additional information or suggestions, please contact 

the Flight Standards Service National Field Office (AFS-900) at 

9-NATL-SMS-ProgramOffice@faa.gov .

Par 1-2 Page 2
1/8/15 AC 120-92B

CHAPTER 2. SAFETY MANAGEMENT SYSTEM (SMS) FOUNDATIONS

2-1. SAFETY CULTURE AND SAFETY MANAGEMENT. One key aspect that is essential 

to safety performance is the culture of the organization. “Safety culture” is the term that we 

apply to those aspects of the organization’s culture that relate to safety performance. The concept 

of safety culture underlies safety management and is the basis for the SMS requirements of 

Title 14 of the Code of Federal Regulations (14 CFR) part 5.2

a. Interdependence. Because the culture of an organization includes the deeply ingrained 

and automatic psychological and behavioral aspect of human performance, there is a strong 

correlation between safety culture and accident prevention. Therefore, safety culture and SMS 

are interdependent. Management’s constant attention, commitment, and visible leadership are 

essential to guiding an organization toward a positive safety performance.

b. Safety Culture. Cultures are the product of the values and actions of the organization’s 

leadership as well as the results of organizational learning. Cultures are not really “created” or 

“implemented;” they emerge over time and as a result of experience. Organizations cannot 

simply purchase a software program, produce a set of posters filled with buzzwords, require their 

people to attend an hour of slide presentations, and instantly install an effective SMS. As with 

the development of any skill, it takes time, practice and repetition, the appropriate attitude, 

a cohesive approach, and constant coaching from involved mentors.

c. Management Framework. It is for this reason that a management framework that 

facilitates decisionmaking and shapes the environment in which employees work is crucial to 

organizational performance in all aspects of the organization’s business, including safety. 

A safety culture matures as safety management skills are learned and practiced and become 

second nature across the entire organization. The following have been found to be characteristics 

of organizations that consistently achieve safe results.

(1) Open Reporting. Policies and processes that foster open reporting while, at the 

same time, stressing the need for continuous diligence and professionalism. The organization 

should encourage disclosure of error without fear of reprisal, yet it should also demand 

accountability on the part of employees and management alike.

(2) Just Culture. The organization should engage in identification of systemic errors, 

implement preventative corrective action, and exhibit intolerance of undesirable behaviors such 

as recklessness or willful disregard for established procedures. This is often referred to as 

a “just culture.”

(3) Personnel Involvement. Involvement of line personnel and all levels of 

management in functions dealing with aviation safety, including the accountable executive, is 

critical to effective safety management throughout an organization.

2 While the concepts discussed in this section underlie the requirements of part 5, they are included solely for 

background purposes. The actual regulatory requirements of part 5 are discussed in Chapter 3.

Par 2-1 Page 3

 
1/8/15 AC 120-92B

(4) Use of Information. Effective use of all safety information assures informed 

management decisionmaking.

(5) Commitment to Risk Reduction. The organization expects direct management 

involvement in identifying hazards and managing risk.

(6) Vigilance. Processes that provide vigilance of ongoing operations and the 

environment to ensure effectiveness of risk controls and awareness of emerging hazards.

(7) Flexibility. Using information effectively to adjust and change to reduce risk, and 

a willingness to commit resources to making changes necessary to reduce risk.

(8) Learning. The organization learns from its own failures and from those of allied 

and similar businesses. The organization actually uses acquired data to feed analysis processes, 

the results of which yield information that can be acted upon to improve safety.

d. Management Involvement. Management leadership should demonstrate their visible 

commitment to and involvement in safe operation performing their daily work. SMS processes 

do not have to be expensive or sophisticated; however, active personal involvement of 

operational leaders is essential. Safety management must be accomplished by those managers 

who “own” the processes in which risk resides. Safety cultures also cannot be “created” or 

“implemented” by management decree, no matter how sincere their intentions. Every 

organization has a safety culture. It is embodied in the way the organization and its members 

approach safety in their jobs. If positive aspects of culture are to emerge, the organization’s 

management must set up the policies and processes that create a working environment that 

fosters safe behavior. That is the purpose of the SMS processes.

2-2. SMS FUNDAMENTALS.

a. What Is an SMS? SMSs can be a complex topic with many aspects to consider, but the 

defining characteristic of an SMS is that it is a decisionmaking system. An SMS does not have to 

be an extensive, expensive, or sophisticated array of techniques to do what it is supposed to do. 

Rather, an SMS is built by structuring your safety management around four components: safety 

policy, safety risk management (SRM), safety assurance (SA), and safety promotion. A brief 

description of these components is provided below.

b. Safety Policy. Safety policy is where you set objectives, assign responsibilities, and set 

standards. It is also where management conveys its commitment to the safety performance of the 

organization to its employees. As SRM and SA processes are developed, you will come back to 

the safety policy to ensure that the commitments in the policy are being realized and the 

standards are being upheld.

c. Safety Risk Management (SRM). The SRM component provides a decisionmaking 

process for identifying hazards and mitigating risk based on a thorough understanding of the 

organization’s systems and their operating environment. SRM includes decisionmaking 

regarding management acceptance of risk to operations. The SRM component is the 

organization’s way of fulfilling its commitment to consider risk in their operations and to reduce 

it to an acceptable level. In that sense, SRM is a design process, a way to incorporate risk 

Par 2-1 Page 4
1/8/15 AC 120-92B 

controls into processes, products, and services or to redesign controls where existing ones are not 

meeting the organization’s needs.

d. Safety Assurance (SA). SA provides you with the necessary processes to give you

confidence that your system is meeting your organization’s safety objectives and that your 

mitigations, or risk controls, developed under SRM are working. In SA, your goal is to watch 

what is going on and review what has happened to ensure that your objectives are being met. 

Thus, SA requires monitoring and measuring safety performance of operational processes and 

continuously improving the level of safety performance. Strong SA processes will yield 

information used to maintain the integrity of risk controls. SA processes are thus a means of 

assuring the safety performance of the organization, keeping it on track, correcting it where 

necessary, and identifying needs for rethinking existing processes. 

e. Safety Promotion. The last component, safety promotion, is designed to ensure that

your employees have a solid foundation regarding their safety responsibilities, the organization’s 

safety policies and expectations, reporting procedures, and a familiarity with risk controls. Thus, 

training and communication are the two key areas of safety promotion. 

f. Summary. An SMS does not have to be large, complex, or expensive in order to add

value. If you have active involvement of the operational leaders, maintain open lines of 

communication up and down the organization and among peers, stay vigilant in looking for new 

operations, and ensure that your employees know that safety is an essential part of their job 

performance, you will have an effective SMS that helps you make better safety management 

decisions.

2-3. CONCEPTUAL OVERVIEW OF SRM AND SA.

a. Graphical Overview of SRM and SA Processes. Figure 2-1, Safety Management

Decisionmaking Processes, provides an expanded view of the principal two sets of processes of 

the SMS: SRM and SA. In the discussion that follows, we’ll introduce some key terms and 

concepts related to SMS processes. A more detailed discussion of the SRM and SA processes is 

set out in Chapter 3, Safety Management System (SMS) Components Explained. Because safety 

management is a decisionmaking process, the SRM and SA processes follow a set of processes

outlined in Figure 2-1. These processes work as follows. The Description and Context step 

requires the user of the process to gain an overall understanding and context of the operation that 

either is being or will be performed. The Specific Information step requires the user of the 

process to obtain information about aspects of the systems and environments involved that may 

present risk. Under the Analysis step, the user analyzes or makes sense of that information. The 

Assessment step requires the user to make decisions regarding the acceptability or risk of system 

performance. Finally, under the Resolution step, the user takes necessary action.

Par 2-2 Page 5 
1/8/15 AC 120-92B 

FIGURE 2-1. SAFETY MANAGEMENT DECISIONMAKING PROCESSES.

b. SRM.

(1) In SRM, the first step, System Description (Analysis), is used to understand the 

aspects of the operation that might cause harm. In most cases, Hazard Identification flows from 

this system analysis. Hazard identification requires you to ask: What hazards exist in the 

operational environment? What are the human factors issues of the operation (e.g., workload, 

distraction, fatigue, or system complexity)? What are the limitations of the hardware, software, 

procedures, etc.?

(2) While the diagram above depicts that processes as distinctly defined components, in 

practice they flow from one to the other. For example, in a careful discussion of how a system 

currently works (System Description (Analysis)), hazards will often become evident. Thus, the 

hazard identification step has also been at least partially accomplished.

Par 2-3 Page 6 
1/8/15 AC 120-92B

(3) The process then progresses into an analysis of the potential consequences of 

operation in the presence of the identified hazards (Risk Analysis). This culminates in an 

assessment of the acceptability of operating with these hazards, Risk Assessment, or whether or 

not the risk of such operations can be mitigated to an acceptable level, Risk Control. For this 

reason, operational managers must be the ones who are accountable for these decisions.

(4) After a system has been designed or revised using the SRM process, special 

attention should be given to the new or revised system using the SA process. It should not be 

surprising to find at this time that there are still things that might not have been considered or 

that there are changes over time in the operational environment, requiring a return to SRM. Thus, 

the SRM and SA processes operate in a continuous exchange.

c. SA and Interactions with SRM.

(1) In SA, the process continues with measuring and monitoring the performance of the 

system operation, System Monitoring, with the designed risk controls in place. This involves 

a variety of data sources (Data Acquisition) that will be further explained in Chapter 3. As in 

SRM, the data will need to be analyzed in order for it to be used in decisionmaking, Analysis of 

Data. In the case of SA, the decisionmaking can result in several paths, System Assessment. If 

the data and analysis say that the system and its risk controls are functioning as intended, the 

result is confirmatory: the management now can have confidence in system safety performance.

(2) If this is not the case, the analysis needs to continue to determine if the shortfall is 

due to the fact that the controls are not being used as intended (e.g., required training not 

accomplished, procedures not followed, org improper tools or equipment provided), or if, even 

though the system is being used as intended, it is not producing the expected results. In the 

former case, action should be taken to correct the problem, Corrective Action. In the latter case, 

the system design should be reconsidered using the path back to the SRM process.

(3) The path back to SRM is a particularly important part of the SA process, especially 

for carriers who are transitioning into SMS. Their operational systems have likely not been built 

using an SRM process, so they may lack formal or well understood risk controls. The SA process 

covers the day-to-day life of system operations, so, in many cases, the determination to review 

existing processes for hazard and risk may be the first time that these aspects of operation have 

been considered.

(4) As in SRM, managers who are responsible for operational processes are the ones 

who are also responsible for assuring that they are performing as intended from a safety, as well 

as operational, standpoint. Moreover, correct design, performance, and risk control need to be 

a concern of top management, including the accountable executive.

2-4. DEFINITIONS.

a. Hazard. A condition that could foreseeably cause or contribute to an aircraft accident 

as defined in Title 49 of the Code of Federal Regulations (49 CFR) part 830, § 830.2.

b. Risk. The composite of predicted severity and likelihood of the potential effect of 

a hazard.

Par 2-3 Page 7
1/8/15 AC 120-92B

c. Risk Control. A means to reduce or eliminate the effects of hazards.

d. Safety Assurance (SA). Processes within the SMS that function systematically to 

ensure the performance and effectiveness of safety risk controls and that the organization meets 

or exceeds its safety objectives through the collection, analysis, and assessment of information.

e. Safety Management System (SMS). The formal, top-down, organization-wide 

approach to managing safety risk and assuring the effectiveness of safety risk controls. It 

includes systematic procedures, practices, and policies for the management of safety risk.

f. Safety Objective. A measurable goal or desirable outcome related to safety.

g. Safety Performance. Realized or actual safety accomplishment relative to the 

organization’s safety objectives.

h. Safety Policy. The certificate holder’s documented commitment to safety, which 

defines its safety objectives and the accountabilities and responsibilities of its employees in 

regard to safety.

i. Safety Promotion. A combination of training and communication of safety information 

to support the implementation and operation of an SMS in an organization.

j. Safety Risk Management (SRM). A process within the SMS composed of describing 

the system, identifying the hazards, and analyzing, assessing, and controlling risk.

Par 2-4 Page 8
1/8/15 AC 120-92B

CHAPTER 3. SAFETY MANAGEMENT SYSTEM (SMS) COMPONENTS EXPLAINED

3-1. OVERVIEW OF THE STRUCTURE OF CHAPTER 3. SMS requirements are 

organized around building blocks of safety management. These processes are essential for 

an SMS. This chapter contains short descriptions of each SMS component and the processes 

contained therein. After the title of each process are the following.

a. Specific Regulatory Requirement (SRR). The SRR for the process (where it may be 

found in Title 14 of the Code of Federal Regulations (14 CFR) part 5).

b. Related Regulatory Requirements. Where applicable, to help put part 5 in context of 

existing regulations and provide reference for interrelated requirements within part 5, e.g., 

requirements for management accountability related to a process.

c. Tracking Tags.3 A reference to International Civil Aviation Organization

(ICAO)/former Safety Management System Pilot Project (SMSPP) - Component/Element tags. 

These do not denote legal requirements; they are provided solely as reference to facilitate 

cross-referencing and gap analysis on the part of SMSPP participants to assist them in revising

their plans and systems to comply with part 5. The Federal Aviation Administration (FAA) 

emphasizes that fully complying with part 5 satisfies almost all4 of the pertinent ICAO SMS 

requirements.

d. A Summary. A brief plain language overview of the process.

e. An Objective. A brief explanation of the goal of the process.

f. A Regulatory Text Box. A copy of part 5 regulatory text, for reference, which should 

facilitate readers’ ability to relate regulatory requirements with explanations without the need to 

cross-reference additional documents.

g. A Discussion. A more detailed plain language explanation of the process as it relates to 

the SMS. It includes some examples, when appropriate, and offers optional Recommended 

Design Characteristics.

h. Scalability. A short discussion, where applicable, of scalability, providing examples of 

how different-sized carriers can meet the pertinent SMS requirements. Information on scalability 

is broken down into small, medium, and large carriers. Small carriers are generally defined as 

those carriers operating fewer than 10 airplanes; medium carriers are those with fewer than 

48 airplanes; and large carriers are those with more than 48 airplanes.

3 These tags are included to assist carriers who originally developed their documentation in accordance with 

AC 120-92A, Appendix 2, and for alignment with international standards. The items referenced as “components” or 

“elements” are also consistent with ICAO Annex 19, Appendix 2, the ICAO SMS Framework.

4 ICAO Safety Management standards require operators of airplanes over 27,000 kg to have include a Flight Data 

Analysis (FDA) program as part of their SMS. Part 5 will not require these programs.

Par 3-1 Page 9

 
1/8/15 AC 120-92B

NOTE: The scalability discussions are for illustration only and impose 

neither requirements nor resource allocation by a service provider.

3-2. SUBPART A: GENERAL.

a. Applicability: Requirements for Implementation.

(1) SRR. Part 5, § 5.1.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

(5) Discussion. The SMS required by this regulation is intended to cover only the 

aviation operational processes of the carrier. For example, the aviation operational processes in

a typical carrier may include:

• Flight operations,

• Operational control (dispatch/flight following),

• Maintenance and inspection,

• Cabin safety,

• Ground handling and servicing,

• Cargo handling, and

• Training.

NOTE: Information concerning implementation planning for 14 CFR 

part 121 certificate holders and applicants for part 121 certificates is outlined 

in greater detail in Chapter 4, Implementation: Building a Safety 

Management System (SMS).

b. General Requirements: Components of an SMS.

(1) SRR. Section 5.3(a).

