Introduction to Safety Management Systems (SMS)

Effective October 2009

2nd Edition
Introduction to Safety Management Systems (SMS)
Effective October 2009

International Air Transport Association

Montreal — Geneva 2nd Edition
 NOTICE
DISCLAIMER. The information contained in this
publication is subject to constant review in the light
of changing government requirements and regula-
tions. No subscriber or other reader should act on
the basis of any such information without referring
to applicable laws and regulations and/or without
taking appropriate professional advice. Although
every effort has been made to ensure accuracy, the
International Air Transport Association shall not be
held responsible for any loss or damage caused by
errors, omissions, misprints or misinterpretation of
the contents hereof. Furthermore, the International
Air Transport Association expressly disclaims any
and all liability to any person or entity, whether a
purchaser of this publication or not, in respect of
anything done or omitted, and the consequences
of anything done or omitted, by any such person or
entity in reliance on the contents of this publication.

© International Air Transport Association. All

Rights Reserved. No part of this publication may
be reproduced, recast, reformatted or trans-
mitted in any form by any means, electronic or
mechanical, including photocopying, record-
ing or any information storage and retrieval sys-
tem, without the prior written permission from:

Senior Vice President

Safety, Operations & Infrastructure
International Air Transport Association
800 Place Victoria
P.O. Box 113
Montreal, Quebec
CANADA H4Z 1M1

Introduction to Safety Management Systems (SMS)

Ref. No: 8402-01
ISBN 978-92-9233-287-7
© 2009 International Air Transport Association. All rights reserved.
Montreal — Geneva
 TABLE OF CONTENTS

1. Introduction to Safety Management Systems (SMS)..................................................................................1

1.1 Definition of Safety............................................................................................................................1
1.2 What is an SMS? ..............................................................................................................................1
1.3 Why SMS? ........................................................................................................................................1
1.4 SMS Requirements...........................................................................................................................2
1.5 Components of an SMS....................................................................................................................3
1.5.1 Safety Policy and Objectives...............................................................................................3
1.5.2 Safety Risk Management (SRM).........................................................................................4
1.5.3 Safety Assurance (SA) ........................................................................................................4
1.5.4 Safety Promotion.................................................................................................................4
1.6 Definition of Concepts.......................................................................................................................5
1.7 Organizational and Safety Cultures ..................................................................................................5

2. Safety Policy and Objectives ......................................................................................................................7

2.1 Management Commitment and Responsibility .................................................................................7
2.2 Safety Accountabilities......................................................................................................................7
2.3 Appointment of Key Safety Personnel..............................................................................................8
2.3.1 Safety Review Board...........................................................................................................9
2.3.2 Safety Action Group ......................................................................................................... 10
2.4 Coordination of Emergency Response Planning........................................................................... 10
2.4.1 Airports ............................................................................................................................. 11
2.4.2 Airlines.............................................................................................................................. 11
2.4.3 Activation of ERP ............................................................................................................. 11
2.5 SMS Documentation...................................................................................................................... 12

3. Safety Risk Management......................................................................................................................... 13

3.1 Hazard Identification ...................................................................................................................... 13
3.1.1 Occurrence Data Collection and Analysis........................................................................ 14
3.1.2 Accident and Incident Investigations................................................................................ 15
3.1.3 Flight Data Analysis.......................................................................................................... 16
3.1.4 Auditing ............................................................................................................................ 17
3.2 Risk Assessment and Mitigation.................................................................................................... 17
3.2.1 Risk Assessment.............................................................................................................. 17
3.2.2 Risk Mitigation .................................................................................................................. 20

nd
2 EDITION, OCTOBER 2009 iii
 Introduction to Safety Management Systems (SMS)

4. Safety Assurance ..................................................................................................................................... 21

4.1 Safety Risk Management and Safety Assurance........................................................................... 21
4.2 Safety Performance Monitoring and Measurement ....................................................................... 21
4.3 Management of Change................................................................................................................. 22
4.4 Continuous Improvement of the SMS ............................................................................................ 23

5. Safety Promotion ...................................................................................................................................... 25

5.1 Safety Training and Education ....................................................................................................... 25
5.2 Safety Communication ................................................................................................................... 26

6. Integrating Airline Management Systems ................................................................................................ 27

7. The Regulatory Authority’s Role in SMS Oversight ................................................................................. 29

8. SMS Implementation ................................................................................................................................ 33

8.1 Gap Analysis .................................................................................................................................. 33
8.2 Safety Management Plan............................................................................................................... 33
8.3 Safety Policy................................................................................................................................... 33
8.4 Provision of Resources .................................................................................................................. 33
8.5 Outsourcing of Services ................................................................................................................. 34
8.6 Phased Approach to SMS Implementation .................................................................................... 34

9. Conclusion................................................................................................................................................ 35

Resources ....................................................................................................................................................... 36

iv nd
2 EDITION, OCTOBER 2009
1. INTRODUCTION TO SAFETY MANAGEMENT SYSTEMS (SMS)

The aim of this document is to provide airlines with an understanding of the basic concepts
associated with a Safety Management System (SMS). The material presented in this guide is
based on the ICAO Safety Management Manual (SMM) (Doc 9859), the IATA Operational Safety
Audit (IOSA) program, guidance material from various civil aviation authorities and ISO
9001:2008 principles.

1.1 DEFINITION OF SAFETY

Safety is the state in which the risk of harm to persons or property damage is reduced to, and
maintained at or below, an acceptable level through a continuous process of hazard identification
and risk management. This definition implies constant measurement and evaluation of an
airline’s safety performance and feedback into the SMS.

1.2 WHAT IS AN SMS?

ICAO defines an SMS as a systematic approach to managing safety, including the necessary
organizational structures, accountabilities, policies and procedures. Airlines are responsible for
establishing an SMS while States are responsible for the acceptance and oversight of an airline’s
SMS.
An SMS is a business-like approach to managing safety. As with any business process, goals
must be set, levels of authority and clear accountabilities for operational safety established, and
provision made for the SMS to obtain the same focus as the airline’s financial management
system. Ultimately, the SMS becomes an integral part of the airline’s management system and
culture.
A fully-developed SMS is a formalized, company-wide system established at the corporate level,
which encompasses all of the individual departments of the company. Flight operations,
engineering and maintenance, ground operations and all other departments whose activities
contribute to the airline’s safety performance will have their own processes and procedures within
the context of the corporate SMS. Furthermore, the organization will develop a management
system that maintains continuity throughout the organization, and provides positive control of the
operation. The company should also consider extending its SMS to vendors when the activities
listed above have been outsourced.
Internal reporting, documentation, and communication are essential to ensure that operational
personnel and members of the management team have accurate information regarding the SMS.
Therefore, airlines must create and maintain a manual that provides a comprehensive description
of the scope, structure and functionality of the SMS, including documented organizational roles
and responsibilities. In addition, a system must be in place to ensure that the content of
manuals, used to support and control airline operations, is clear, concise and current.