(2) Related Regulatory Requirements. None.

§ 5.1 Applicability.

(a) A certificate holder under part 119 of this chapter authorized to conduct operations in accordance with 

the requirements of part 121 of this chapter must have a Safety Management System that meets the 

requirements of this part and is acceptable to the Administrator by March 9, 2018.

(b) A certificate holder must submit an implementation plan to the FAA Administrator for review no later 

than September 9, 2015. The implementation plan must be approved no later than March 9, 2016.

(c) The implementation plan may include any of the certificate holder’s existing programs, policies, or 

procedures that it intends to use to meet the requirements of this part, including components of an existing 

SMS.

Par 3-1 Page 10
1/8/15 AC 120-92B

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

(5) Discussion. For a discussion on size, scope and complexity with regard to SMS 

scalability, see paragraph 1-3 and the scalability examples in this chapter.

c. Recordkeeping Requirements.

(1) SRR. Section 5.3(b).

(2) Related Regulatory Requirements. Section 5.95.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

(5) Discussion. Documentation and recordkeeping requirements are in part 5, subpart F.

d. Compliance with Code of Federal Regulations (CFR).

(1) SRR. Section 5.3(c).

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Part 5 Requirements.

§ 5.3 General requirements.

(a) Any certificate holder required to have an SMS under this part must submit the Safety Management 

System to the Administrator for acceptance. The SMS must be appropriate to the size, scope, and 

complexity of the certificate holder’s operation and include at least the following components:

(1) Safety policy in accordance with the requirements of subpart B of this part;

(2) Safety risk management in accordance with the requirements of subpart C of this part;

(3) Safety assurance in accordance with the requirements of subpart D of this part; and

(4) Safety promotion in accordance with the requirements of subpart E of this part.

§ 5.3 General requirements.

(b) The Safety Management System must be maintained in accordance with the recordkeeping requirements 

in subpart F of this part.

§ 5.3 General requirements.

(c) The Safety Management System must ensure compliance with the relevant regulatory standards in chapter I 

of Title 14 of the Code of Federal Regulations.

Par 3-2 Page 11
1/8/15 AC 120-92B

3-3. SUBPART B: SAFETY POLICY.

a. Introduction.

(1) SRR. Part 5, subpart B.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. N/A.

(4) Summary. This section of the advisory circular (AC) provides guidance about how 

the accountable executive, in coordination with other senior managers, might define safety 

performance objectives, assign accountability, and allocate resources. The safety policy should 

be appropriate to the size, scope, and complexity of the operation. Additionally, the safety policy 

component is where your management defines their commitment to managing safety throughout 

the organization.

b. Safety Policy.

(1) SRR. Section 5.21.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.1.

(4) Part 5 Requirements.

(5) Discussion. The safety policy statement is a concise document from the accountable 

executive that conveys the organization’s basic commitments to safety management. It provides 

a basis for more detailed setting of objectives for planning and performance measurement, 

assignment of responsibility, and reporting, including clear statements regarding behavioral and 

performance expectations. The safety policy may be supported by additional documents that 

expand in specific areas, and, where applicable, it may also set out procedures. An example of a

§ 5.21 Safety policy.

(a) The certificate holder must have a safety policy that includes at least the following:

(1) The safety objectives of the certificate holder.

(2) A commitment of the certificate holder to fulfill the organization's safety objectives.

(3) A clear statement about the provision of the necessary resources for the implementation of the 

SMS.

(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or 

issues.

(5) A policy that defines unacceptable behavior and conditions for disciplinary action.

(6) An emergency response plan that provides for the safe transition from normal to emergency 

operations in accordance with the requirements of § 5.27.

(b) The safety policy must be signed by the accountable executive described in § 5.25.

(c) The safety policy must be documented and communicated throughout the certificate holder 

organization.

(d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains 

relevant and appropriate to the certificate holder.

Par 3-3 Page 12
1/8/15 AC 120-92B

safety policy statement can be found in Appendix 3, Sample Safety Policy Statement. 

Section 5.21(a)(1) requires carriers to develop safety objectives as part of their safety policy. The 

assessment process required by § 5.73 is where decisions are made regarding attainment of these 

objectives. In setting these objectives, this is a case where “starting with the end in sight” is 

sound advice. Objectives can fall into a number of categories, including:

• Compliance with regulations. Compliance with all regulations is an expectation 

for all carriers and assurance of such compliance is an explicit requirement of 

the SMS (refer to § 5.3(b)).

• Milestones for implementation of safety-related programs or initiatives.

• Reduction of error or incident rates.

• Tracking of safety events. Certain events such as ground damage, pilot 

deviations, weight and balance errors, or maintenance errors may be targets for 

safety objectives and associated tracking and action. One caution with these 

types of measures is not to lose focus on risk factors that may be associated with 

potentially more serious events.

(6) Scalability. Safety policies would not be expected to vary between small, medium, 

and large organizations; however, the levels of management involved in preparation and 

implementation of the policy may vary.

(a) Small. The owner or most senior manager (the accountable executive) may 

personally perform this process. The policy can be a simple, often single-page, written 

document, signed by the accountable executive. Small organizations typically operate in smaller 

networks of employees, so the policy may be posted in company work areas or included in 

company briefings or in training.

(b) Medium. The accountable executive, with the involvement of other senior 

managers, is likely to develop, publish, and communicate the safety policy. The policy may be 

disseminated via company newsletters, company Web sites, employee briefings, or existing 

indoctrination and recurrent training.

(c) Large. A large organization may require the accountable executive or other 

senior managers and technical staff to perform this process. While the regulations only require 

the accountable executive to sign the safety policy, members of senior management may also 

sign the safety policy. Large carriers may disseminate their policy using a variety of resources 

such as company Web sites, intranets, email, or existing indoctrination and recurrent training.

c. Safety, Accountability, and Authority.

(1) SRR. Section 5.23.

(2) Related Regulatory Requirements. Section 5.25 and 14 CFR part 119, § 119.65.

Par 3-3 Page 13
1/8/15 AC 120-92B

(3) ICAO/SMSPP. Element 1.2.

(4) Part 5 Requirements.

(5) Discussion. This SMS process requires defined accountability for achieving safety 

performance objectives within the organization’s safety policy for the following individuals:

NOTE: “Accountability” as used here, refers to active management and line 

employee involvement and action in managing and maintaining safety 

performance. A certificate holder defines accountability by ensuring that 

each of its management and line employees is aware of his or her specific role 

within SMS and actively participates in carrying out his or her SMS-related 

duties. Once the accountabilities for these employees have been defined, 

Subpart D (Safety Promotion) requires that these accountabilities be 

communicated throughout the organization.

(a) Accountable Executive. The accountable executive has the ultimate 

responsibility for safety management within the organization. The specific duties of the 

accountable executive are discussed in more detail in the discussion of § 5.25 below.

(b) All Members of Management. Managers are the individuals who are 

responsible for identifying hazards, conducting risk assessments, and developing risk controls for 

their areas of responsibility. They have the technical expertise and are the ones responsible for 

implementation and operation of risk controls (often in the form of operational procedures, 

specified tools, training, communication, etc.). A key element in your SRM process is to identify 

the levels of management with the authority to make risk decisions related to aviation safety. 

Thus, managers that have the authority to implement changes in systems and procedures must 

use the SMS processes in managing their area of operational responsibility. They are also 

responsible for assuring the continuing operational safety of risk controls. Through data 

collection methods and analytical processes in the SA component, managers are able to 

determine that risk controls are effective and that their safety performance is acceptable. For 

example, the Director of Maintenance (DOM) is one of the managers accountable for SMS 

within his or her area of responsibility.

§ 5.23 Safety accountability and authority.

(a) The certificate holder must define accountability for safety within the organization’s safety policy for 

the following individuals:

(1) Accountable executive, as described in § 5.25.

(2) All members of management in regard to developing, implementing, and maintaining SMS 

processes within their area of responsibility, including, but not limited to:

(i) Hazard identification and safety risk assessment.

(ii) Assuring the effectiveness of safety risk controls.

(iii) Promoting safety as required in subpart E of this part.

(iv) Advising the accountable executive on the performance of the SMS and on any need for 

improvement.

(3) Employees relative to the certificate holder’s safety performance.

(b) The certificate holder must identify the levels of management with the authority to make decisions 

regarding safety risk acceptance.

Par 3-3 Page 14
1/8/15 AC 120-92B

(c) Employees. All employees should be aware of the company’s safety policies, as 

well as the processes, procedures, and tools relevant to their responsibilities. They need to know 

how the confidential employee reporting system works. Employees have a duty and 

responsibility to follow an organization’s processes and procedures.

(6) Scalability. The method for meeting these requirements is not expected to vary 

greatly between different organizations. Rather, the numbers and relationships of personnel will 

be unique to each organization.

d. Designation and Responsibilities of Required Safety Management Personnel. This 

section of the regulation addresses two processes: (1) Designation and Responsibilities of the 

Accountable Executive, and (2) Designation and Responsibilities of Safety Management 

Personnel.

(1) Designation and Responsibilities of the Accountable Executive.

(a) SRR. Sections 5.25(a) and (b).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 1.3.

(d) Part 5 Requirements.

(e) Discussion.

1. Designation. Section 5.25(a) requires the organization to identify an alreadyexisting person in the organization who holds the ultimate decisionmaking authority over the 

§ 5.25 Designation and responsibilities of required safety management personnel.

(a) Designation of the accountable executive. The certificate holder must identify an accountable 

executive who, irrespective of other functions, satisfies the following:

(1) Is the final authority over operations authorized to be conducted under the certificate 

holder’s certificate(s).

(2) Controls the financial resources required for the operations to be conducted under the 

certificate holder’s certificate(s).

(3) Controls the human resources required for the operations authorized to be conducted under 

the certificate holder’s certificate(s).

(4) Retains ultimate responsibility for the safety performance of the operations conducted under 

the certificate holder’s certificate.

(b) Responsibilities of the accountable executive. The accountable executive must accomplish the 

following:

(1) Ensure that the SMS is properly implemented and performing in all areas of the certificate 

holder’s organization.

(2) Develop and sign the safety policy of the certificate holder.

(3) Communicate the safety policy throughout the certificate holder’s organization.

(4) Regularly review the certificate holder's safety policy to ensure it remains relevant and 

appropriate to the certificate holder.

(5) Regularly review the safety performance of the certificate holder’s organization and direct 

actions necessary to address substandard safety performance in accordance with § 5.75.

Par 3-3 Page 15
1/8/15 AC 120-92B

certificate holder’s operations. This person is responsible for planning, organizing, directing, and 

controlling the personnel, organizational structure, financial, and other resources necessary for 

safe flight operations. A flowchart outlining a process for designating an accountable executive 

is available in Appendix 4, Identifying the Accountable Executive.

2. Responsibilities. As the ultimate authority in the organization, the 

accountable executive is responsible for the proper functioning of the SMS. This entails, among 

other things, keeping an open line of communication with the designated management personnel, 

providing sufficient resources for the SMS to function properly, and being actively involved in 

the SA component of SMS, discussed below.

3. Scalability. In smaller organizations, the accountable executive may 

personally participate in or directly supervise operational processes. This individual may serve in 

multiple positions within the company. In larger organizations, the accountable executive is 

responsible for ensuring that management personnel are clearly designated for ensuring the 

safety of operational and safety management processes.

(2) Designation and Responsibilities of Required Safety Management Personnel.

(a) SRR. Section 5.25(c).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 1.3.

(d) Part 5 Requirements.

(e) Discussion. This section of the regulation requires the company to ensure that 

sufficient personnel are available to provide support for essential SMS functions, such as 

analysis, assistance to operational managers in meeting their safety management responsibilities, 

and acting as a safety advisor to the accountable executive. These responsibilities may be carried 

out as collateral duties by managers referred to in § 5.23(a)(2), or the carrier could assign the 

tasks of supporting SMS functions to other personnel. For example some organizations may 

choose to use their existing required management personnel under § 119.65 to fulfill these 

responsibilities. Other organizations may organize a Safety Department with a number of 

persons or use existing personnel within each operational division.

§ 5.25 Designation and responsibilities of required safety management personnel.

(c) Designation of management personnel. The accountable executive must designate sufficient 

management personnel who, on behalf of the accountable executive, must be responsible for the 

following:

(1) Coordinate implementation, maintenance, and integration of the SMS throughout the 

certificate holder’s organization.

(2) Facilitate hazard identification and safety risk analysis.

(3) Monitor the effectiveness of safety risk controls.

(4) Ensure safety promotion throughout your organization as required in subpart E of this part.

(5) Regularly report to the accountable executive on the performance of the SMS and on any need 

for improvement.

Par 3-3 Page 16
1/8/15 AC 120-92B 

NOTE: The final rule preamble states: “Personnel designated to perform 

this function must be in positions in the organization of sufficient

independence to have direct access to the accountable executive to report on 

the safety performance of the operation and recommend and necessary 

improvements.” 

e. Coordination of Emergency Response Planning.

(1) SRR. Section 5.27.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.4.

(4) Part 5 Requirements.

(5) Discussion. The plan should provide procedures for management decisionmaking 

and action in an emergency. This should include a line of succession of management authority 

sufficient to respond to emergencies. Coordination of your emergency response plans with the 

emergency response plans of other organizations might include first responders to accidents or 

incidents, airport authorities, and hazardous materials (hazmat) authorities. The plan might also 

address how you return or transition to normal operations after the emergency condition 

subsides. Many organizations already have emergency response plans that may be used to fulfill 

this requirement.

3-4. SUBPART C: SAFETY RISK MANAGEMENT.

a. Introduction.

(1) SRR. Part 5, Subpart C.

(2) Related Regulatory Requirements. Section 5.23(a)(2).

(3) ICAO/SMSPP. Component 2.0.

(4) Summary. SRM is a formal system for identifying and mitigating risk. There are

five processes necessary to control and mitigate risk. These processes are featured in Figure 3-1, 

Safety Risk Management Processes and Regulatory Requirements, and are discussed in more 

detail below. These are:

§ 5.27 Coordination of emergency response planning.

Where emergency response procedures are necessary, the certificate holder must develop and the 

accountable executive must approve as part of the safety policy, an emergency response plan that addresses 

at least the following:

(a) Delegation of emergency authority throughout the certificate holder’s organization;

(b) Assignment of employee responsibilities during the emergency; and

(c) Coordination of the certificate holder’s emergency response plans with the emergency response plans 

of other organizations it must interface with during the provision of its services.

Par 3-3 Page 17 
1/8/15 AC 120-92B 

• System description and analysis.

• Hazard identification.

• Safety risk analysis.

• Safety risk assessment.

• Safety risk controls.

FIGURE 3-1. SAFETY RISK MANAGEMENT PROCESSES AND REGULATORY 

REQUIREMENTS

b. Applicability: Requirements to Apply SRM.

(1) SRR. Section 5.51.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Component 2.0.

(4) Objective. To determine situations where the SRM process must be applied.

System

Analysis

(Design)

Hazard

Ident

Risk

Control

Risk

Assmt

Risk

Analysis

Start Inputs: 5.51

•New System

•System Change

•New Operational Procedure

Outputs: To SA Subpart D

Inputs From SA: 5.71(b)

5.53(a)&(b)

5.53(c)

5.55(b)

5.55(c)

5.55(a)

Evaluate

Controls

5.55(c)(1)

5.53 System 

Analysis & 

Hazard 

Identification 

5.55 Risk 

Assessment 

& Control

SRM

(Subpart c)

Par 3-4 Page 18 
1/8/15 AC 120-92B

(5) Part 5 Requirements.