1.3 WHY SMS?

Effective safety management requires a realistic balance between safety, productivity, and costs.
The process for achieving this balance is called system safety and is described by ICAO as
balancing the needs of an organization in terms of production (delivery of services) and
protection (safety).
System safety is a formal, yet flexible process. It does not limit itself to identifying deficiencies
after adverse events. Instead, it pro-actively searches for opportunities to improve operational
processes. As a result of the continuous and proactive identification of safety concerns within the
operation, improvements to mitigate negative outcomes become embedded in processes
throughout the organization.

nd
2 EDITION, OCTOBER 2009 1
 Introduction to Safety Management Systems (SMS)

SMS is designed to increase the knowledge and understanding of employee errors and
operational issues in order to develop effective mitigation strategies. Data sources, such as
employee safety reports, allow the airline to analyze operational work errors and how they may
contribute to a serious incident or accident. Both safety managers and line managers must
understand that the following:
Ê Everyone make mistakes
Ê Errors are consequences rather than causes
Ê We analyze errors to help understand “why,” not “what” or “who”
Ê Errors are precursors to a more serious incident or accident
Ê Thorough investigation and analysis of errors will enable development of effective mitigations
These concepts are supported by the notion of the organizational accident. This notion illustrates
that an accident is an interaction between organizational processes set out by senior
management, workplace conditions that lead personnel to commit active failures, and latent
conditions that can penetrate current defenses and have adverse effects on safety.
Safety is becoming increasingly viewed as the outcome of operational processes that are
components of an organization’s management systems. These systems undergo constant
change and an SMS provides the tools and processes to facilitate organizational or procedural
change and maintain an acceptable level of safety.
State regulatory agencies are in a period of transition from a predominantly prescriptive (rule-
based) regulatory framework to an integrated regulatory environment that combines prescriptive
and performance-based regulatory approaches. Moreover, two activities are being conducted in
parallel. On one hand, States are establishing a State Safety Program (SSP) that is a
management system to provide oversight of service providers licensed by the State. On the
other hand, individual service providers, such as airlines, are implementing an SMS.

1.4 SMS REQUIREMENTS

ICAO has introduced safety management requirements into the following annexes:
Ê Annex 1 – Personnel Licensing
Ê Annex 6 — Operation of Aircraft, Part I — International Commercial Air Transport —
Aeroplanes, and Part III — International Operations — Helicopters
Ê Annex 8 – Airworthiness of Aircraft
Ê Annex 11 — Air Traffic Services
Ê Annex 13 – Aircraft Accident and Incident Investigation
Ê Annex 14 — Aerodromes
As part of the ICAO requirements in these annexes, service providers must implement an SMS
that is accepted by their State.
Note: The term “service provider” includes the following entities: approved training organizations
(that are exposed to safety risks during the provision of their services), aircraft operators,
maintenance organizations, air traffic services providers, certified aerodrome operators and
organizations responsible for type design and/or manufacture of aircraft.
As part of the requirements, an SMS must address the following requirements (ICAO SMM
6.5.1):
Ê Identify safety hazards
Ê Ensure the implementation of remedial action necessary to maintain agreed safety
performance

2 nd
2 EDITION, OCTOBER 2009
 Introduction to SMS

Ê Provide for continuous monitoring and regular assessment of the safety performance
Ê Aim for a continuous improvement of the overall performance of the SMS
As part of these requirements, the organization must appoint a senior corporate official as the
Accountable Executive, who retains overall accountability for the SMS. The Accountable
Executive must possess the authority and control of the resources necessary to finance,
implement, and enforce policies and procedures within the operation. While ultimate
responsibility for the SMS remains at all times with the Accountable Executive, implementation of
the SMS may be delegated to an identified responsible person within the organization (see
Transport Canada Advisory Circular 107-001, Guidance on SMS Development).
The organization needs to identify and assign responsibility within SMS for ensuring compliance
with regulatory requirements and established internal standards. The outsourcing of any function
that may affect safety requires the organization to ensure effective safety oversight of such
functions. The means by which this control is achieved needs to be identified within the SMS.
Safety responsibilities will be further discussed in Section 2 of this document.
Section 1 of the IOSA Standards Manual (ISM) and the associated guidance material, will
continue to be revised to reflect current ICAO SMS requirements and best practices. The IOSA
standards will only reflect the basic SMS requirements stated in the ICAO Annexes. Some Civil
Aviation Authorities (CAAs) may develop additional requirements above those SMS standards
reflected in the ISM.

1.5 COMPONENTS OF AN SMS

The structure of an SMS may vary according to the size and complexity of a service provider and
its aims and objectives. ICAO and various CAAs have produced guidance for service providers
on the implementation of the four components and associated twelve elements that comprise an
SMS framework. IATA aligns with the ICAO SMS framework, which is presented in this section.
The primary requirement for an SMS is a general commitment from the highest level of
management. The separate elements of an SMS are not stand-alone and unique; the elements
inter-react and support each other. All components of an SMS should be reviewed on a regular
basis to ensure that they remain current and relevant to the organization.
Quality management must be utilized to ensure that all policies are clearly defined, with
procedures and processes in place to detail how such policies are to be implemented and
managed.
The following four components and twelve associated elements, as a minimum, should be
included in an SMS framework. This section presents a high-level summary; each element will
be discussed in more detail later in this document.