(6) Discussion.

(a) To know when SRM process may be required, it is important to know what 

a system is. Systems could be people, hardware, software, information, procedures, facilities, 

services, and other support facets which are directly related to the organization’s aviation safety 

activities. Examples of broad-based systems could include:

• Flight operations,

• Operational control (dispatch/flight following),

• Maintenance and inspection,

• Cabin safety,

• Ground handling and servicing,

• Cargo handling, and

• Training.

(b) Within these systems there are subsystems. Some examples of subsystems 

include crew scheduling systems, training curricula, maintenance control, deicing, fueling, 

aircraft fleet, ground operations, and hazmat training.

(c) Under § 5.51, the SRM process is triggered when proposed new systems or 

changes to systems are being considered. For example, changes to your operation could include 

the addition of new routes, opening or closing of line stations, adding or changing contractual 

arrangements for services, additions of new fleets or major modifications of existing fleets, 

addition of different types of operations such as Extended Operations (ETOPS), or any one of 

many different types of operations. The SRM process is not triggered solely by major changes to 

a system; it is triggered by any revision of an existing system. However, the level of SRM 

documentation needed for smaller changes to a system may be significantly smaller than for 

major changes.

NOTE: It is not the intent of part 5 to require the application of SRM 

processes and procedures to activities that are not related to aviation 

operations.

c. System Analysis and Hazard Identification. This section of the regulation addresses 

the following two processes: (1) System Description and Analysis, and (2) Hazard Identification.

§ 5.51 Applicability

A certificate holder must apply safety risk management to the following:

(a) Implementation of new systems.

(b) Revision of existing systems.

(c) Development of operational procedures.

(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D 

of this part.

Par 3-4 Page 19
1/8/15 AC 120-92B

NOTE: Appendix 2, Safety Risk Management (SRM) Worksheets, contains 

a set of worksheets that may be useful for conducting SRM.

(1) System Description and Analysis.

(a) SRR. Section 5.53(a) and (b).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 2.1/Process 2.1.1.

(d) Objective. To gain an understanding of the components and elements of 

operational systems, processes, procedures and the operational environment.

(e) Part 5 Requirements.

(f) Discussion. Systems analysis is the primary means of proactively identifying 

and addressing potential problems before the new or revised systems or procedures are put into 

place. The system analysis should explain the functions and interactions among the hardware, 

software, people, and environment that make up the system in sufficient detail to identify hazards 

and perform risk analyses. The process is started by describing the system (this can be as simple

as flowcharting the system or writing a short narrative).

1. An example of system description and analysis might involve the need in 

your operations for a new aircraft (or fleet of aircraft) to meet your company or corporate goals. 

Several of your organizational “systems” would be affected: flight operations, maintenance, 

station, ground, etc. As part of your examination of the flight operations system, you would need 

to consider changes to pilot qualifications, pilot and mechanic training, scheduling, crew rest, 

union participation, and several other areas. This is a process normally done as part of your 

business activities.

2. Your system analysis should identify and consider activities and resources 

necessary for the system to function. For example, in the scenario of adding aircraft to your fleet, 

you would identify for the pilot training system, as one of the affected systems, the activities and 

resources necessary for pilot training to pilot the additional aircraft. These may include 

simulators, training curriculum, training aids, and instructors.

§ 5.53 System analysis and hazard identification.

(a) When applying safety risk management, the certificate holder must analyze the systems 

identified in § 5.51. Those safety analyses must be used to identify hazards under paragraph (c) of 

this section, and developing and implementing risk controls related to the system under § 5.55(c).

(b) In conducting the system analysis, the following information must be considered:

(1) Function and purpose of the system.

(2) The system’s operating environment.

(3) An outline of the system’s processes and procedures.

(4) The personnel, equipment, and facilities necessary for operation of the system.

Par 3-4 Page 20
1/8/15 AC 120-92B

3. The above example of adding aircraft to your fleet would entail 

consideration of several systems and a variety of procedures due to the number of processes that 

would be affected. However, in a simpler case, such as a change in the procedure for arming 

cabin doors prior to pushback, only those elements of the systems that would be affected by the 

change would need to be considered. The carrier would not be expected to perform a 

comprehensive analysis of the entire cabin safety system.

4. The system description and analysis process frequently includes 

representatives from management, safety staff, subject matter experts (SME), employees, and 

representation groups (e.g., unions) formed into workgroups such as safety committees, safety 

roundtables, safety action groups, or similar titles. Since many, if not most, system changes 

involve allocation of resources, the accountable executive or other managers with the authority to 

commit resources should be included in the process.

5. The outputs could be recorded in a simple recording medium such as 

a worksheet or a notebook, common desktop software, or a Web-Based Application Tool 

(WBAT), (see Appendix 6). Appendix 2 provides an example of a set of worksheets that could 

be used as paper records or converted to a variety of software applications, including desktop 

spreadsheets or WBATs.

(g) Scalability.

1. Small. System description and analysis could be performed by the 

owner/manager and/or another assigned employee(s). An analysis could consist of a discussion 

among managers such as the Director of Operations (DO) and/or Chief Pilot or other individuals 

designated by them.

2. Medium. System description and analysis could be performed by a member 

of management or one of the designated SMS management representatives with a small 

workgroup of company SMEs and stakeholders.

3. Large. System description and analysis might be performed at multiple 

organizational levels (e.g., corporate, division, or department) and facilitated by the Safety 

Department/division or its equivalent. The organization might have standing committees of 

SMEs and stakeholders participating at various levels.

(2) Hazard Identification.

(a) SRRs. Section 5.53(c).

(b) Related Regulatory Requirements.

• Section 5.23(a)(2)(i): Accountabilities of members of management; and

• Section 5.25(c)(2): Responsibilities of safety management personnel.

(c) ICAO/SMSPP. Element 2.1/Process 2.1.2.

Par 3-4 Page 21
1/8/15 AC 120-92B

(d) Objective. To examine operational systems, operations, processes, and the 

operational environment in order to identify conditions that could result in an aircraft accident.

(e) Part 5 Requirements.

(f) Discussion. The hazard identification process flows from the system analysis. In 

hazard identification, you would ask: What could go wrong with your processes, under typical or 

abnormal operational conditions, that could cause an accident?

1. Most often the same individuals or groups conducting the system analysis 

process (safety committees, safety roundtables, etc.) would conduct hazard identification. You 

use your experience, FAA requirements, manufacturers’ technical data, and knowledge of your 

operations to identify hazards to your operation. For example, a newly modified component of 

an aircraft cabin door might require new arming and disarming procedures by flight attendants 

and new signaling procedures for station personnel upon aircraft arrival at a passenger gate. 

Hazards could include the effectiveness of new procedure training, employees missing training, 

failing to read or understand newly published procedures, supervisors failing to monitor the new 

procedures, etc. While identification of every conceivable hazard is unlikely, you are expected to 

exercise due diligence in identifying hazards that could foreseeably lead to an aircraft accident.

2. The output of hazard identification could be recorded in a simple recording 

medium such as a spreadsheet or paper files, or software such as a WBAT.

(g) Scalability.

1. Small. Hazard identification could be performed by the owner/manager 

and/or another employee(s), often as part of the system analysis.

2. Medium. As in the system analysis, hazard identification could be performed 

by a member of management or a designated SMS management representative with a small 

workgroup of company SMEs and stakeholders.

3. Large. Hazard identification might be performed at multiple organizational 

levels (e.g., corporate, division, or department levels) and facilitated by a Safety 

Department/division or its equivalent. The organization might have standing committees of 

SMEs and stakeholders participating at various levels.

d. Safety Risk Analysis and Control. This section of the regulation addresses the 

following three processes: (1) Safety Risk Analysis, (2) Safety Risk Assessment, and (3) Safety 

Risk Control.

§ 5.53 System analysis and hazard identification.

(c) The certificate holder must develop and maintain processes to identify hazards within the 

context of the system analysis.

Par 3-4 Page 22
1/8/15 AC 120-92B

(1) Safety Risk Analysis.

(a) SRRs. Section 5.55(a).

(b) Related Regulatory Requirements. Section 5.25(c)(2), Responsibilities of 

Safety Management Personnel.

(c) ICAO/SMSPP. Element 2.2/Process 2.2.1.

(d) Objective. To estimate the severity and likelihood of a potential accident due to 

exposure to an identified hazard.

(e) Part 5 Requirements.

(f) Discussion. For each identified hazard, define the potential for injury and 

damage that may result from an accident related to operating while exposed to the hazard. In 

order to determine potential for injury and damage, you need to define the likelihood of 

occurrence of an accident and severity of the injury or damage that may result from the aircraft 

accident. It is important to remember that the likelihood and severity do not refer to the hazard 

but of a potential occurrence (accident or incident) related to the hazard.

1. The risk analysis also needs to consider the basis for the estimates of 

severity and likelihood. What is it about the factors analyzed in § 5.53, individually or in 

combination, which could result in an accident? Have you changed equipment that your 

employees must use, the procedures for using it, the layout of the facility, etc., in ways that could 

increase the likelihood of errors resulting in an accident? For example, if, in the process of 

a merger, flight deck procedures from one of the partner airlines become the standard across the

merged carrier and if the change in procedures has been identified as a hazard, what is it about 

the new procedures that would lead to errors?

2. This is one reason why the system analysis is an essential foundational step 

in risk management. If risk analysis is not based upon a thorough understanding of the system, 

you may miss important details that could cause the system to fail. The knowledge gained in the 

system analysis and subsequent risk analysis will later be used to develop a mitigating strategy. 

Risk controls will target the conditions that we think will cause an accident or affect its severity 

or likelihood.

3. Risk analyses in operational contexts are often based on expertise and expert 

judgment, but they should also use data from the carrier’s own experience or those of others in 

the industry where available. Review of accident statistics, failure data, error data (e.g., runway 

incursion reports or information from the National Aeronautics and Space Administration 

(NASA)’s Aviation Safety Reporting System (ASRS)) or equipment reliability data may help in 

determining likelihood.

§ 5.55 Safety risk assessment and control.

(a) The certificate holder must develop and maintain processes to analyze safety risk associated with 

the hazards identified in § 5.53(c).

Par 3-4 Page 23
1/8/15 AC 120-92B

4. The type of consequence (e.g., error, failure, accident, or incident) that is 

envisioned normally drives the estimate of severity. For example, if the hazard could result in 

controlled flight into terrain (CFIT), the severity of this outcome is normally major, if not 

catastrophic. Conversely, tire failures, while potentially leading to a fatal accident, more often 

lead only to aircraft damage.

5. Even where the best estimate has to be based on reasonable expert judgment, 

effective risk management can be accomplished by applying a disciplined analysis. The outputs 

could be recorded in a simple recording medium such as a notebook, basic desktop software, 

a WBAT,5 or a spreadsheet application.

(g) Scalability.

1. Small. Risk analysis could be performed by the owner/manager, and/or 

another employee(s). It might be performed in conjunction (by the same individual/group) with 

system description and analysis, hazard identification, risk assessment, and risk control.

2. Medium. Risk analysis could be performed by a member of management 

and/or the designated management representative with a small workgroup of company SMEs and 

stakeholders.

3. Large. Risk analysis might be performed at multiple organizational levels, 

(e.g., the corporate, division, or department levels) and facilitated by the Safety Department or 

specially trained analytical personnel shared with other departments. The organization might 

have standing committees of SMEs and stakeholders participating at various levels.

(2) Safety Risk Assessment.

(a) SRRs. Section 5.55(b).

(b) Related Regulatory Requirements.

• Section 5.23(a)(2)(i): Accountabilities of members of management, and

• Section 5.23(b): Decision authority regarding safety risk acceptance.

(c) ICAO/SMSPP. Element 2.2/Process 2.2.2.

(d) Objective. To make a decision regarding the acceptability of operation in the 

presence of an identified hazard.

5 The Web-Based Analysis Tool (WBAT) is a federally developed and funded software system that may be used to 

assist air carriers with data management. WBAT also contains an SMS implementation plan manager module, which 

supports the air carrier’s implementation of SMS.

Par 3-4 Page 24

 
1/8/15 AC 120-92B

(e) Part 5 Requirements.

(f) Discussion. Once the risk is analyzed, you must assess whether the risk is 

acceptable. A common tool used in risk assessment decisions is a risk matrix. A risk matrix 

provides you with a way to integrate the effect of severity of the outcome and the probability of 

occurrence, which enables you to assess risks, compare potential effectiveness of proposed risk 

controls, and prioritize risks where multiple risks are present.

1. If a risk matrix is used, the carrier should develop criteria for severity and 

likelihood that are appropriate for their type of operations and their operational scenario. For 

example, severity levels are sometimes defined in terms of a dollar value of potential damage. In 

this case, different types of airplanes operated and their relative values would dictate different 

scales between carriers. Likewise, the method that the carrier uses to estimate likelihood will 

have an effect on how likelihood scales are defined. If the carrier prefers to use quantitative 

estimates (e.g., probability), the scales would be different than one that prefers to use qualitative 

estimates. Figure 3-2 below depicts a sample risk matrix.

§ 5.55 Safety risk assessment and control.

(b) The certificate holder must define a process for conducting risk assessment that allows for the 

determination of acceptable safety risk.

Par 3-4 Page 25
1/8/15 AC 120-92B 

FIGURE 3-2. SAMPLE RISK MATRIX 

2. Risk assessment is based on judgment, experience, and input from data

collection tools (DCT) and previous processes. If the risk is acceptable, it may be done with the 

SRM process. If this is the case, then the system may be placed into operation and monitored in 

the SA process. If you decide the risk is not acceptable, you will need to follow the next step in 

SRM, which is developing risk controls. 

3. Risk assessments must also involve the levels of management with the

authority to make risk decisions, deciding what is or is not an acceptable risk for the systems 

within their area of operational responsibility. For example, dispatching a flight that presents 

a medium or high risk might require the Chief Pilot or DO to approve or authorize the flight. For 

large scale operational decisions, the accountable executive may be the only appropriate person 

to make these risk acceptance decisions. Thus, the person responsible for making these risk 

acceptance decisions will depend on the scope of the proposed change to the operation and the 

level of risk presented to the operation. 

4. The outputs of this process could be recorded on paper or via an electronic

medium, such as a WBAT.

(g) Scalability.

1. Small. Risk assessment could be performed by the owner/manager, and/or

another employee(s) making the risk decisions. Risk acceptance would also probably be 

conducted by this individual/group. These processes could be similar to a flight risk management 

process, or you could use a risk matrix.

2. Medium and Large. SRM should be coordinated across the divisional and

geographic units of the company to assure integrated decisionmaking and communication. 

Decisions involving multiple systems may require joint decisionmaking among departments or 

managers responsible for those systems. Many companies have standing committees made up of 

senior managers, who are the decision makers, supported by working groups of technical 

Par 3-4 Page 26 
1/8/15 AC 120-92B

personnel. For example, the accountable executive could make company-level decisions and 

department managers could make the decisions for their operations. A risk matrix may be useful 

to determine who makes the risk decision, whether the risk is acceptable, or to determine the 

priority for mitigating risk.

(3) Safety Risk Control.

(a) SRRs. Sections 5.55(c) and (d).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 2.2/Process 2.2.3.

(d) Objective. To develop a risk control that reduces risk to an acceptable level.

(e) Part 5 Requirements.

(f) Discussion.