1.5.1 Safety Policy and Objectives

Management commitment and responsibility: Commitment of the senior management to
safety is reflected in a policy statement, which is signed by the Accountable Executive.
(ICAO Annex 6, 3.3.5; Appendix 7, 1.1)
Safety accountabilities: A statement of accountabilities clearly defines safety responsibilities of
managers and employees at different levels in the organization, with effective deputation of
responsibilities established for operationally critical areas when principal office holders are
absent. (ICAO Annex 6, 3.3.5; Appendix 7, 1.2)
Appointment of key safety personnel: The Safety Manager, in most organizations, will be the
person to whom the Accountable Executive has assigned the daily oversight functions of the
SMS. (ICAO Annex 6, 3.3.5; Appendix 7, 1.3)

nd
2 EDITION, OCTOBER 2009 3
 Introduction to Safety Management Systems (SMS)

Coordination of emergency response planning: Service providers implement an Emergency

Response Program (ERP) that includes contingency plans to ensure proper response throughout
the organization when an emergency situation arises. This may not necessarily involve an actual
aircraft accident, but should include a business continuity contingency plan.
(ICAO Annex 6, 3.3.5; Appendix 7, 1.4)
SMS documentation: Safety management activities must be documented appropriately and be
available to all employees. (ICAO Annex 6, 3.3.5; Appendix 7, 1.5)

1.5.2 Safety Risk Management (SRM)

Hazard identification: The airline must maintain processes that ensure that operational hazards
are identified for all operational activities. Hazard identification is typically based on a
combination of reactive, proactive, and predictive safety management methods.
(ICAO Annex 6, 3.3.5; Appendix 7, 2.1)
Risk assessment and mitigation: Individual hazards are analyzed; their consequences are
assessed and communicated throughout the organization. Mitigation actions must be developed
for those hazards presenting unacceptable operational risk.
(ICAO Annex 6, 3.3.5; Appendix 7, 2.2)

1.5.3 Safety Assurance (SA)

Safety performance monitoring and measurement: SA activities focus on assessing the
health of the organization, with an emphasis on safety. Specific goals for improvements in all
areas should be set for all senior operational managers. SA should include monitoring of
external sources of safety information and include participation in regional safety groups or safety
data sharing organizations. (ICAO Annex 6, 3.3.5; Appendix 7, 3.1)
Management of change: External or internal changes may introduce new hazards to
operational activities. Processes must exist to manage organizational responses to regulatory
changes, major changes in operational procedures, or new activities such as new airport
destinations. Safety reporting systems should have processes established to identify new risks
and actively monitor performance in new areas of the operation.
(ICAO Annex 6, 3.3.5; Appendix 7, 3.2)
Continuous improvement of the SMS: SA utilizes quality tools such as internal evaluations or
independent audits to assess organizational health from a safety perspective. Onsite
assessments of operational management systems on a recurring basis provide opportunities for
continuous improvement of processes and procedures for each functional area of the airline.
(ICAO Annex 6, 3.3.5; Appendix 7, 3.3)

1.5.4 Safety Promotion

Training and education: The airline must identify safety training requirements for each level of
management and for each employee group. Safety training for operational personnel should
address safety responsibilities, including complying with all operating and safety procedures,
recognizing and reporting hazards, and ultimately ensuring that employees have the knowledge
and skills to safely complete work activities. (ICAO Annex 6, 3.3.5; Appendix 7, 4.1)
Safety communication: Communication of safety information is a key responsibility for the
Safety Manager. Continuous improvement and learning is accomplished through the sharing of
lessons learned from investigations, hazard report analysis, and operational safety assessments.
Feedback to operational personnel, such as examples of procedural improvements as a result of
safety reports, is an essential feature of safety communications.
(ICAO Annex 6, 3.3.5; Appendix 7, 4.2)

4 nd
2 EDITION, OCTOBER 2009
 Introduction to SMS

1.6 DEFINITION OF CONCEPTS

As part of the SMS requirements, several concepts have been introduced (ICAO SMM 6.4.6):
Ê Level of safety: the degree of safety within a system expressed through safety indicators
Ê Safety indicators: the parameters that characterize and/or typify the level of safety of a
system
Ê Safety targets: the concrete objectives of the level of safety
Ê Acceptable Level of Safety (ALoS): the minimum degree of safety that must be assured by a
system in actual practice
Ê Safety indicator value: the quantification of a safety indicator
Ê Safety target value: the quantification of a safety target

1.7 ORGANIZATIONAL AND SAFETY CULTURES

ICAO (SMM 2.8.4) defines organizational culture as follows: Organizational culture differentiates
the characteristics and value systems of particular organizations (the behavior of members of one
company vs. that of another company, or government vs. private sector behavior). Organizations
provide a shell for national and professional cultures. For example, in an airline, pilots may come
from different professional backgrounds (military vs. civilian experience, light aircraft or commuter
operations vs. development within a large carrier). They may also come from different
organizational cultures due to corporate mergers or lay-offs.
The culture of an organization sets informal boundaries of behavior and provides a framework for
decision making, threat (hazard) identification, and willingness to take personal and
organizational risks.
A safety culture is generated within an organizational culture by an open and honest reporting
system where employees can feel free to report safety issues without the threat of punitive
measures being taken. An effective, proactive safety reporting culture has been achieved when
the majority of employee safety reports relate to identified or perceived threats, instead of errors
or incidents.
Safety culture is based on both the attitudes of the employees and the structural organization. It
includes the requirement to actively identify safety issues and to respond with appropriate action.
Safety culture goes beyond mechanical adherence to procedures. It requires that all duties that
can have an impact on operational safety be carried out correctly, with alertness, sound
judgment, and a proper sense of accountability throughout all levels of an organization. The
adoption and promotion of such a safety culture is the basic foundation of a successful SMS.
The term “just culture” is also commonly used when discussing safety culture. It encompasses
the notion that within an organization, honest human errors are accepted as part of human
nature. However, deliberate violations of rules and established procedures are not condemned
and should result in disciplinary action.
The promotion of the safety or just culture within airlines has been proven to be beneficial as it
has increased the flow of safety reports and enriched the safety data available. Within the
mindset of a just culture, errors are considered inevitable. They are dealt with fairly and result in
some real corrective action (aside from a reminder not to err again). This type of culture is
necessary for the organization to learn from errors, including the widest distribution of the lessons
learned throughout the airline to take remedial action where necessary, and to ensure that
processes and procedures are improved to prevent recurrence of the errors. Establishing a just
culture is clearly the responsibility of senior management who creates the work environment
throughout the organization (Just Culture—Balancing Safety and Accountability, Sidney Dekker,
2007).

nd
2 EDITION, OCTOBER 2009 5
 Introduction to Safety Management Systems (SMS)