1. After hazards and associated risk are fully understood, risk controls must be 

designed for risks that the carrier deems unacceptable. This is accomplished using their risk 

assessment process, as specified in § 5.55(b). Examples of risk controls include new processes, 

equipment, training, new supervisory controls, new equipment or hardware, new software, 

changes to staffing arrangements, or any of a number of other system changes. In short, anything 

that would lessen the likelihood or severity of a potential incident/accident.

2. Next, look at the system with the proposed control in place to determine if 

the level of risk is now acceptable and the proposed control does not introduce unintended 

consequences or new hazards. This is commonly referred to as substitute risk. Section 5.55(d) 

requires you to evaluate whether the risk will be acceptable with the proposed safety risk control 

applied. The risk that remains is often called residual risk.

(g) Scalability.

1. Small. The risk control process could be a documented activity performed by 

the owner/manager and/or another employee(s) designing and evaluating the risk controls. It 

might be performed in conjunction (by the same individual/group) with system description and 

analysis, hazard identification, risk analysis, and risk assessment.

2. Medium and Large. The risk control process could be performed by 

a member of management or SMS management representatives with a small workgroup of 

company SMEs and stakeholders to design the risk controls. There would be interdepartmental 

§ 5.55 Safety risk assessment and control.

(c) The certificate holder must develop and maintain processes to develop safety risk controls that 

are necessary as a result of the safety risk assessment process under paragraph (b) of this section.

(d) The certificate holder must evaluate whether the risk will be acceptable with the proposed safety 

risk control applied, before the safety risk control is implemented.

Par 3-4 Page 27
1/8/15 AC 120-92B

coordination before the controls are implemented. After the control is approved, it is 

implemented and documented through the company’s publication system. Implementation of risk 

controls may include distribution of manual revisions and training of company personnel.

e. SRM Example. The scenario below illustrates how these SRM processes would be 

applied in an operational context.

(1) An airline receives notification that the instrument landing system (ILS) at one of its 

destination airports is scheduled to be out of service for a period of time and, therefore, the 

flights will have to use a less familiar Nonprecision Approach (NPA) procedure. Concern is 

expressed by the flightcrews about the procedure and the differences between fleets that will 

affect operational procedures and the currency of training. Under § 5.51, this triggers the SRM 

processes and procedures.

(2) Pursuant to § 5.53(a) and (b), the SRM process starts with an analysis of the systems 

involved, with the addition of a new procedure for the aircraft fleet. This would include analysis 

of the flight operations and training program. In this case, the company has two fleets of 

airplanes that are operated to the destination airport in question. The equipment, and therefore 

the procedures and flightcrew training in these two fleets, differs. By analyzing the system, they 

identify a hazard (per § 5.53(c)), in that the pilots are not properly trained to fly the procedures 

that are required for that specific airport.

(3) To analyze the risk associated with this hazard (as required by § 5.55(a)), a team is 

assembled with representatives from management, the training and standardization organization, 

the flight safety organization, the organization responsible for dispatch and operational control, 

and the pilot’s union. Representatives of the FAA Certificate Management Team (CMT) also 

attend the work team’s meetings. The risk analysis consists of documented discussions among 

the assembled SMEs.

(4) As a result of the risk analysis, a risk assessment is done (per § 5.55(b)). As part of 

the assessment, it is determined that the existing operational procedures and training used by one 

of the fleets are not acceptable for safe operation into the airport without revision and additional 

training. A management decision is made that the procedures and associated training currently in 

use will not provide an acceptable level of safety (ALoS) for operations into the airport.

(5) After determining that the risk is unacceptable, risk controls are designed under 

§ 5.55(c). The risk control in this case consists of a change to operational procedures, including 

programming of the flight management system (FMS) and associated approach procedure 

training for flightcrew members. Prior to implementation of the risk controls, the company 

checks the resulting procedures in flight simulators to ensure that the risk control will mitigate 

risk to an acceptable level, as required by § 5.55(d).

(6) Per § 5.23(b), the solution is submitted to the fleet Chief Pilots for management 

review and acceptance of the mitigated risk. Division-level management and top management 

are briefed on the operation at regular management reviews. Once the controls are approved by 

all concerned, they are implemented operationally. Per the SA requirements, these controls are 

Par 3-4 Page 28
1/8/15 AC 120-92B

specifically targeted for performance monitoring by the operational control/dispatch organization 

and the flight operations organization line checks.

3-5. SUBPART D: SAFETY ASSURANCE.

a. Introduction.

(1) SRR. Part 5, subpart D.

(2) Related Regulatory Requirements.

• Section 5.23(a)(2) Accountabilities of members of management,

• Section 5.25(a)(4) Accountable Executive—Ultimate responsibility for safety 

performance, and

• Section 5.25(b)(1) Accountable Executive—Responsibility to ensure SMS 

implementation and performance.

(3) ICAO/SMSPP. Component 3.0.

(4) Summary. SA consists of the following five processes, divided into three sections 

of the regulation.

(a) Safety Performance Monitoring and Measurement § 5.71.

• System monitoring,

• Data acquisition, and

• Analysis.

(b) Safety Performance Assessment § 5.73. System assessment.

(c) Continuous Improvement § 5.75. Continuous improvement.

NOTE: Figure 3-3, Safety Assurance Processes and Regulatory 

Requirements, depicts the SA processes and their associated regulatory 

requirements.

Par 3-4 Page 29
1/8/15 AC 120-92B 

FIGURE 3-3. SAFETY ASSURANCE PROCESSES AND REGULATORY 

REQUIREMENTS

b. Safety Performance Monitoring and Measurement: Overview. This section of the

regulation consists of the following processes: Monitoring of Operational Processes

(subparagraph 3-5c(1)), Monitoring of the Operational Environment (subparagraph 3-5c(2), Data 

Acquisition (subparagraphs 3-5c(3)–(7)), and Analysis of Data (subparagraph 3-5d).

(1) SRR. Section 5.71. 

(2) Related Regulatory Requirements. None. 

(3) ICAO/SMSPP. Element 3.1. 

c. Safety Performance Monitoring and Measurement: Required Data Acquisition

Processes. This subsection consists of the following seven data acquisition processes: 

Monitoring of Operational Processes, Monitoring of the Operational Environment, Auditing of 

Operational Processes, Evaluation of the SMS and Operational Processes, Investigations: 

Accidents and Incidents, and Investigation: Potential Noncompliance and Confidential Employee 

Reporting System.

(1) Monitoring of Operational Processes.

System

Operation/

Monitoring

Analysis

Data

Acquisition

& Process

Preventive/

Corrective

Action

System

Assmt

5.71(a)(3) Internal Audits

5.71(a)(4) Internal Evaluation

5.71(a)(5)&(6) Investigations

5.71(a)(7) Employee Reporting

Outputs To SRM:

5.73(b)

5.71(b) Analysis of Data

5.75

5.73(a) System Assessment

5.73(a) Management Review

*

* Note: Each data source should be traceable

through analysis 5.71(b) assessment 5.73(a)

And Corrective Action 5.75 where necessary.

Inputs From SRM:

5.71(a)

5.71Safety 

Performance

Monitoring 

and Measurement

SA

How is this going to be 

analyzed? By whom?

5.73 Safety 

Performance 

Assessment

5.75 Continuous

Improvement

(Subpart c)

5.71(a)(1)&(2) 

Monitoring

Par 3-5 Page 30 
1/8/15 AC 120-92B

(a) SRR. Section 5.71(a)(1).

(b) Related Regulatory Requirements.

• Part 121, § 121.703, Service Difficulty Reports, and

• Section 121.705, Mechanical Interruption Summary Reports.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.1.

(d) Objective. To observe the day to day, flight by flight, job by job performance of 

operational systems and their associated risk controls.

(e) Part 5 Requirements.

(f) Discussion. Monitoring operational processes is what supervisors do on 

a day-to-day basis (e.g., direct supervision of employee activities, monitoring of pilot currency, 

and monitoring Minimum Equipment List (MEL) status). Monitoring also involves reviewing 

data that is collected for operational purposes to look for anything of safety significance (e.g., 

duty logs, crew reports, work cards, process sheets, and reports from the employee safety 

feedback system). This may include monitoring products and services from outside sources that 

are used in the certificate holder’s operations.

(g) Scalability.

1. Small. Most of the data/information-gathering for monitoring of operational 

processes will likely occur as a normal business process by the management personnel who are 

directly involved in the day-to-day operations. For example, regularly reviewing (e.g., weekly, 

monthly, or quarterly) the flight dispatch logs and crewmember duty records is a form of 

monitoring and could be conducted during the normal course of duties.

2. Medium. Line managers and departmental or key management personnel 

may observe and review day-to-day activity, noting work task inconsistencies and potential 

safety issues. Flight operations quality assurance (FOQA) and Line Operations Safety Audit 

(LOSA) programs may also be sources of information to monitor operations.

3. Large. Monitoring may involve multiple levels of management, safety 

professionals, functional area managers (such as DO, DOM, Chief Inspector, and Chief Pilot), 

trained auditors/analysts, and teams/groups of line managers. As in medium-size carriers, FOQA 

and LOSA programs may be employed. Operational processes may need to be coordinated 

across adjacent work function boundaries, so effective monitoring may also need to be 

coordinated.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following:

(1) Monitoring of operational processes.

Par 3-5 Page 31
1/8/15 AC 120-92B

(2) Monitoring of Operational Environment.

(a) SRR. Section 5.71(a)(2).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.1.

(d) Objective. To monitor the operational environment to identify new or changed 

conditions.

(e) Part 5 Requirements.

(f) Discussion. Monitoring of the operational environment involves practices that 

are similar to those of monitoring operational processes. The context for monitoring the 

operational environment of a system is developed from the system analysis that is conducted 

under SRM. Once the scope of the operational environment is defined under SRM, the 

operational environment must be monitored to assess impacts on aviation safety. For example, 

increases in the price of fuel may require airlines to change their scheduling, routes, and aircraft 

utilization.

(3) Auditing of Operational Processes and Systems.

(a) SRR. Section 5.71(a)(3).

(b) Related Regulatory Requirements. Section 5.23(a)(2)(ii).

(c) ICAO/SMSPP. Element 3.1/Processes 3.1.2 and 3.1.4.

(d) Objective. To provide the process owners with a means to obtain information 

about the performance of systems in their area of responsibility.

(e) Part 5 Requirements.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(2) Monitoring of the operational environment to detect changes.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(3) Auditing of operational processes and systems.

Par 3-5 Page 32
1/8/15 AC 120-92B

(f) Discussion.

1. Audits are a means of collecting data to confirm whether or not actual 

practices are being followed within a department. Audits should typically involve the operational 

management responsible for the system(s) being audited. Procedures for auditing should describe 

your audit process, criteria, scope, frequency, method for selecting auditors, and methods of 

documentation and recordkeeping. Audit planning should take into account the safety criticality 

of the processes to be audited and the results of previous audits. Auditors should not audit their 

own work, but may audit the work of others around them in the same department. Audit 

procedures should include the responsibilities and expectations for planning, conducting, 

reporting results of audits, maintaining records of audit results, and processes for auditing 

contractors and vendors, as necessary.

2. The results of audits can be recorded in paper format such as a common 

logbook-style binder, or in electronic media such as a desktop spreadsheet program or a program 

such as a WBAT.

(g) Scalability.

1. Small. The auditing process could be carried out periodically by the 

accountable executive/owner, key management person, or a trained employee as a collateral 

duty. Audits may also be carried out as a subfunction of normal business processes. For example, 

comparisons of deferred maintenance logs and repair part receipts are a form of safety auditing 

that are probably already accomplished routinely.

2. Medium. In a medium-size organization, the auditing process can be 

accomplished by operational departmental personnel, on a periodic basis, as determined by the 

needs of operational decision makers.

3. Large. In a large organization, the auditing processes are typically fulfilled 

by divisional auditors on a consistent basis. Large companies may already have safety and 

safety/quality auditors who perform this function or, in smaller divisions, they may be performed 

by personnel from inside the divisions.

(4) Evaluation of SMS and Operational Processes and Systems.

(a) SRR. Section 5.71(a)(4).

(b) Related Regulatory Requirements. Section 5.25(c)(3), Responsibilities of 

safety management personnel.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.3.

(d) Objective. To provide a source of information to the organization regarding the 

safety performance of operational systems and the SMS.

Par 3-5 Page 33
1/8/15 AC 120-92B

(e) Part 5 Requirements.

(f) Discussion. An evaluation is typically an independent review of the company’s 

processes, procedures, and systems. The evaluation process builds on the concepts of audit and 

inspection. An evaluation is an internal oversight tool that provides the accountable executive 

with a snapshot of the safety performance of the carrier’s operational processes and systems, as 

well as SMS processes. The evaluation should include all available data about the organization, 

including information from the audits conducted by the operational management.

1. Conducting evaluations at planned intervals will help the carrier’s 

management to determine if its safety management methods and practices are meeting safety 

objectives and expectations set out in the safety policy. Evaluation planning should take into 

account the safety criticality of the processes that are being evaluated and the results from 

previous evaluations. The scope, content, and frequency of evaluations should be based on the 

decision maker’s need for information to assess the health of operational processes and the SMS. 

You will also need to define criteria for selecting evaluators.

2. The results of evaluations can be recorded in a paper or electronic medium 

in a common logbook-style binder, an electronic file folder, or a secure email account.

(g) Scalability.

1. Small. The evaluation process could be carried out periodically by the 

accountable executive/owner, a key management person, or designated employees as a collateral 

duty under the direction of the accountable executive.

2. Medium. This process could be accomplished by the Director of Safety 

(DOS) or Safety Department on a monthly, quarterly, or other periodic basis, as determined by 

the information needs of the accountable executive or other senior management decision makers. 

Personnel resources to perform the observations and data collection for evaluations could be 

from a small, dedicated department or selected line personnel as a collateral duty.

3. Large. Evaluations could be accomplished by a Safety Department or an 

Internal Evaluation Program (IEP) office on a quarterly, annual, or other periodic basis, as 

determined by the information needs of the accountable executive or other senior management 

decision makers. Most part 121 companies have IEPs, and their outputs can be integrated into the 

SMS. Analysis of evaluations is typically performed by a Safety Department. The resulting data 

would be acted upon by the appropriate operational department with the Safety Department 

managing the data and assisting the responsible division(s) in resolving their issues. Most large 

organizations have standing management committees that consider results of evaluations and any 

corrective action needed.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(4) Evaluations of the SMS and operational processes and systems.

Par 3-5 Page 34
1/8/15 AC 120-92B

(5) Investigation of Incidents and Accidents.

(a) SRR. Section 5.71(a)(5).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.5.

(d) Objective. To gather information on accidents and incidents to identify potential 

weaknesses in operational systems.

(e) Part 5 Requirements.

(f) Discussion. Investigations should be treated as an opportunity for organizational 

learning to prevent a repeat of errors and/or change company processes so that mistakes do not 

recur. Investigations should focus on what went wrong rather than who caused the error and 

emphasize improvement of safety performance. The organization should include investigation 

data, if available, from outside sources such as FAA or National Transportation Safety Board 

(NTSB) investigations and may, where appropriate, participate as a party to official

investigations. The results of investigations can be recorded in paper or electronic medium in 

a common logbook-style binder, an electronic file folder, or other electronic system such as 

a WBAT or another suitable system.

(g) Scalability.

1. Small. Investigations can be conducted by the accountable executive or 

assigned employees.

2. Medium. Investigations can be conducted by a Safety Department, with 

additional assigned line personnel providing technical expertise.

3. Large. Investigations, depending on the situation, can be conducted by safety 

teams with specialized disciplines.

(6) Investigation of Potential Noncompliance.