6 nd
2 EDITION, OCTOBER 2009
2. SAFETY POLICY AND OBJECTIVES

2.1 MANAGEMENT COMMITMENT AND RESPONSIBILITY

The safety policy of an organization should define senior management’s fundamental approach
towards safety, to be adopted by employees and contractors. The policy should be based on a
clear and genuine board-level commitment, which clearly states that the management of aviation
safety is paramount. A commitment to compliance with aviation regulations and the adoption of
industry best practices should be included.
The safety policy should, as a minimum:
Ê Contain a senior management commitment to safety as a fundamental priority throughout the
organization, signed by the Accountable Executive
Ê Commit the organization to continuous improvement of its management system and safety
culture
Ê Contain a clear statement of the organization’s safety objectives and measures necessary to
conform to safety regulations
Ê Include imperatives for operational safety in the description of duties and responsibilities of
senior management
Ê Promote a just culture that includes non-punitive reporting procedures and encourages the
reporting of any inadvertent human error
Ê Enforce safety as a primary responsibility of all managers
Ê Include communications processes that permit a free flow of information throughout the
organization
Ê Identify clearly that the safety principles outlined in the SMS policy statement apply to
employees and contracted parties
Ê Cover procedures for reporting and coordinating events and activities performed by other
organizations that are subject to their own safety management systems, between the relevant
systems
Ê Include a requirement for continual senior management review and improvement

2.2 SAFETY ACCOUNTABILITIES

Successful handling of safety matters is a line management’s responsibility, requiring the active
participation of all levels of management and supervision. This should be reflected in the
structure of the company and in published safety accountabilities. While ultimate responsibility for
the SMS remains with the Accountable Executive at all times, responsibility for SMS
implementation may be delegated to other identified individuals within the organization. Top-level
accountabilities may not be delegated, but responsibilities should be cascaded throughout the
organization so that all aspects of aviation safety are covered. A company responsibility
structure could be similar to the diagram shown in Figure 1.

nd
2 EDITION, OCTOBER 2009 7
 Introduction to Safety Management Systems (SMS)

Figure 1 – Example of an organizational responsibility structure

The notion that ownership of the safety process was exclusive to the safety office has evolved in
the SMS environment to a concept of safety services. This reflects the idea that the safety
department’s purpose is to provide a service to the organization, i.e., the management of safety
is considered a core business process. Functionally, the safety department is a safety data
collection and analysis unit that uses a number of predictive, proactive, and reactive methods to
provide reliable information to the entire management team. However, the responsibility for
managing safety within each responsible division (Flight Operations, Engineering and
Maintenance, Ground Operations, etc) resides within that division.
The functional responsibilities of managers and employees at different levels in the organization
should be clearly defined, documented and communicated, with the aid of organizational
diagrams where appropriate. The individual and collective responsibilities affecting safety
performance should be stressed to all employees. Effective deputation of responsibilities should
be established for operationally critical areas of the operation to cover the absence, or change, of
principal office holders.

2.3 APPOINTMENT OF KEY SAFETY PERSONNEL

The Safety Manager, in most organizations, will be the person whom the Accountable Executive
has assigned the daily management of SMS functions and oversight of the safety department i.e.,
implementation of the SMS for the organization. The size of the staff will vary depending upon
the size of the airline. For example, in small organizations, the Safety Manager may be assigned
a number of different responsibilities to include flight safety, ground safety, quality, and perhaps
security. In contrast, larger organizations will have Directors leading specialized departments.
These Directors develop and manage processes to ensure neutral and unbiased support of
organizational managers—collection of data, identification of hazards, risk analysis, and
assessment of mitigation strategies in relation to agreed safety performance metrics of the
organization.
In large organizations, the Safety and Quality Managers will work together as a team to jointly
identify operational safety hazards, assess operational risks and ensure mitigation strategies are
appropriate for the identified hazard. They ensure compliance with State regulatory requirements

8 nd
2 EDITION, OCTOBER 2009
 Safety Policy and Objectives

and conformance with organizational processes and procedures. They identify opportunities for
continuous improvement.

2.3.1 Safety Review Board

The Safety Review Board (also referred to as management review) is a very high-level
committee, chaired by the Accountable Executive and composed of senior managers, including
line managers responsible for functional areas (ICAO SMM 8.6.7). It is a strategic body that
addresses high-level issues relating to policies, resource allocation and organizational
performance monitoring.
The Safety Review Board is a necessary element of a well-managed company, as well as a
powerful medium through which organizational control and continuous improvement can be
delivered. To be effective, a formal management review must take place on a regular basis, but
not less than once per year. Many organizations accomplish this on a quarterly basis, to coincide
with Board of Directors meetings.
Formally, there must be a process for retaining records that detail the activity such as meeting
schedules, agendas and minutes. Output of this activity should be recorded in comprehensive
minutes or in the form of a report and include action plans for changes to be implemented within
the organization.
An acceptable method to satisfy this requirement is a periodic formal meeting of senior corporate
executives. The meeting must have an agenda that includes an assessment that ensures all
elements of the management system are in place and functioning. The review must also include
an assessment of operational performance to ensure goals are being met in terms of operational
safety.
Senior management must ensure that deficiencies identified during the management review are
addressed through the implementation of organizational changes, which will improve the
performance of the system.
Input to the management review process should include, but not be limited to the following:
Ê Results of safety risk assessments
Ê Results of audits, inspections and investigations
Ê Safety performance results
Ê Operational feedback
Ê Changes in regulatory policy or civil aviation legislation
Ê Process performance and organizational conformity
Ê Status of corrective and preventative actions
Ê Follow-up actions from previous management reviews
Ê Feedback and recommendations for management system improvement
Ê Regulatory violations
Based on these inputs, the management review process will take decisions and actions related to
the following:
Ê Improving the effectiveness of processes throughout SMS
Ê Improving safety requirements and allocating needed resources
Safety assurance is accomplished through the use of a feedback loop, which monitors system
objectives and actual results in order to identify systemic changes required to eliminate any
discrepancies. A suggested system feedback loop is shown in Figure 2.

nd
2 EDITION, OCTOBER 2009 9
 Introduction to Safety Management Systems (SMS)

Figure 2 – SMS Continuous Feedback Loop

2.3.2 Safety Action Group

A Safety Action Group (also called Safety committee) should be formed to provide internal
reviews of SMS performance at an operational level. The Safety Committee should meet on a
quarterly basis to determine whether SMS objectives have been met in order to adequately
address safety concerns. Composition of the Safety Committee should include line managers as
well as representatives from each of the operational areas including, but not limited to: Flight
Operations; Engineering / Maintenance; In-flight Services; Ground Handling; and Cargo.
Depending on the type and size of the operation, the Safety Committee’s role should include the
following:
Ê Identification and mitigation of operational hazards
Ê Review of safety audit results and Corrective Action Plans
Ê Review of internal reporting systems
Ê Review of industry accident investigation reports
Ê Implementation of previous safety recommendations
Ê Risk assessment of new routes, equipment or procedures

2.4 COORDINATION OF EMERGENCY RESPONSE PLANNING

Since commercial airline transport operations are based almost entirely on public confidence, any
accident has a significant impact. A major accident resulting in a hull loss, human suffering and
loss of life will not only undermine public confidence in the industry as a whole, but particularly
the company involved. It is therefore essential for an operator to have an Emergency Response
Plan (ERP), also known as a Business Continuity Plan, as an integral part of its SMS. The widely
differing operating styles and corporate structures of different operators preclude presenting an
emergency management plan in detail. The principles, which follow, are therefore only an initial
guide to airlines.