(a) SRR. Section 5.71(a)(6).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.5.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(5) Investigations of incidents and accidents.

Par 3-5 Page 35
1/8/15 AC 120-92B

(d) Objective. To obtain information to determine compliance with regulations as 

well as underlying policies and procedures.

(e) Part 5 Requirements.

(f) Discussion. This subject is very similar to the one described above in that the 

focus of the investigation should reveal information that, when utilized correctly, will 

concentrate on objective facts to identify system deficiencies, help prevent future recurrences,

and improve system reliability. It is not as important to identify “who did it” as it is for you to 

learn why it happened. Within this process, it is important to distinguish between error and 

intentional/willful noncompliant actions. Investigations of reports regarding potential 

noncompliance with regulatory standards or of inadequate safety risk controls established by the 

certificate holder should be mitigated through the SRM process established in part 5, subpart B. 

Instances of noncompliance with an FAA regulation may be reported through the Voluntary 

Disclosure Reporting Program (VDRP), where applicable. For instances involving individual 

employee noncompliance with FAA regulations, these employees may use an Aviation Safety 

Action Program (ASAP), if one is available.

(g) Scalability. Methods of conducting investigations of potential noncompliance 

can be accomplished in a manner similar to that for investigations of accidents and incidents.

(7) Confidential Employee Reporting System.

(a) SRR. Section 5.71(a)(7).

(b) Related Regulatory Requirements. None.

(c) ICAO/SMSPP. Element 3.1/Process 3.1.6.

(d) Summary. To provide a means for employees to communicate safety 

information to management.

(e) Part 5 Requirements.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(6) Investigations of reports regarding potential non-compliance with regulatory standards or 

other safety risk controls established by the certificate holder through the safety risk 

management process established in subpart B of this part.

§ 5.71 Safety performance monitoring and measurement.

(a) The certificate holder must develop and maintain processes and systems to acquire data with 

respect to its operations, products, and services to monitor the safety performance of the 

organization. These processes and systems must include, at a minimum, the following: ...

(7) A confidential employee reporting system in which employees can report hazards, issues, 

concerns, occurrences, incidents, as well as propose solutions and safety improvements.

Par 3-5 Page 36
1/8/15 AC 120-92B

(f) Discussion. The workforce is an important information source that should be 

included in the data-gathering process. Audits and evaluations bring decision makers important 

information and are essential to a proactive SA approach. However, these tools can be limited by 

the scope and content of their design. Front-line employees may observe aspects of the operation 

or environment that were not expected and were not included in audit or evaluation protocols. In 

this respect, the employee reporting system can fill in important gaps in the company’s data 

collection process.

1. In order to be effective, the organization needs to establish and maintain an 

environment in which employees feel comfortable to report hazards, issues, and concerns, as 

well as occurrences, incidents, etc., and propose safety solutions and improvements. The 

accountable executive and management team need to encourage employees to report safety 

issues and not fear reprisals from management. Policies that assure employees of fair treatment 

and clear standards of behavior are an essential part of the reporting process.

2. A key aspect of the confidential reporting system is that it is confidential. 

Therefore, you must define methods for employee reporting and de-identification of sources 

without losing essential information. As you develop and employ the confidential reporting 

procedures and include this invaluable input in safety decisionmaking, employees will begin to 

trust the system to work toward elimination of systemic problems. This, in turn, will stimulate 

greater participation in employee reporting of safety concerns.

3. ASAPs can be used as part of the employee reporting system for the 

employee groups covered by the ASAPs. However, the confidential employee reporting system 

required by part 5 must include all employees in the company. Companies that do not have 

ASAPs may consider providing employees with a hotline, a suggestion box, or information and 

forms for the NASA ASRS. If a WBAT is used, this system provides a portal for ASRS 

reporting. ASRS provides certificated employees with limited immunity in the form of waivers 

of sanctions for reported events with certain restrictions.

(g) Scalability.

1. Small. An employee reporting system for a small company need not be 

highly sophisticated to be effective. The employees might report a hazard either orally or in 

a note or email to their supervisor. Collection tools could be a suggestion box, voice mail 

“hotline,” etc.

2. Medium and Large. A medium- or large-sized company will most likely 

have an existing online employee reporting system or ASAPs for some employee groups. Data 

collection for the reporting system can take many forms, from a simple suggestion box to 

company Web sites or intranets, or a dedicated email address. Data management can be 

accomplished with common desktop spreadsheet or database software or specialized software, 

such as a WBAT.

Par 3-5 Page 37
1/8/15 AC 120-92B

d. Analysis of Data.

(1) SRR. Section 5.71(b).

(2) Related Regulatory Requirements. Section 5.25(c)(2), Responsibilities of safety 

management personnel.

(3) ICAO/SMSPP. Element 3.1/Process 3.1.7.

(4) Objective. To organize and examine data to determine its meaningfulness in 

making safety decisions.

(5) Part 5 Requirements.

(6) Discussion. Analysis involves examining data acquired from various sources in 

§ 5.71(a) in order to make inferences about the safety performance of operational systems and 

the SMS.

(a) It is common for organizations to treat each employee report, audit finding, or 

investigation in isolation. Often, system problems may not be seen if data points are examined in 

isolation. Thus, analysis processes should also look across individual reports and among various 

data sources for patterns or trends.

(b) For example, in a recent case, examination of data from an airline’s FOQA 

program showed several instances of unstabilized approaches and exceeding of flap and landing 

gear speeds on approach. It would be easy to assume that pilot technique was the cause and then 

counsel or retrain the pilots. However, upon closer analysis and comparison of the events, the 

airline found that all of the instances were at one specific airport. Contacts with other airlines 

indicated similar experiences at the same airport. After further conversations with air traffic 

control (ATC), the parties concluded that, due to the traffic handling practices, it was common 

for flights to be vectored close and high, which resulted in the approach problems. After further 

conversations with ATC management, the problem was resolved.

(c) The following is a starting point for an analysis process.

1. Establish the context: Understand the safety performance objectives of the 

system, operations, or SMS. For system impacts, and to analyze risk controls developed under 

SRM, you would also need to review the system analysis conducted under SRM.

2. Identify the objective of the analysis: Are you analyzing the safety 

performance of a system, of an operation, or the SMS itself?

§ 5.71 Safety performance monitoring and measurement.

(b) The certificate holder must develop and maintain processes that analyze the data acquired through the 

processes and systems identified under paragraph (a) of this section and any other relevant data with 

respect to its operations, products, and services.

Par 3-5 Page 38
1/8/15 AC 120-92B

3. Secure appropriate data: Section 5.71(a) provides a framework for data 

sources. The data needed may be already on hand, or additional data-gathering may be needed, 

such as conducting a special audit with focus on a specific problem.

4. Select an appropriate data analysis method: Analysis need not be 

sophisticated to yield valuable results. For example, analysis of employee reports or qualitative 

analysis by SMEs may be the best method. If desired, several classification systems exist to help 

convert subjective, qualitative data into quantitative data for tracking and trend analysis. For 

routine reporting, analysis may consist of tracking such things as dispatch reliability per month, 

system or part failure rates, crew utilization/duty time, and events such as minor incidents, 

diversions, and precautionary engine shutdowns.

5. Recommendation: At this point, the person conducting the analysis may 

compare performance against relevant company safety objectives. Unless the decision maker is 

personally conducting the analysis, an assessment recommendation may be made. In the case 

that a potential regulatory violation is discovered during analysis, the carrier may initiate a

self-disclosure under voluntary reporting procedures.

6. Documentation: Prepare reports and records in a format appropriate to your 

operation.

(d) The outputs from data analysis could be recorded in a simple recording medium 

such as a notebook, paper files, common desktop software, or specialized systems such as 

a WBAT.

(7) Scalability.

1. Small. Analysis of the data gathered could be done by the accountable 

executive, the DOS, other individual managers, or other designated employees as a collateral 

duty.

2. Medium. Analysis of data could be done by the DOS, other individuals 

within a Safety Department, or a person(s) within each department, and then shared with other 

departments and management during regularly scheduled meetings.

3. Large. Operational departments may have their own data analysis group 

reviewing data and analyzing the data by SMEs within the respective department, possibly 

supported and coordinated by a Safety Department.

e. Safety Performance Assessment.

(1) SRR. Section 5.73.

(2) Related Regulatory Requirements. Sections 5.23(a)(2)(ii) and 5.25(b)(1).

(3) ICAO/SMSPP. Element 3.1/Processes 3.1.8, 3.2, and 3.3.2.

Par 3-5 Page 39
1/8/15 AC 120-92B

(4) Objective. To make decisions regarding safety performance with reference to safety 

objectives and regulatory compliance.

(5) Part 5 Requirements.

(6) Discussion. Under § 5.71, collected safety performance data is analyzed and the 

results are used for informed decisionmaking. The assessment process is where these decisions 

are made. Decisions are made by personnel with assigned responsibility and authority. The SA 

process should consider who makes the decisions regarding whether the company’s safety 

performance is effective and whether the company is meeting its safety objectives and 

expectations that are identified in the safety policy required by § 5.21. The conclusions of the 

safety assessments are reported to the accountable executive, who possesses ultimate authority to 

act on such conclusions, as necessary.

(a) Assessments can have one of the following general outcomes:

• Performance is acceptable and objectives are being met.

• Performance is not acceptable, and analysis suggests that the problem lies 

with conformity with regulations or company policy and procedures, or 

necessary resources have not been provided. In the event this occurs, 

corrective action under § 5.75 would be warranted.

• Conformity with the risk controls and regulations appears to be satisfactory; 

however, desired results are not being obtained. In the event that this occurs, 

the SRM processes would be triggered.

• New or uncontrolled hazards are discovered. This may be due to new 

hazards having arisen since the system was designed or discovery of factors 

that were overlooked. In this case, as in the previous, the SRM processes 

must be followed.

(b) The results of assessments can be recorded in a paper or electronic medium in 

a common logbook-style binder, an electronic file folder, common desktop software, or 

specialized system, such as a WBAT.

§ 5.73 Safety performance assessment.

(a) The certificate holder must conduct assessments of its safety performance against its safety objectives, 

which include reviews by the accountable executive, to:

(1) Ensure compliance with the safety risk controls established by the certificate holder;

(2) Evaluate the performance of the SMS.

(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any 

ineffective controls.

(4) Identify changes in the operational environment that may introduce new hazards.

(5) Identify new hazards.

(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under 

paragraph (a)(2) through (a)(5) of this section, the certificate holder must use the safety risk 

management process described in subpart C of this part.

Par 3-5 Page 40
1/8/15 AC 120-92B

(7) Scalability.

(a) Small and Medium. As an organization grows in size, it is normal to have 

additional personnel performing safety, quality, or internal evaluation functions. An SMS does 

not change the number and types of personnel in these situations as much as it may change the 

way in which these persons and organizations work and interact. For example, safety 

performance and assessment could be a documented activity performed by the accountable 

executive or a coordinated activity between the accountable executive and other operational 

managers, supported and coordinated by the DOS. Risk acceptance would also normally fall to

managers within this group.

(b) Large. This process is best addressed at the highest level in the organization and 

involves the accountable executive, division vice presidents, and other defined leaders and 

decision makers. At each level, the company would define who is responsible for making risk 

acceptance decisions and what actions should be taken to either correct the problem or design 

new risk controls. Larger companies typically have standing management committees at the 

functional organization level (e.g., flight operations, technical operations/maintenance, in-flight 

services, dispatch/operational control) and a second body at the corporate level to assure 

integration, coordination, and review by the accountable executive.

f. Continuous Improvement.

(1) SRR. Section 5.75.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 3.3/Process 3.3.1.

(4) Objective. To provide the organization’s decision makers with a means to correct 

safety performance deficiencies identified in the safety performance assessment process.

(5) Part 5 Requirements.

(6) Discussion.

(a) The final step within SA is continuous improvement. This process is designed to 

ensure that you are correcting substandard safety performance identified during the safety 

performance assessment in order to continuously improve safety performance.

(b) As discussed in subparagraph 3-5e, Safety Performance Assessment), the 

corrective action process of § 5.75 is triggered when conformity with risk controls has been 

found to be deficient. In this case, it is not necessary to conduct a new safety risk analysis. Risk 

has already been assessed as being unacceptable without satisfactory completion of the risk 

control. For example, if it has been found that an Airworthiness Directive (AD) has not been 

§ 5.75 Continuous improvement.

The certificate holder must establish and implement processes to correct safety performance deficiencies 

identified in the assessments conducted under § 5.73.

Par 3-5 Page 41
1/8/15 AC 120-92B

applied to a particular aircraft, the only correct action is to comply with the risk control (in this 

case, the AD). The risk of flying the airplane without the AD has already been assessed as 

unacceptable.

(7) Scalability. Continuous improvement decisionmaking is an output of the 

performance assessment process. Therefore, the arrangements discussed for assessment apply to 

scalability for continuous improvement activities. The managers, committees, or working groups 

that make assessment decisions would also lay out courses of corrective action.

g. An SA Example. This example builds on the scenario discussed in the SRM example, 

which can be found in the SRM section, subparagraph 3-4e. In that example, an airline addressed

the unacceptable risk of an airport approach procedure by imposing risk controls consisting of a 

change to operational procedures, including programming of the FMS and associated approach 

procedure training for flightcrew members.

(1) As required by §§ 5.71(a)(1) and 5.73(a)(1) and (a)(3), the air carrier specifically 

monitored the flight operations and the associated controls at the airport by the operational 

control/dispatch organization as part of their normal activities. This organization was tasked with 

assuring that crews assigned to the specific flights were appropriately qualified (thus verifying 

that this part of the risk control was being employed), and that the airplanes scheduled for the 

flights had appropriate operational equipment. As required by § 5.71(a)(2), the air carrier also 

monitored the airport to determine whether the altered approach procedure was still necessary.

(2) Another part of the risk control monitoring and auditing was conducted using 

structured line checks pursuant to § 5.71(a)(3). This method was used to conduct audits of 

specific flight operations (in addition to the airline’s normal checking procedures), thus 

providing data to verify that the procedures put in place provided risk controls that are effective, 

as required by § 5.73(a)(3). At the same time, per § 5.71(a)(7), the airline’s employee reporting 

system was available for pilots to submit their concerns to the company. Line check and 

employee reporting data were collected and analyzed under § 5.71, and then assessed by 

management under § 5.73.

(3) If any deficiencies were found, an analysis would have been conducted to ascertain 

whether the deficiencies should be addressed through SRM (per § 5.73(b)) or a correction 

(per § 5.75). If the root cause of the deficiencies was shortfalls in compliance with the designed 

operational process (e.g., required training was not completed), the deficiency should be 

addressed through a correction, per § 5.75. However, if the deficiency was associated with the 

basic design of the control (e.g., inadequate training curriculum), the SRM process would be 

repeated to revise the procedure in the areas where it was found deficient, per § 5.73(b).

3-6. SUBPART E: SAFETY PROMOTION.

a. Introduction.

(1) SRR. Part 5, subpart E, Safety Promotion

(2) Related Regulatory Requirements. Section 5.23(a)(2)(ii), Accountabilities of 

members of management.

Par 3-5 Page 42
1/8/15 AC 120-92B

(3) ICAO/SMSPP. Component 4.0.

(4) Objective. To provide employees with effective SMS training commensurate with 

their safety responsibilities, and to create a means to deliver organization-wide safety 

communication.

(5) Discussion. Because a key component of SMSs is the effective control of risk, 

every member in your organization must understand and take responsibility for the role they play 

in controlling risk by their actions and behavior. These members should also have access to 

up-to-date safety information so that they can properly fulfill their roles.

b. Competencies and Training.