10 nd
2 EDITION, OCTOBER 2009
 Safety Policy and Objectives

2.4.1 Airports
ICAO Annex 14 specifies the actions that must be undertaken by an aerodrome operator to deal
with an accident occurring on, or in the vicinity of, its airport. This plan, in addition to specifying
the aerodrome operator’s role, must also show the details of local authorities and organizations
that could assist in such an event. The aerodrome operator will generally establish an Emergency
Coordination Center (ECC) through which all post-accident activities are organized and
controlled.

2.4.2 Airlines
It is the airline’s responsibility to maintain familiarity with emergency plans at all airports into
which it operates. Senior representatives of the airline will be required to coordinate the airline’s
emergency response with the authorities at the accident location, and must therefore have a
readily available, tested, emergency response plan in place.
To fulfill its responsibilities, the airline must establish and equip:
Ê A Emergency Management Center (EMC) at its headquarters
Ê A Local Incident Control Center (LICC) at the accident location to coordinate activities with
company headquarters and the local authority EMC
Ê A mobile support and investigation team to assist local investigators and victim support
services

2.4.3 Activation of ERP

In the event of an accident/serious incident, Operations Control will probably receive the first
notification of the event, and will be the department to initiate the ERP, beginning with members
of the EMC. When the EMC assumes control of the event, it is essential for business continuity,
that Operations Control resumes control of continuing operations, leaving event control to the
EMC.
In the event of an accident/serious incident, the airline will basically have three areas of
response:
Ê Headquarters – activation of the company EMC
Ê Local – activation of the LICC at/near the event location
Ê Mobile – activation and dispatch of the Company Incident Support Team (go team)
The EMC must be maintained in a constant state of preparedness. It should also be borne in
mind that the EMC will require 24-hour manning for an unspecified period after an incident, and
the previously stated requirement for alternative members to be nominated fulfils a dual purpose.
All procedures, including local airport emergency plans at route stations, must be promulgated
through a dedicated Company Emergency Procedures manual that is distributed selectively
throughout the network. Individuals who have responsibilities following a major accident or
incident, or who are likely to become involved in the aftermath, are obliged to keep themselves
apprised of its contents and their role.
The airline ERP should include network-wide exercises at least annually. Furthermore, as
individuals and contact details change, communications and appointment lists should be updated
at frequent intervals.
The exact procedures to be adopted will depend on the size of the airline, its corporate structure,
route network, type of operation and the requirements of prevailing legislation not only in the
operator’s State, but also in the country in which an event occurs. It is prudent to ensure a

nd
2 EDITION, OCTOBER 2009 11
 Introduction to Safety Management Systems (SMS)

minimum of two, or preferably three, persons are identified for each nominated ERP position to
allow for absences.

2.5 SMS DOCUMENTATION

Although documentation techniques may vary between organizations; each feature of the SMS
must be documented and readily available to those managers and employees who need access
to the information. In smaller airlines, the Accountable Executive may prefer that the SMS
documentation be centralized in an SMS manual. Larger airlines will likely capture SMS
information, as appropriate, in corporate, division, and functional level manuals. This technique
ensures that SMS principles are cascaded throughout the organization and detailed SMS
information is readily available to line personnel.
An SMS manual should cover the following subjects:
Ê Scope of the SMS
Ê Safety policy and objectives
Ê Safety accountabilities
Ê Key safety personnel
Ê SMS documentation and procedures
Ê Coordination of emergency response planning
Ê Hazard identification and risk management schemes
Ê Safety assurance
Ê Safety performance monitoring and measurement
Ê Safety auditing
Ê Management of change
Ê Continuous improvement
Ê Safety promotion (training education and communication)
Ê Contracted services

12 nd
2 EDITION, OCTOBER 2009
3. SAFETY RISK MANAGEMENT

3.1 HAZARD IDENTIFICATION

A hazard is defined as a condition, object or activity with the potential of causing injuries to
personnel, damage to equipment or structures, loss of material, or reduction of ability to perform
a prescribed function (ICAO SMM 4.2.3).
Safety management begins through an organization’s ability to identify actual and potential
hazards. Hazard identification is the first step in a formal process of collecting, recording, acting
on, and generating feedback to all managers and employees in terms of safety risks (ICAO SMM
9.3). There are multiple sources of hazard identification. For example, front line employees are
a rich source of hazard identification since they must deal with system, procedural, and training
deficiencies to accomplish their daily tasks. Flight data analysis and on-site audits of activities
provide additional insight into the hazards that exist in any aviation-related activity. An airline’s
safety department should ensure that data collection activities are structured in a manner that
allows for the understanding of hazards that must be effectively managed to ensure safe
operations. A number of programs exist to gain detailed data on hazards. These include the
following:
Ê Employee safety reports (potentially including vendor reports when applicable)
• Ground handling reports
• Pilot, dispatch, and cabin crew reports
• Aircraft engineering and maintenance reports
Ê Accident and incident investigations
Ê Flight Data Analysis
Ê Process analysis
Ê Job Task Analysis (JTA)
Ê On-site safety audits
Ê Maintenance reliability and Continuous Analysis and Surveillance System (CASS) reports
Ê External sources (CAAs, investigative bodies, safety organizations, manufacturers, etc.)
Hazard identification methods can be classified under three wide categories of data sources:
reactive, proactive and predictive.
Ê Reactive data sources: Data emerges from processes that need to be triggered by a serious
event, which may often involve material damage and/or injuries. These processes are
activated once a system failure has occurred. Reactive data sources include accident or
incident investigations.
Ê Proactive data sources: Data is drawn from processes that are triggered by occurrences
that are less serious (minimal or no damaging consequences). These processes are based
on the notion that identifying safety risks within a system prior to any system failures, and
taken action, can minimize the negative outcomes. Data sources include safety audits,
mandatory or voluntary reporting systems, and safety surveys.
Ê Predictive data sources: Processes are in place to captured routine operational data, in real
time. The airline monitors its operation with these processes to discover potential safety
concerns. A Flight Data Analysis (FDA) program and Line Operations Safety Audit (LOSA)
observations are examples of proactive data sources.

nd
2 EDITION, OCTOBER 2009 13
 Introduction to Safety Management Systems (SMS)

There are three levels of hazard identification within most organizations:

Ê Organizational or corporate level: Data analysis is typically conducted by the management
team. Hazards to the organization may be identified by different departments as they review
employee reports, audit results, or flight data. The SMS will have processes in place to
assess and assign risk, develop corrective action plans, and to conduct follow-ups to ensure
sustainable mitigations.
Ê Functional level: Daily hazard identification is a fundamental responsibility of the line
manager supervising the work activity. The line manager is responsible to ensure that
operational procedures and activities are planned, trained, and executed in a manner to meet
operational goals. Ensuring both an efficient and safe operation is a management
responsibility, particularly at the level where the work is taking place.
Ê Individual level: Each employee is required to deal with a workplace that contains several
hazards. The Threat and Error Management (TEM) concept is effective in all workplaces to
identify the operational threats to safety and how to manage or mitigate them effectively. For
example, ramp personnel have to deal with the hazard such as hot and cold weather
extremes, windy conditions, fatigue, and pressures to complete the work quickly. Each
employee group must be trained to deal effectively with the potential hazards they are likely
to encounter in their “unique” workplace—the cabin, maintenance hangar, flight deck, or
ramp.
External sources of hazard identification include regional/international safety organizations,
internet industry news and incident reporting sources, regulatory advisory bulletins, directives,
and new regulations, aircraft and parts manufacturers, feedback from vendors, and industry
safety data sharing organizations. The ability to benchmark internal performance against
industry safety standards allows airlines to determine areas where their own operation could be
improved.

3.1.1 Occurrence Data Collection and Analysis

The collection and retention of data on its own serves no useful purpose. All data that is
collected must be used for review and analysis of the operation for the purpose of identifying
hazards, system weaknesses, process breakdowns, regulatory violations and other trends or
conditions that could potentially lead to a negative safety outcome. The data acquisition and
analysis process must include a method of risk analysis and prioritization to enable the
development and implementation of effective corrective action. This topic is further discussed in
section 3.2 of this document.
There are many methods of storing data, from the traditional paper files to highly sophisticated
electronic data storage systems. Airlines are strongly recommended to use an electronic system,
as this will facilitate analysis and reporting. Examples of electronic safety data systems available
for storage and analysis of crew reports are:
Ê Mercator Sentinel (formerly BASIS)
Ê AvSoft or AVSiS
Ê Aviation Events Reports Organizer (AERO)
Ê Superstructure Aviation Quality Database (AQD)
The use of sophisticated analytical tools and methods gives a safety department the ability to
analyze the data from their occurrence reporting system, and a means of understanding the
possible causes of hazards and monitor trends in safety data.
A typical airline safety data reporting system, such as those mentioned above, will have modules
for a broad spectrum of activities relevant to operational safety and accident prevention.

14 nd
2 EDITION, OCTOBER 2009
 Safety Risk Management

The first stage includes the gathering and entering of reports from personnel such as flight crew,
dispatchers, cabin crew, maintenance personnel and ground handling personnel into the
database. The database will have a system of keywords and descriptors that can be used to
classify the particular occurrence in a clear and logical manner. An important part of the
classification system is that personnel who are making the classifications must be trained to treat
all occurrences in the same manner. This will ensure a consistency within classification.
Investigation of occurrences must be carried out meticulously, using the applicable specialists
where necessary. The safety department must have the unimpeded authority to request
assistance in the investigation of these occurrences.
The database will contain internal tools to assist in the identification of trends. While an individual
occurrence may stand out, it is necessary to conduct regular analyses of the data to detect any
emerging trends, and take action at an early stage.
The database can also be used to produce follow-up information for the individuals who have
submitted the occurrences reports, and to disseminate the information widely throughout the
airline. An important function of the safety department is to acknowledge receipt of every incident
report directly to the person(s) submitting it, and to record when the occurrence file is closed.
The communication of safety issues and action taken, can take many forms. Newsletters, safety
magazines, journals, flyers and websites are some of the methods regularly used. A Confidential
Reporting System (CRS) is also a valuable tool to confidentially publish potential safety or
organizational issues that do not fit the normal safety reporting chain.
The final stage in the internal feedback loop is the management review, discussed in more detail
in section 4.4.1 of this document. It is an essential and regular review of hazards, risks and
remedial action, including their follow-up and effectiveness. If the corrective action taken is found
to have been ineffective, the safety issue needs to be studied in further detail.
Additional levels of occurrence data analysis include participation in industry or regional safety
data sharing events, safety committees, or data sharing programs. These programs often
provide an ability to benchmark internal performance against industry performance, or to perform
individualized queries against industry wide databases. Examples include:
Ê IATA Global Safety Information Centre (GSIC) and IATA Safety Trend Evaluation, Analysis
and Data Exchange System (STEADES)
Ê NASA Aviation Safety Reporting System (ASRS)
Ê FAA Aviation Safety Information Analysis System (ASIAS)

3.1.2 Accident and Incident Investigations

Accidents and incidents that occur in all areas of operations are reflective of a system failure at
some level in the organization. The purpose of a thorough investigation is to understand what
happened and how to prevent the event from reoccurring. Many airlines follow the same steps
and processes that have been proven so effective by State accident investigation organizations.
As a minimum, an effective accident/incident investigation program is managed at the corporate
level (by the safety department) and should contain the following essentials:
Ê Fact finding and data collection
• Employee interviews
• Flight data (digital flight data recorder or cockpit voice recorder)
• Failed hardware (aircraft parts, etc.)
• Document and procedural review
• Technical expert interviews (internal and external)

nd
2 EDITION, OCTOBER 2009 15
 Introduction to Safety Management Systems (SMS)

• Manufacturer participation
• Ground handling (ramp) video
Ê Data analysis
• Subject Matter Experts (SMEs) to evaluate the facts
• Consensus on the facts, sequence of events, and system deficiencies
Ê Conclusions
• Summary of factual information and analysis
Ê Recommendations
• Identify and assign specific corrective actions to prevent reoccurrence
Ê Senior Management Review
• Provide senior management with a thorough review of the facts and corrective action
plan
• Assign and track implementation of corrective actions through a tailored corrective action
record or request
• Conduct periodic follow-up assessments to ensure the effectiveness and sustainability of
the corrective actions