(1) SRR. Section 5.91.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 4.1/Processes 4.1.1 and 4.1.2.

(4) Objective. To assure that employees are competent to perform their SMS-related 

duties.

(5) Part 5 Requirements.

(6) Discussion. Your organization will need to train its employees. Your employees 

may receive initial safety training for them to understand and perform their safety duties. 

Recurrent training may also be necessary to reinforce these skills. For example, a Safety 

Department employee will probably need more detailed SMS training (such as safety risk 

analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than

will a baggage handler. Line managers may need to know the potential consequences of safety 

failures and system failure modes more so than line employees will. Line employees may only 

need an overview of safety management fundamentals for their operational department (e.g., 

instructions on how to identify and report safety concerns).

(a) Competency is an observable, measurable set of skills, knowledge, abilities, 

behaviors, and other characteristics that individuals exhibit as they successfully perform work 

functions. Competencies are typically required at different levels of proficiency depending on the 

work roles or occupational function. By training your employees, you should establish 

competencies for all employees, commensurate with their duties relevant to the operation and 

performance of the SMS. Competence can be assessed at the completion of training by written, 

oral, or demonstration tests, and then measured periodically during the performance of that 

individual’s work by way of periodic evaluations or supervisor/management observations. As 

§ 5.91 Competencies and training.

The certificate holder must provide training to each individual identified in § 5.23 to ensure the individuals 

attain and maintain the competencies necessary to perform their duties relevant to the operation and 

performance of the SMS.

Par 3-6 Page 43
1/8/15 AC 120-92B

part of SA, organizations should periodically review their training program(s) to ensure that 

those programs meet the objectives set out in the safety policy.

(b) It is the responsibility of your organization to determine its own training needs 

based on competency requirements. Management personnel, specifically designated by the 

accountable executive to ensure the SMS is fully implemented, may need to be trained first and 

may also need specialized training to fulfill their responsibilities. Determining the organization’s 

training needs starts with a careful review of the safety policy, processes, and objectives. 

Everyone working within the scope of SMS should receive training commensurate with their 

position in the organization.

(7) Scalability. Organizations of all sizes may choose to either train their employees in

house or to contract out the training to outside vendors. Whichever option is taken, the training 

must be specific to your company’s SMS and operations.

c. Safety Communication.

(1) SRR. Section 5.93.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 4.2.

(4) Objective. To assure that employees have current and pertinent safety information.

(5) Part 5 Requirements.

(6) Discussion.

(a) Effective communication involves adjusting the content of the communication 

and manner in which the information is delivered to match the target employee’s role in the 

organization. The accountable executive must ensure that communication mechanisms are 

available and are effectively utilized. The delivery system should be appropriate according to the 

size and complexity of the organization.

(b) Safety policy and information could be provided as text, visual media such as 

posters or short videos, orally, or through examples. Messages should be consistent and in a form 

employees at each level can relate to, and be delivered using whichever media the organization 

has available. For example, hazard communications regarding birds for flightcrew members 

§ 5.93 Safety communication.

The certificate holder must develop and maintain means for communicating safety information that, at 

a minimum:

(a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their 

responsibilities.

(b) Conveys hazard information relevant to the employee’s responsibilities.

(c) Explains why safety actions have been taken.

(d) Explains why safety procedures are introduced or changed.

Par 3-6 Page 44
1/8/15 AC 120-92B

(regarding new bird strike avoidance techniques) may be in a “Notices” section of the Flight 

Operations Manual (FOM), and may be reinforced by recurrent training. Hazard communications 

made to line maintenance technicians (regarding birds roosting and nesting in flight controls, 

auxiliary power unit (APU) intakes, and engine cowlings) may be conveyed by posters and 

changes to daily inspection procedures. Hazard communications regarding birds made to ground 

service personnel may be in the form of posters, videos, and demonstrations (cleaning and 

removing bird droppings from windshields).

(7) Scalability.

(a) Small. Communicating safety considerations to employees will probably be 

simple and direct. For example, the company owner or the organization could conduct regular 

all-hands/employee meetings, such as “hangar talk sessions.” Additionally, communication could 

include regular and periodic briefings to the employees, posting the status of safety issues on 

bulletin boards, emails to employees, and face-to-face meetings with division management 

teams.

(b) Medium. Communication methods may be more structured than in small 

organizations. Safety information may be published throughout the company by printed or 

electronic means. Safety meetings are likely more structured and formal. Communication and 

feedback may be formalized in order to provide information to individual employees as well as 

organization-wide information for cross-boundary issues and/or common hazards.

(c) Large. Communication is more likely to be formal and a tracking system may 

be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. 

Information technology (IT) approaches, such as email broadcasts or intranet Web sites, may be 

considered to facilitate directing the flow of safety information and recording its accomplishment 

for evaluation and auditing purposes.

3-7. SUBPART F: SMS DOCUMENTATION AND RECORDKEEPING.

a. Introduction.

(1) SRR. Part 5, Subpart F.

(2) Related regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.5.

(4) Discussion. You must establish and maintain SMS information, in either paper or 

electronic form, describing the safety-related processes and procedures. Additionally, you must 

maintain the SMS records discussed below for a specified period of time.

b. SMS Documentation.

(1) SRR. Section 5.95.

(2) Related Regulatory Requirements. None.

Par 3-6 Page 45
1/8/15 AC 120-92B

(3) ICAO/SMSPP. Element 1.5.

(4) Part 5 Requirements.

(5) Discussion. You must establish and maintain SMS information, in either paper or 

electronic form, describing the safety-related processes and procedures and interfaces between 

these. You should also implement a distribution system to ensure that the documents dealing 

with these processes and procedures are promptly updated whenever there is a change in one or 

more of these processes or procedures.

(6) Scalability.

(a) Small and Medium. The owner/manager or designee may be responsible for 

maintaining and distributing current versions of guidance documents. Documentation may 

consist of a set of typewritten documents, spreadsheets, and forms that are kept in file cabinets or 

binders. Managers of medium-size companies need the same type of information to make 

decisions, although the volume is typically larger than that of a small company and smaller than 

that of a large organization.

(b) Large. Documentation and recordkeeping processes for a large organization 

may use a WBAT, unique software applications, or development of new database tools to 

support risk reporting and analysis. These organizations should examine existing tools and 

infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements.

c. SMS Records.

(1) SRR. Section 5.97.

(2) Related Regulatory Requirements. None.

(3) ICAO/SMSPP. Element 1.5.

§ 5.95 SMS documentation.

The certificate holder must develop and maintain SMS documentation that describes the certificate 

holder’s:

(a) Safety policy.

(b) SMS processes and procedures.

Par 3-7 Page 46
1/8/15 AC 120-92B

(4) Part 5 Requirements.

(5) Discussion. The timeline associated with the retention of the documents required by 

the regulation for outputs of SRM processes would be for as long as they remain relevant to the 

operation. For risk assessments, this may mean for as long as the air carrier engages in the 

activity for which the risk assessment was conducted. For risk controls, it may mean for as long 

as the risk control remains in effect.

(6) Scalability.

(a) Small. The owner/manager or designee may be responsible for maintaining 

auditable records. Documentation may consist of handwritten records, spreadsheets, and 

completed forms that are kept in file cabinets or binders.

(b) Medium. An individual or small staff may coordinate document maintenance 

and retention. This staff may use a combination of paper and electronic media to administer the 

process. Some records may be retained by department heads in accordance with a procedure 

delegating this responsibility.

(c) Large. The organization may have a dedicated records staff or department 

whose duties include document distribution and records retention. Due to the size and 

complexity of the organization, the use of technology is probably more pronounced.

§ 5.97 SMS records.

(a) The certificate holder must maintain records of outputs of safety risk management processes as 

described in subpart C of this part. Such records must be retained for as long as the control remains 

relevant to the operation.

(b) The certificate holder must maintain records of outputs of safety assurance processes as described in 

subpart D of this part. Such records must be retained for a minimum of 5 years.

(c) The certificate holder must maintain a record of all training provided under § 5.91 for each individual.

Such records must be retained for as long as the individual is employed by the certificate holder.

(d) The certificate holder must retain records of all communications provided under § 5.93 for 

a minimum of 24 consecutive calendar-months.

Par 3-7 Page 47 (and 48)

1/8/15 AC 120-92B 

CHAPTER 4. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT SYSTEM 

(SMS)

4-1. PROCESS OVERVIEW.

a. Existing Title 14 of the Federal Code of Regulations (14 CFR) Part 121 Certificate

Holders. For existing part 121 certificate holders, the process of creating an SMS and 

an implementation plan consists of the following:

• Mapping and analyzing your existing organization,

• Determining the extent to which your organization already complies with the

requirements of 14 CFR part 5,

• Developing a plan to comply with the requirements of part 5 with which your

organization does not already comply, and

• Submitting the plan to the Federal Aviation Administration (FAA) for approval.

NOTE: Existing part 121 certificate holders who wish to use their 

implementation plan that has been validated through SMS Pilot Project 

(SMSPP)/SMS Voluntary Program (SMSVP) must update their 

implementation plan to ensure compliance with part 5. 

b. New Certification. SMS implementation for a certificate applicant is different than that

for a certificate holder. The implementation plan requirement and the specific deadline for full 

SMS implementation is dependent on when your organization’s formal application for a part 121 

certificate is accepted by the FAA.

(1) Applicants Completing Formal Application After March 9, 2015. According to 

14 CFR part 119, § 119.8, applicants that have not completed formal application prior to 

March 9, 2015 must demonstrate that they meet the full requirements of 14 CFR part 5 prior to 

being issued a certificate. The application process for a part 121 certificate can be found in FAA 

Order 8900.1, Volume 10 (ATOS), Chapter 6, Section 2, Certification Process Document or 

Volume 2, Chapter 3 for Safety Assurance System (SAS). 

(2) Applicants Completing Formal Application Prior to March 9, 2015. Applicants 

that have completed formal application prior to March 9, 2015 may be issued certificates; 

however, they are still responsible for meeting the deadlines set out in §§ 119.8 and 5.1.

(a) Applicants Completing All Other Certification Requirements Prior to 

September 9, 2015. These applicants can be certificated without an SMS implementation plan. 

However, they must submit an SMS implementation plan prior to September 9, 2015 for 

approval by the FAA.

(b) Applicants Completing All Other Certification Requirements Prior to 

March 9, 2016. These applicants must submit an SMS implementation plan for review by the 

FAA prior to being issued a certificate. They must have an approved implantation plan prior to 

March 9, 2016.

Par 4-1 Page 49 
1/8/15 AC 120-92B

(c) Applicants Completing All Other Certification Requirements After 

March 9, 2016. Prior to receiving a part 121 certificate, these applicants will be required to have 

an approved SMS implementation plan for completion of all part 5 requirements prior to 

March 9, 2018.

(d) Applicants Unable to Complete All Certification Requirements Prior to 

March 9, 2018. These applicants will be required to demonstrate compliance with all 

requirements for SMS prior to being issued a certificate.

4-2. MAPPING AND ANALYZING YOUR ORGANIZATION. The first step in developing 

an SMS is mapping out and analyzing your organization. The initial mapping and analysis starts 

by describing and documenting your organizational structure, operational environment, and 

specific functions of each department.

a. Organizational Description. An organizational description should detail your 

company’s departments by operations, as well as management personnel responsible for the 

company’s systems (e.g., flight operations, training, ground operations, cabin safety, dispatch, 

maintenance). The organizational description may include, for example, discussion of using 

contractors for fueling and deicing operations, maintenance functions, etc. It is also common for 

unions of various employee groups to be discussed and described during the organizational 

description process.

b. Analysis. Following the organizational description, an analysis should describe and 

document what each department does, identify responsible and/or accountable personnel, and 

record who has the authority to modify processes and procedures and accept risk for each 

department. Typical timeframes: A small service provider may complete an organizational 

description in a few days; a medium-size service provider may do so within a couple of weeks, 

and a large organization may need a month or more.

4-3. CONDUCTING A GAP ANALYSIS. To build an implementation plan, you need to 

understand your current state of compliance with part 5, as well as programs you may already 

have that could be used to satisfy the requirements of part 5. A gap analysis involves analyzing 

and assessing your existing programs, systems, processes, and activities with respect to SMS 

requirements found in part 5. Your company may use any technique to identify what needs to be 

done to implement an SMS. If you chose to utilize a gap analysis, the completed gap analysis 

will provide input for development of your implementation plan.

a. Organizational Processes. Most certificate holders have many of the elements of 

an SMS in their current operational processes, although those processes may not entirely fulfill 

the requirements of part 5 (e.g., they may be limited in scope (do not cover the entire 

organization) and interoperability (do not interface sufficiently to form a “system”)). A list of 

regulatory and voluntary programs that may be appropriate for inclusion in your SMS to satisfy 

the requirements of part 5 can be found in Chapter 5, Integrating Existing Safety Programs into 

the Safety Management System (SMS).

b. Gap Analysis. In order to establish overall organizational compliance, the certificate 

holder should compare its current organizational processes to part 5 requirements. 

Par 4-1 Page 50
1/8/15 AC 120-92B

An implementation plan is then prepared to fill the gaps identified in the analysis. An optional 

FAA Gap Analysis Tool has been developed to assist certificate holders in their gap analysis 

efforts. An example is available in Appendix 5, Sample Gap Analysis and Implementation Plan 

Excerpts, but any method and/or tool that ensures complete coverage of part 5 requirements may 

be used by the certificate holder.

NOTE: If you determine that a process in your organization satisfies part 5, 

your gap analysis should identify how that process meets the requirements of 

part 5.

4-4. PREPARING AN IMPLEMENTATION PLAN.

a. What is an Implementation Plan?

(1) An implementation plan is a document that outlines the steps the air carrier plans to 

take to ensure that it has an SMS that is acceptable to the FAA by March 9, 2018.

(2) The requirements for an implementation plan are in §§ 5.1(b) and (c).

(3) To ensure that resources are being allocated and to monitor the development and 

implementation of the SMS, your accountable executive should be designated prior to the 

development of the implementation plan. The accountable executive is ultimately responsible for 

implementation and performance of the SMS.

b. What an Implementation Plan Should Cover. The implementation plan must cover 

the functions of your organization that directly impact aviation safety and the complete timeline 

of SMS development.

(1) It should include milestones for the development of the processes and procedures 

required by part 5.

(2) It should be updated as necessary as SMS implementation progresses.

(3) It should show a reference to each applicable part 5 section requirement and include 

a brief description explaining either:

• How you already comply with the specified requirement, or

• How you plan to comply with the requirement.

(4) The implementation plan should assign responsibility for completing 

implementation tasks/actions.

NOTE: An SMS process is considered “implemented” and in compliance 

with part 5 when: all process documentation (manuals) is complete and 

published; all process personnel are available and trained; all 

hardware/software is available and in the location of its intended use; and 

the Certificate Management Team (CMT) has validated the process.

Par 4-3 Page 51
1/8/15 AC 120-92B

(5) The implementation plan need not be complex or excessively detailed, but should 

provide a basic roadmap to meet part 5 requirements. The implementation plan may consist of 

more than one document, combined with the gap analysis document, or created in a format 

useful to your company. An implementation plan can be found in Appendix 5, Sample Gap 

Analysis and Implementation Plan Excerpts. If you are a part 121 certificate holder, your 

implementation plan must be approved by your respective CMT.

(6) Similar to the gap analysis process, you should receive input from the managers of 

all your organizational divisions and functional areas covered by the SMS. This is necessary to 

form a plan filling in all the gaps discovered during the gap analysis.

4-5. PHASED SMS IMPLEMENTATION STRATEGY.

a. Introduction. One recommended, but not required, way to implement an SMS is 

through a phased implementation approach. The sample SMS implementation strategy has 

four phases. For example, the four levels of phased implementation could be:

• Level 1 - Planning and organization,

• Level 2 - Basic safety management,

• Level 3 - Fully functional SMS, and

• Level 4 - Continuous improvement.

NOTE: Utilizing this method, the overall complexity of the task is divided 

into smaller, more manageable subcomponents.

b. Implementation Levels—Overview. The overall objective of the levels is to develop 

and implement an integrated, comprehensive SMS for your entire organization. Phased 

implementation can be thought of as organizational learning — the same building block 

approach often used in training and education of personnel. The recommended SMS 

development levels, as follows, are suggested but not required. Your organization may determine 

and develop your own phases, levels, divisional implementation strategies, etc. This four-level 

approach is only a representative template. Figure 4-1, Recommended Safety Management 

System (SMS) Implementation Levels, illustrates the recommended levels of SMS development 

and implementation.

Par 4-4 Page 52
1/8/15 AC 120-92B 

FIGURE 4-1. RECOMMENDED SAFETY MANAGEMENT SYSTEM 

IMPLEMENTATION LEVELS 

(1) Implementation Level 1: Planning and Organization. Level 1 begins when your 

management team commits to providing the resources necessary for full SMS implementation. 

Level 1 includes a thorough understanding of your organizational structure and a comparison 

(gap analysis) between the part 5 requirements and your organizational structure. Your 

organization will develop an implementation plan to bridge your identified gaps. The final 

implementation plan must be approved by your CMT. 

(2) Implementation Level 2: Basic Safety Management. Level 2 is where you 

develop and implement basic Safety Risk Management (SRM) and Safety Assurance (SA) 

processes and apply those processes to existing systems. This is often called the “reactive phase.” 

At this phase, your company is able to identify hazards and address unacceptable risk. Level 2 

implementation, depending on the size and complexity of the organization, typically takes 

12 months to complete. 

(3) Implementation Level 3: Functional SMS. Level 3 is where your SRM process 

will be applied to the initial design of systems, processes, organizations, and services; 

development of new or changed operational procedures; and planned changes to operational 

processes. This is the “proactive/predictive” phase, where risks in future planned operations are 

addressed. Both the SRM and SA processes developed at Level 2 are now applied in a predictive 

manner —applying safety management to something that you have not done before. At the 

completion of Level 3, you have a fully implemented SMS.

(4) Implementation Level 4: Continuous Improvement. At Level 4, you are 

monitoring your SMS and operational processes. By the time you reach this level, all required 

SMS processes are already in place. A major objective of a successful SMS is to attain and 

maintain this continuous improvement status for the life of the organization. 

c. SMS Implementation Layout. Figure 4-2, Safety Management System Development,

shows an example of a high-level phased implementation layout. An implementation plan 

prepared according to this layout would apply milestones, responsibilities, resources, and 

documentation. 

4 

1 

2 

3 

Basic Safety 

Management

Fully Functional 

SMS

Continuous 

Improvement

Planning &

Organization

Par 4-5 Page 53 
1/8/15 AC 120-92B 

FIGURE 4-2. SAFETY MANAGEMENT SYSTEM DEVELOPMENT

SMS Processes should be implemented by the indicated Level of 

Implementation

Implementation 

Level

SMS Processes 1 2 3

Part 5, Subpart B - Safety Policy (SMSPP 1.0) X

§ 5.21 - Safety Policy (SMSPP 1.1) X

§ 5.23 - Safety Accountability and Authority (SMSPP 1.2) X

§ 5.25 - Designation and responsibilities of required safety 

management personnel (SMSPP 1.3) (*1) X

§ 5.27 - Coordination of emergency response planning (SMSPP 1.4) X

Part 5, Subpart C - Safety Risk Management (SRM) (SMSPP 2.0) (*4) X

§ 5.51 - Applicability - (SMSPP 2.0) X

§ 5.53 - System analysis and hazard identification (SMSPP 2.1) (*4) X

 § 5.53(a) and (b) - System analysis (SMSPP 2.1.1) X

 § 5.53(c) - Hazard Identification (SMSPP 2.1.2) X

§ 5.55 - Safety Risk Assessment and Control (SMSPP 2.2) X

 § 5.55(a) - Analyze Safety Risk (SMSPP 2.2.1) X

 § 5.55(b) - Safety Risk Assessment (SMSPP 2.1.2) X

 § 5.55(c) - Safety Risk Control (SMSPP 2.1.3) X

Part 5, Subpart D - Safety Assurance (SA) (SMSPP 3.0) (*3) X

§ 5.71 - Safety Performance Monitoring and Measurement (SMSPP 3.1) X

 § 5.71(a)(1) and (2) - Monitoring (SMSPP 3.1.1) X

 § 5.71(a)(3) - Auditing (SMSPP 3.1.2 and 3.1.4) X

 § 5.71(a)(4) - Evaluations (SMSPP 3.1.3) X

 § 5.71(a)(5) and (6) - Investigations (SMSPP 3.1.5) X

 § 5.71(a)(7) - Confidential Employee Reporting System 

(SMSPP 3.1.6) X

§ 5.71(b) - Analyze Data (SMSPP 3.1.7) X

§ 5.73 - Safety Performance Assessment (SMSPP 3.1.8) (*3) X

§ 5.75 - Continuous Improvement (SMSPP 3.3) X

 § 5.75 - Correct Safety Performance (SMSPP 3.3.1) X

Part 5, Subpart E - Safety Promotion (SMSPP 4.0) X

§ 5.91 - Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X

§ 5.93 - Safety Communication (SMSPP 4.2) X

Part 5, Subpart F - SMS Documentation and Recordkeeping 

(SMSPP 1.5) X

§ 5.95 - SMS Documentation (SMSPP 1.5) X

§ 5.97 - SMS Records (SMSPP 1.5) X

(*1) Level 1 - Implement - § 5.25(c)(1) only

(*2) Level 1 - A training plan is expected for all personnel 

(*3) Level 2 - Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards 

(No need to baseline entire organization). Do not implement § 5.73a(4) and (5) 

(*4) Level 2 - Implementation of § 5.53, will be limited in level 2 by the lack of the system 

analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)

Par 4-5 Page 54 
1/8/15 AC 120-92B

SMS Processes should be implemented by the indicated Level of 

Implementation

Implementation 

Level

SMS Processes 1 2 3

Part 5, Subpart B - Safety Policy (SMSPP 1.0) X

§ 5.21 - Safety Policy (SMSPP 1.1) X

§ 5.23 - Safety Accountability and Authority (SMSPP 1.2) X

§ 5.25 - Designation and responsibilities of required safety 

management personnel (SMSPP 1.3) (*1) X

§ 5.27 - Coordination of emergency response planning (SMSPP 1.4) X

Part 5, Subpart C - Safety Risk Management (SRM) (SMSPP 2.0) (*4) X

§ 5.51 - Applicability - (SMSPP 2.0) X

§ 5.53 - System analysis and hazard identification (SMSPP 2.1) (*4) X

 § 5.53(a) and (b) - System analysis (SMSPP 2.1.1) X

 § 5.53(c) - Hazard Identification (SMSPP 2.1.2) X

§ 5.55 - Safety Risk Assessment and Control (SMSPP 2.2) X

 § 5.55(a) - Analyze Safety Risk (SMSPP 2.2.1) X

 § 5.55(b) - Safety Risk Assessment (SMSPP 2.1.2) X

 § 5.55(c) - Safety Risk Control (SMSPP 2.1.3) X

Part 5, Subpart D - Safety Assurance (SA) (SMSPP 3.0) (*3) X

§ 5.71 - Safety Performance Monitoring and Measurement (SMSPP 3.1) X

 § 5.71(a)(1) and (2) - Monitoring (SMSPP 3.1.1) X

 § 5.71(a)(3) - Auditing (SMSPP 3.1.2 and 3.1.4) X

 § 5.71(a)(4) - Evaluations (SMSPP 3.1.3) X

 § 5.71(a)(5) and (6) - Investigations (SMSPP 3.1.5) X

 § 5.71(a)(7) - Confidential Employee Reporting System 

(SMSPP 3.1.6) X

§ 5.71(b) - Analyze Data (SMSPP 3.1.7) X

§ 5.73 - Safety Performance Assessment (SMSPP 3.1.8) (*3) X

§ 5.75 - Continuous Improvement (SMSPP 3.3) X

 § 5.75 - Correct Safety Performance (SMSPP 3.3.1) X

Part 5, Subpart E - Safety Promotion (SMSPP 4.0) X

§ 5.91 - Competencies and Training (SMSPP 4.1, 4.1.1 and 4.1.2) (*2) X X

§ 5.93 - Safety Communication (SMSPP 4.2) X

Part 5, Subpart F - SMS Documentation and Recordkeeping 

(SMSPP 1.5) X

§ 5.95 - SMS Documentation (SMSPP 1.5) X

§ 5.97 - SMS Records (SMSPP 1.5) X

(*1) Level 1 - Implement - § 5.25(c)(1) only

(*2) Level 1 - A training plan is expected for all personnel

(*3) Level 2 - Only implement § 5.53(a) and (b) as it pertains to existing (known) hazards 

(No need to baseline entire organization). Do not implement § 5.73a(4) and (5)

(*4) Level 2 - Implementation of § 5.53, will be limited in level 2 by the lack of the system 

analysis process (§ 5.53(a) and (b) (SMSPP 2.1.1)) and § 5.73a(4) and (5)

Par 4-5 Page 55 (and 56)

1/8/15 AC 120-92B

CHAPTER 5. INTEGRATING EXISTING SAFETY PROGRAMS INTO THE SAFETY 

MANAGEMENT SYSTEM (SMS)

5-1. PURPOSE OF THIS CHAPTER. This chapter explains how your existing safety 

programs may be integrated into the SMS Safety Assurance (SA) processes. The Federal 

Aviation Administration (FAA) encourages the continued use of your current safety programs as 

part of overall safety management. Expanding your current safety programs across your entire 

organization is one way to provide a comprehensive systems approach to SA.

5-2. DISCUSSION OF INDIVIDUAL PROGRAMS.

a. Safety Programs and the SMS. Certificate holders are encouraged to be creative in 

utilizing safety programs to meet the specifications of the SMS rule. These programs collect data 

on the performance of the safety system, so most can be used to help satisfy some of the SA 

requirements.

b. FAA-Sanctioned Programs. The following are FAA-sanctioned programs, but they are 

not the only programs available.

(1) Continuing Analysis and Surveillance System (CASS).

(a) Program. CASS is required by Title 14 of the Code of Federal Regulations 

(14 CFR) part 121, § 121.373. CASS is a quality assurance (QA) system that monitors and 

analyzes the performance and effectiveness of the air carrier’s Continuous Airworthiness 

Maintenance Program (CAMP).

(b) Integration. A CASS overlaps some of the SMS SA functions (14 CFR part 5, 

§ 5.71). CASS could be a standalone system, or a subsystem within an SMS. CASS may be 

maintained separately; however, it would probably be beneficial to integrate CASS within the 

SMS. However accomplished, it is imperative to understand that CASS should supply 

information to the SMS. The SMS may even support CASS through the use of Safety Risk 

Management (SRM) and SA processes applied to CASS needs. An SMS may evaluate the CASS 

to ensure that all critical CASS elements are being performed and controlled and all outcomes 

are acceptable in accordance with FAA Order 8900.1, Volume 3, Chapter 44, Assess Continuing 

Analysis and Surveillance System for Parts 121 and 135, and the current edition of Advisory 

Circular (AC) 120-79, Developing and Implementing an Air Carrier CASS.

(2) Aviation Safety Action Program (ASAP).

(a) Program. The ASAP is meant to encourage voluntary reporting of safety issues 

and events that come to the attention of participating certificate holders’ employees. ASAPs 

include processes for intake of data from employees, analysis of the data, and development of 

corrective actions within a confidential environment. ASAP is accepted by the FAA but is not 

required. ASAP development, implementation, acceptance, and operation are detailed in the 

current edition of AC 120-66, Aviation Safety Action Program (ASAP).

(b) Integration. ASAP can be used to satisfy some SMS requirements (§ 5.71).

For example, the ASAP can be used to partially satisfy the requirement for a confidential 

Par 5-1 Page 57
1/8/15 AC 120-92B

reporting system. Employee groups not covered by an ASAP would need some type of 

confidential employee reporting system. In the event of termination of an ASAP program, those 

covered employees would be required to have a confidential employee reporting system. ASAP 

requires analysis and corrective action; however, it does not require analysis of patterns or trends 

across reports that would identify systemic problems. This information should be analyzed 

through the SA process.

(3) Aviation Safety Reporting System (ASRS).

(a) Program. The FAA ASRS utilizes the National Aeronautics and Space 

Administration (NASA) as a third party to receive aviation safety reports. The ASRS does not 

provide an explicit requirement for corrective actions, nor does it provide sufficient detailed data 

with which to adequately analyze specific systems or processes.

(b) Integration. Trend and global systemic information may be appropriate for SA 

analysis under SMS. Additional information on these policies can be obtained in AC 00-46, 

Aviation Safety Reporting Program.

(4) Flight Operational Quality Assurance (FOQA).

(a) Program. FOQA is a voluntary program for the routine collection and analysis 

of digital flight data generated during aircraft operations. The FOQA program is another 

potential tool in an operator’s SMS to monitor operational data and provides data analysis and 

assessment. FOQA program development, implementation, acceptance, and operation are 

covered in the current edition of AC 120-82, Flight Operational Quality Assurance.

(b) Integration. FOQA can be used to satisfy some SMS SA requirements (§ 5.71). 

FOQA requires data collection and analysis but stops short of requiring corrective action. Thus, 

this requirement would be dependent on the configuration of the specific operator’s program —

a subject of the gap analysis. FOQA, if present, must interface with the operator’s other safety 

programs and their SMS.

(5) Voluntary Disclosure Reporting Program (VDRP).

(a) Program. The VDRP provides incentives for a certificate holder to voluntarily 

identify, report, and correct instances of regulatory noncompliance. The FAA will review, 

accept, and oversee corrective actions and conduct followup surveillance. The FAA’s acceptance 

of the voluntary disclosure foregoes legal enforcement action, and protects from release, when 

specific criteria are met, qualifying disclosures and corrective actions. Additional information on 

the VDRP can be obtained in the current edition of AC 00-58, Voluntary Disclosure Reporting 

Program.

(b) Integration. VDRP data is not normally a source of safety information. 

However, the data gathered during an investigation, subsequent development, and 

implementation of a fix could be integrated into the data analysis, assessment, and validation 

processes of a carrier’s SMS SA.

Par 5-2 Page 58
1/8/15 AC 120-92B

(6) Internal Evaluation Program (IEP).

(a) Program. The IEP can be a safety process that, through inspections, audits, and 

evaluations, assesses the adequacy of managerial controls and processes in critical safety 

systems. The FAA encourages (and the Department of Defense (DOD) requires) using an IEP to 

increase awareness management and employees’ responsibility to follow company safety 

practices and comply with all regulatory requirements. IEP is the subject of the current editions 

of AC 120-59, Air Carrier Internal Evaluation Program, and AC 145-5, Repair Station Internal 

Evaluation Programs.