3.1.3 Flight Data Analysis

One of the most powerful tools to aid safety management is the use of aircraft digital flight data
for routine analysis of aircraft performance and operational parameters. This type of program is
also known as Flight Data Analysis (FDA), Flight Data Monitoring (FDM) or Flight Operations
Quality Assurance (FOQA).
FDA data often collects many times the number of parameters that are stored in a Digital Flight
Data Recorder (DFDR), which is best known as the crash recorder, or black box. The same data
can be stored on, and downloaded easily from, subsidiary recorders generically known as Quick
Access Recorders (QAR). They are generally more easily accessible than the DFDR and they
are not crash proof.
Operational flight data is routinely downloaded from the aircraft QAR by means of disk exchange,
direct download onto a transfer device, and more recently by automatic downloads via a wireless
network directly from the aircraft recorder. The data is then fed through analysis software to
check for abnormalities using parameters that have been agreed between the airline and
manufacturer. The reports from this program are produced automatically, including a negative
report if no exceedances are present on a particular flight.
A flight data analyst then analyzes the reports to determine whether there are any undesirable
trends emerging that require action (e.g., an increasing rate of unstable approaches at a
particular airport). Following the hazard analysis, there will usually be a review by a working
group, not less than monthly, that looks for both specific exceedances and emerging unsafe
trends.
The FDA can highlight deviations from Standards Operating Procedures (SOPs), which may be
indicative of inappropriate procedures or confirm the effectiveness of training methods. As in any
closed-loop process, follow-up monitoring is required to assess the effectiveness of any
corrective actions taken. For example, FDA might help answer the following questions:
Ê Are the desired results being achieved? Sufficiently? Soon enough?
Ê Have the problems really been corrected, or just relocated to another part of the system?
Ê Have new problems been introduced?

16 nd
2 EDITION, OCTOBER 2009
 Safety Risk Management

The collection, storage and analysis of FDA data require a dedicated department with a high
degree of specialization and logistical support. It must be recognized as an FDA program that is
founded on a bond of trust between the airline, its crews and the regulatory authority. Crew
cooperation is fundamental to its success, and the program must actively demonstrate a non-
punitive policy. The main object of an FDA program is to improve safety by identifying trends, not
individual acts.
Participation in regional or international FDA data sharing programs provides an ability to analyze
performance on a broader scale and to use these programs to resolve issues at a national or
regional level.

3.1.4 Auditing
Safety audits are used primarily as a means to verify the safety performance of the airline and to
validate the effectiveness of safety risk controls. On-site audit activities, conducted by an
independent entity, routinely identify a number of safety hazards, non-compliance with regulatory
requirements, non-adherence to established procedures, latent system deficiencies and
opportunities for improvement.
Many auditing departments have improved their auditing processes by expanding checklists to
include the identification of operational hazards and system analysis with a focus on identifying
opportunities for improvement. The identification of hazards in audit summaries must be shared
with the safety staff to ensure a holistic view of operational risks and included in the risk
management process. Alignment of this work is accomplished through the use of the same risk
matrix by both the Safety Risk Management and Quality Assurance, i.e., each audit finding and
observation is assigned a risk code with appropriate corrective action.

3.2 RISK ASSESSMENT AND MITIGATION

Safety Risk Management (SRM) is a generic term that encompasses the assessment and
mitigation of the safety risks of the consequences of hazards that threaten the capabilities of an
organization, to a level As Low As Reasonably Practicable (ALARP). The term ALARP reflects
the notion that any further risk reduction, as part of the SRM process, would be either
impracticable or outweighed by the costs involved in additional actions.
This SRM process provides a systematic examination of operational conditions or activities that
have been identified as potentially hazardous, followed by a structured assessment of the
associated risk, which is normally expressed in terms of severity and probability of occurrence.
Severity is determined by the worst credible potential outcome while less severe effects may be
considered analytically. Probability is determined by how often the resulting harm can be
expected to occur at the worst credible severity.
The objective of SRM is to quantify risks, determine the acceptability and develop appropriate
and effective measures where necessary to eliminate hazards or mitigate risks to an acceptable
level.

3.2.1 Risk Assessment

Risk assessment is an evaluation of the potential for injury, equipment damage, or loss due to a
hazard and the management of that probability. It is essential that everyone in the airline and
State regulatory authority has the same understanding of the terminology used for assigning
probability and severity. Figures 3 to 6 show the proposed ICAO 5X5 risk matrix.

nd
2 EDITION, OCTOBER 2009 17
 Introduction to Safety Management Systems (SMS)

Figure 3 – ICAO Safety Risk Probability Table

Figure 4 – ICAO Safety Risk Severity Table

18 nd
2 EDITION, OCTOBER 2009
 Safety Risk Management

Figure 5 – ICAO Risk Assessment Matrix

Figure 6 – ICAO Risk Tolerability Matrix

nd
2 EDITION, OCTOBER 2009 19
 Introduction to Safety Management Systems (SMS)

3.2.2 Risk Mitigation

Once a hazard has been identified, analyzed, and assessed using a risk matrix, development of
corrective or preventative action should be assigned to the appropriate functional director or
manager, such as flight operations or maintenance. An effective method to capture and record
these activities is through a Corrective Action Request (CAR) or record. The CAR is a useful tool
to record the Corrective Action Plan (CAP) submitted by the functional manager, outlining how
the organization proposes to correct the deficiencies documented in the CAR. Many
organizations identify both short and long-term corrective actions.
Short-term corrective action: This action corrects the issue specified in the audit finding or safety
report and is preliminary to the long-term (sustainable) action that prevents recurrence of the
problem. Should the issue be a regulatory violation, there must be immediate actions to prevent
continued violations of regulatory requirements. It must be recognized that these actions may
neither be efficient nor sustainable in the long-term.
Long-term corrective action: Long-term corrective action has two components. The first
component involves identifying the contributing factors of the problem from a system perspective
and indicating the measures the responsible manager must take to prevent a recurrence. The
second component is a timetable for implementation of the long-term corrective action. Some of
these actions may require periods of time before full implementation; for example, where major
equipment or software purchases are required.
An effective risk assessment process also identifies an acceptable level of risk, where no action
is required. Events that fall into this category are tracked and monitored and are identified in
green in the two examples on preceding pages.
Mitigations, controls, or corrective actions are rarely 100 percent effective. Once these corrective
actions are in place, there must be a recalculation of risks to evaluate and ensure the residual
risk is at an acceptable level or as low as reasonably practicable.
Overall, the SRM processes enable airline management to proactively identify existing and new
hazards introduced into operational systems and to develop countermeasures (mitigations) to
manage this risk. The SRM process ensures that:
Ê Safety-related changes to any process or procedure is documented appropriately
Ê Operational risk is proactively assessed and analyzed prior to implementation
Ê Unacceptable risk is mitigated and residual risk is captured, quantified, understood, and
accepted by the decision makers
Ê Hazards are identified, monitored, and tracked to resolution
Ê The effectiveness of the risk mitigation strategies is assessed
Ê The performance of a change is monitored throughout the change’s lifecycle