(b) Integration. An IEP can be part of an SA process. If used by a certificate 

holder, an IEP can satisfy the internal evaluation requirement of § 5.71. Since an IEP is not 

covered by a standalone regulation or formal voluntary program approval process, its use within 

an SMS is dependent on the configuration.

(7) Line Operations Safety Audit (LOSA).

(a) Program. The Line Operations Safety Audit (LOSA) is a formal process where

qualified observers ride the jump seat during regularly scheduled flights to collect safety-related 

data on various weather and visibility conditions, operational complexities, and flightcrew 

performance. A LOSA program is not formally approved or accepted by the FAA. LOSA is the 

subject of the current edition of AC 120-90, Line Operations Safety Audits.

(b) Integration. A LOSA program could be used to satisfy part of the internal audit 

requirements of § 5.71. A gap analysis would be required to ensure that it meets SMS standards. 

LOSA results, if present, should be included in the SA data acquisition process.

(8) Advanced Qualification Program (AQP).

(a) Program. The AQP is a systematic methodology for developing training 

program components for air carrier crewmembers and dispatchers. An AQP incorporates 

data-driven quality control processes for validating and maintaining the effectiveness of 

curriculum content. AQP is the subject of the current edition of AC 120-54, Advanced 

Qualification Program.

(b) Integration. The AQP can be used to satisfy a portion of the SMS SA 

monitoring requirement (§ 5.71(a)(1)). The certificate holder may elect to use or develop 

an AQP, depending on their unique operational complexities.

Par 5-2 Page 59 (and 60)

1/8/15 AC 120-92B

Appendix 1

APPENDIX 1. SMS CROSS-REFERENCE FOR TRANSITIONING SMS PILOT 

PROJECT PARTICIPANTS

The following table provides a cross reference between Advisory Circular (AC) 120-92A, 

Appendix 1, Safety Management System Framework: Functional Expectations, and Title 14 of 

the Code of Federal Regulations (14 CFR) part 5. It is an aid to service providers who have 

implemented all or part of an SMS under AC 120-92A. The FAA emphasizes that this 

cross-reference chart does not mean that an existing process automatically satisfies the pertinent 

part 5 requirements. Certificate holders should conduct a gap analysis, or a similar procedure, to 

ascertain whether changes need to be made to their existing processes in order to satisfy the 

requirements of part 5.

FIGURE A1-1. SAFETY MANAGEMENT SYSTEM PILOT PROJECT6

AC 120-92A–PART 5 CROSS-REFERENCE

AC 120-92A, Appendix 1 (SMSPP) 

Framework

Title 14 CFR Part 5

Component 1.0 Safety Policy and Objectives § 5.3(a)(1), Subpart A, General Requirements

Element 1.1 Safety Policy § 5.21, Safety Policy, Subpart B Safety Policy

Element 1.2 Management Commitment and 

Safety Accountabilities

§ 5.23, Safety Accountability and Authority, 

§ 119.65 Requirements, § 121.135 Manual 

Contents, and § 121.369 Manual 

Requirements

Element 1.3 Key Safety Personnel § 5.25, Designation and Responsibilities of 

Required Safety Management Personnel, 

§ 119.65 Requirements

Element 1.4 Emergency Preparedness and 

Response

§ 5.27, Coordination of Emergency Response 

Planning

Element 1.5 SMS Documentation and 

Records

Subpart F, SMS Documentation and 

Recordkeeping, §§ 5.95, 5.97 and 121.135

Component 2.0 Safety Risk Management Subpart C, Safety Risk Management, § 5.51 

Applicability

Element 2.1 System Analysis & Hazard 

Identification

§ 5.53, System Analysis and Hazard 

Identification

Process 2.1.1 System Description and Task 

Analysis

§ 5.53(a) and (b)

Process 2.1.2 Identify Hazards § 5.53(c)

Element 2.2 Risk Assessment and Control §5.55(a), Safety Risk Assessment and Control

Process 2.2.1 Analyze Safety Risk § 5.55(a)

Process 2.2.2 Assess Safety Risk § 5.55(b)

Process 2.2.3 Control/Mitigate Safety Risk § 5.55(c)

6 This cross-reference is included to assist carriers who originally developed their documentation in accordance with 

AC 120-92A, Appendix 2, and for alignment with international standards. The items referenced as “components” or 

“elements” are also consistent with International Civil Aviation Organization (ICAO) Annex 19, Appendix 2, the 

ICAO SMS Framework.

Page 1

 
1/8/15 AC 120-92B

Appendix 1

AC 120-92A, Appendix 1 (SMSPP) 

Framework

Title 14 CFR Part 5

Component 3.0 Safety Assurance Subpart D, Safety Assurance

Element 3.1 Safety Performance Monitoring 

and Measurement

§ 5.71, Safety Performance Monitoring and 

Measurement

Process 3.1.1 Continuous Monitoring § 5.71(a)(1) and (2)

Process 3.1.2 Internal Audits by Operational 

Departments

§ 5.71(a)(3)

Process 3.1.3 Internal Evaluation § 5.71(a)(4)

Process 3.1.4 External Auditing of the SMS § 5.71(a)(3)

Process 3.1.5 Investigation § 5.71(a)(5) and (6)

Process 3.1.6 Employee Reporting and 

Feedback System

§ 5.71(a)(7)

Process 3.1.7 Analysis of Data § 5.71(b)

Process 3.1.8 System Assessment § 5.73(a), Safety Performance Assessment

Element 3.2 Management of Change § 5.73(b) and (a)(2)–(5)

Element 3.3 Continuous Improvement § 5.75, Continuous Improvement

Process 3.3.1 Preventive/Corrective Action § 5.75

Process 3.3.2 Management Review § 5.73(a)

Component 4.0 Safety Promotion Subpart E, Safety Promotion

Element 4.1 Competencies and Training § 5.91, Competencies and Training

Process 4.1.1 Personnel Requirements 

(Competence)

§ 5.91

Process 4.1.2 Training § 5.91

Element 4.2 Communication and Awareness § 5.93, Safety Communication

Page 2
1/8/15 AC 120-92B 

Appendix 2 

APPENDIX 2. SAFETY RISK MANAGEMENT (SRM) WORKSHEETS

The worksheets in this appendix are provided to illustrate the SRM process and a possible way to 

develop and document the SRM processes required under Title 14 of the Code of Federal 

Regulations (14 CFR) part 5, subpart C. These worksheets are provided for illustrative purposes 

only. Carriers may develop their own record keeping systems and should determine the amount 

and depth of documentation and recordkeeping that are needed to show compliance. Not all 

situations will require the same degree of detail.

FIGURE A2-1. SAFETY RISK MANAGEMENT TRIGGERING CONDITIONS AND 

SUMMARY

NOTE: Refer to part 5, § 5.51 

Title:

Reason for Risk Assessment

New System Design

Change to Existing System Design

New Operational Procedure

Modification to an Existing Operation or Procedure

Operational Environment Change

Ineffective Risk Control

Brief Summary

Where signed below, the authorized manager has determined that no new hazards have 

been introduced by this change:

Name:

Signature:

Page 1 
1/8/15 AC 120-92B

Appendix 2

FIGURE A2-2. SYSTEM ANALYSIS

NOTE: Refer to § 5.53(a) and (b).

Responsible Manager:

Authority for Implementation and Risk Acceptance:

Function and Purpose of the System or Change:

Description of Operating Environment Related Hazards

Personnel

Equipment

Facilities

Page 2
1/8/15 AC 120-92B

Appendix 2

FIGURE A2-3. HAZARD LIST

NOTE: Refer to §§ 5.53(c) and 5.23 (a)(1).

System/Project: __________________________

Responsible Manager: __________________________

Hazard Potential Consequence(s)

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

Page 3
1/8/15 AC 120-92B 

Appendix 2 

FIGURE A2-4. RISK ANALYSIS

NOTE: Refer to § 5.55(a). 

Pre-Control Post-Control 

Hazard Potential 

Consequences

Severity Likelihood Substitute 

Risk?

Severity Likelihood

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10 

Page 4 
1/8/15 AC 120-92B 

Appendix 2 

FIGURE A2-5. RISK ANALYSIS AND ASSESSMENT SUMMARY

NOTE: Refer to §§ 5.55(b) and 5.23(b). 

Acceptance Authority (Sign here and Initial Appropriate Columns): ___________________ 

Pre-Control Accept? Post-Control Accept?

Hazard Potential 

Consequences

Severity Likelihood Severity Likelihood

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

Page 5 
1/8/15 AC 120-92B 

Appendix 2 

FIGURE A2-6. RISK CONTROL

NOTE: Refer to § 5.55(c) and (d).

System/Project: ___________________________________________________________ 

Responsible Manager: ___________________________________________________________ 

Hazard Control Substitute Risk Residual Risk

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

Page 6 
1/8/15 AC 120-92B 

Appendix 2 

FIGURE A2-7. RISK CONTROL DOCUMENTATION 

NOTE: Refer to 14 CFR part 5, subpart F.

System/Project: ___________________________________________________________ 

Hazard Procedure Documentation 

H1

H2

H3

H4

H5

H6

H7

H8

H9

H10

Page 7 (and 8) 

1/8/15 AC 120-92B

Appendix 3

APPENDIX 3. SAMPLE SAFETY POLICY STATEMENT

The Executive Management of [Certificate Holder’s name] recognizes that an effective Safety 

Management System (SMS) is vital to the success and longevity of the Company. Therefore the 

Executive Management is committed to implementing and maintaining a fully functional SMS 

and to the continuous improvement of the level of safety throughout [Certificate Holder’s name].

• Executive Management of [Certificate Holder’s name] will establish specific 

safety-related objectives and will periodically publish and distribute to all employees 

those objectives and plans.

• These safety objectives will be monitored, measured, and tracked to ensure overall 

corporate safety objectives are met. All employees and individuals in the company have 

the responsibility to perform their duties and activities in the safest practical manner.

• [Certificate Holder’s name] Executive Management is committed to providing the 

necessary financial, personnel, and other resources to establish and maintain a fully 

functional SMS.

• [Certificate Holder’s name] Executive Management is dedicated to establishing 

a confidential employee reporting system to report all hazards, accidents, incidents, and 

safety issues without fear of reprisal.

• Activities involving intentional disregard for FAA regulations, company policies and 

procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary 

action.

• As a component of the SMS, [Certificate Holder’s name] Executive Management is 

committed to establishing, maintaining, and periodically exercising an emergency 

response procedure and plan that provides for the safe transition from normal to 

emergency operations.

Executive Management will convey this expectation to all employees through postings, intranet

site, company newsletter, and any other means to ensure all employees are aware of the 

company’s SMS, their duties and responsibilities, and our safety policy.

This safety policy will be periodically reviewed by Executive Management to ensure it remains 

relevant and appropriate to the company.

[Signed],

Accountable Executive [Additional management personnel optional]

Page 1 (and 2)

1/8/15 AC 120-92B

Appendix 4

APPENDIX 4. IDENTIFYING THE ACCOUNTABLE EXECUTIVE

To assist the organization with the selection of their accountable executive, Figures A4-1 and 2

provide flowcharts with a series of questions. Figure A4-1 identifies different organizational 

structures and how those structures may determine the accountable executive.

FIGURE A4-1. ACCOUNTABLE EXECUTIVE DECISION PROCESS.

Page 1
1/8/15 AC 120-92B

Appendix 4

FIGURE A4-2. VERIFYING THE ACCOUNTABLE EXECUTIVE.

Once the accountable executive is identified (Figure A4-1), the questions in Figure 9 will assist 

in verifying that the selected person is the correct choice. In Figure A4-2, all questions must 

receive a “yes” answer. Should any of the questions result in a “no” answer, you should start the 

selection process again with a new candidate.

Page 2
1/8/15 AC 120-92B

Appendix 5

APPENDIX 5. SAMPLE GAP ANALYSIS AND IMPLEMENTATION PLAN 

EXCERPTS

FIGURE A5-1. AIR CARRIER GAP ANALYSIS TOOL

Page 1
1/8/15 AC 120-92B

Appendix 5

FIGURE A5-2. SAMPLE WORK BREAKOUT SCHEDULE

Page 2
1/8/15 AC 120-92B

Appendix 6

APPENDIX 6. REFERENCES AND ADDITIONAL INFORMATION

a. Safety Management System (SMS)-Related Web Sites. For additional information 

regarding Safety Management Systems you may want to visit the following Web sites:

(1) FAA Public SMS Web site: 

http://www.faa.gov/about/initiatives/sms/specifics_by_aviation_industry_type/

(2) ICAO Publications and Resources Web site: 

http://www.icao.int/anb/safetymanagement/Documents.html

(3) ICAO SMS Training Web site: 

http://www.icao.int/anb/safetymanagement/training/training.html

(4) Transport Canada SMS Web site: http://www.tc.gc.ca/civilaviation/sms/menu.htm

(5) Transport Canada Process to Assess Industry SMS Web site: 

http://www.tc.gc.ca/CivilAviation/SMS/Training/Module9/menu.htm

(6) Australian Government Civil Aviation Safety Authority SMS Training Web site: 

http://www.casa.gov.au/scripts/nc.dll?WCMS:STANDARD:1779027664:pc=PC_91435

(7) Civil Aviation Authority of New Zealand SMS Web site: 

http://www.caa.govt.nz/SMS/SMS_home.htm

(8) WBAT (Web-Based Application Tool): WBAT (maintained by Universal Technical 

Resource Services, Inc. (UTRS)) provides aviation service providers with a secure, fully 

customizable system that promotes safety and accountability across five employee groups. UTRS 

developed WBAT with funding from the FAA, and will deliver free on-site training and 

electronic support to Certificate Holders. The UTRS point of contact can be reached at 

info@wbat.org.

(9) Advisory Circulars (AC) 00.2 and AC 00-44: The current edition of AC 00.2, 

Advisory Circular Checklist and Status of Other FAA Publications, contains a listing of all ACs. 

The current edition of AC 00-44, Status of Federal Aviation Regulations, contains a listing of the 

Codes of Federal Regulations (CFR) and current prices.

(10) ACs Online: You can get copies of this and other ACs online at 

http://www.faa.gov/regulations_policies/advisory_circulars.

(11) Regulations Online: You can also obtain a copy of current regulations online at 

http://www.gpoaccess.gov/ecfr.

(12) FAA Web Site: Our Web site is at http://www.faa.gov. The Flight Standards

Information Management System (FSIMS) Web site is located at http://fsims.faa.gov.

Page 1
1/8/15 AC 120-92B

Appendix 6

b. Related Reading Material. The following documents (current editions), may be 

helpful in developing an SMS:

• Title 14 CFR Part 5, Safety Management Systems for Certificate Holders Operating 

under 14 CFR Part 121.

• AC 120-59, Air Carrier Internal Evaluation Programs (IEP).

• AC 120-66, Aviation Safety Action Programs (ASAP).

• AC 00-58, Voluntary Disclosure Reporting Program (VDRP).

• AC 120-79, Developing and Implementing a Continuing Analysis and Surveillance 

System (CASS).

• AC 120-82, Flight Operational Quality Assurance (FOQA).

• Annex 6 to the Convention on International Civil Aviation, Part 1, International 

Commercial Air Transport, Aeroplanes (with Amendment 33).

• FAA Order 8000.369, Safety Management System Guidance.

• FAA Order VS 8000.367, Aviation Safety (AVS) Safety Management System 

Requirements.

• International Civil Aviation Organization (ICAO) Document 9859, ICAO Safety 

Management Manual (SMM, Second Edition, 2009).

Page 2