20 nd
2 EDITION, OCTOBER 2009
4. SAFETY ASSURANCE

In the framework of SMS, safety assurance and SRM are important components of the system.
SRM needs feedback on safety performance following the cycle known as PDAC (Plan, Do, Act,
Check) process including the development of countermeasures (safety risk controls). This
process will be discussed later in this section. Once this process is established, it needs to be
assured to be effective by continuous monitoring of outputs (safety performance) to ensure the
system performs as it was designed.
A SRM is partly based on quality principles. These principles are found throughout an effective
SMS and are effectively captured by the familiar International Standards Organization (ISO)
9001:2008 publication that highlights the importance of leadership, a systems approach to
management, people, process development, continuous improvement, data analysis, and
supplier oversight.

4.1 SAFETY RISK MANAGEMENT AND SAFETY ASSURANCE

The SRM function of an SMS provides for initial identification of hazards and assessment of
safety risks. Organizational safety risk controls are developed, and once they are determined to
be capable of bringing the safety risk to ALARP, they are employed in daily operations. The
safety assurance function takes over at this point to ensure that the safety risk controls are being
practiced as intended and that they continue to achieve their intended objectives. The safety
assurance function also provides for the identification of the need for new safety risk controls
because of changes in the operational environment (ICAO SMM 9.10.2).
In order to achieve the goals stated above, the safety assurance component will incorporate the
use of tools such as internal audits to ensure that policies, processes and procedures
consistently meet requirements necessary to achieve the highest possible level of safety.
As mentioned above, SMS requires feedback on safety performance to complete the safety
management cycle and to ensure that risk management cycle is maintained as intended.
Fundamentally, safety assurance is a monitoring and feedback system to provide confidence to
the entire management team to provide assurance as to the performance of operating systems
and processes using a number of assessment tools.

4.2 SAFETY PERFORMANCE MONITORING AND MEASUREMENT

System analysis is an important feature of safety assurance. In an SMS, the safety assurance
elements can be applied to gain an understanding of the human, organizational, technical and
environmental issues that can impact safety. Safety performance monitoring and measurement
may be accomplished by viewing organizational processes through each of the following
perspectives (ICAO SMM 9.6):
Ê Responsibility: Who is accountable for management of the operational activities (planning,
organizing, directing, controlling) and its ultimate accomplishment?
Ê Authority: Who can direct, control or change the procedures and who can make key
decisions on issues such as safety risk acceptance?
Ê Procedures: Specified ways to carry out operational activities that translates the “what”
(objectives) into “how” (practical activities)
Ê Controls: Elements of the system to include hardware, software, and procedures designed to
keep operational activities on track
Ê Interfaces: An examination of such items as lines of authority between departments, lines of
communications throughout the organization and consistency or alignment of procedures
between work and employee groups

nd
2 EDITION, OCTOBER 2009 21
 Introduction to Safety Management Systems (SMS)

Ê Process measures: Means of providing feedback to responsible managers to ensure that

process outputs and outcomes are being produced as expected
Different data sources such as ASRs, FDA data or confidential reporting systems can help the
airline monitor safety concerns. Different tools can be used to monitor safety performance, such
as:
Ê Hazard reporting, by line personnel such as pilots or cabin crew
Ê Safety studies to address areas of concern (e.g., unstable approaches)
Ê Safety reviews on particular issues
Ê Audits, such as the IATA Operational Safety Audit (IOSA) or the Line Operations Safety Audit
(LOSA)
Ê Safety surveys to obtain feedback from front line personnel
Ê Internal safety investigations, which do not need to limit themselves to mandatory occurrence
reports

4.3 MANAGEMENT OF CHANGE

Change can introduce new hazards to an operation, which must be identified if they are to be
systematically managed. They may only become apparent during a subsequent investigation of
an incident or accident. Change also affects the appropriateness or effectiveness of existing
business strategies within the company (e.g., procedures, training, documentation, etc).
Airlines should evaluate existing management processes to determine if changes are required.
These can include:
Ê Acquiring new equipment
Ê Introducing new operations, routes, procedures or training facilities
Ê Outsourcing functions
Ê Changing business partnerships
Ê Undergoing a merger, re-organization or fleet reduction
A change management process is a documented strategy to proactively identify and manage the
safety risks that can accompany significant change in an airline – whether operational, technical
or organizational.
Change management ensures the following:
Ê The hazards associated with the change will be systematically identified and managed
Ê The management of the change will be evaluated and monitored
Ê The information will be tracked
Should an airline initiate a new process, revise an operational procedure or equipment, the SRM
process will be used to identify potential hazards with the change, document the mitigation
strategy or controls to manage the associated risk, and gain appropriate management approval
of the residual risk. In this case, the safety assurance function takes over to ensure that the
safety risk controls are being practiced as intended and that they continue to achieve their
intended objectives. During the lifecycle of the change, safety assurance provides periodic
feedback to line managers as to the effectiveness of the controls and overall health of the
system.

22 nd
2 EDITION, OCTOBER 2009
 Safety Assurance

The change management plan should be developed as a part of the overall change management
process. The plan may contain the sections listed below.
Ê An introductory section that describes the goal of the plan – to reduce the safety-risks
associated with introducing, implementing and integrating the change initiative into the
company’s operation. An organization chart is often included, and the accountabilities and
responsibilities for safety management are clearly articulated.
Ê It is important to ensure that personnel from all departments affected are involved (flight crew,
maintenance personnel, ground handlers, vendors, etc.) in evaluating the change and
participating in the entire process. A means for all personnel to report back on any issues
identified as a result of the change and any new issues is essential.
Ê A section that describes the system. This section should include not just the change initiative
but also include the operational or organizational context in which the change is being
conducted. This is important because the system description must describe the current
operation and the anticipated effects of all changes.
Ê Hazard analyses should be conducted during all steps of the project. This is integrated
directly into the larger change management plan, so that safety considerations are integrated
into the entire plan.
Ê Any required changes that are identified during the change management process must be
integrated into existing documents and procedures.
Ê The rational behind changes to policies and procedures needs to be documented as well as
the safety risk assessments that supported these changes.
Ê Reporting of achievements and measures of safety performance.
A change management plan enables:
Ê Safeguards to be integrated into all changes undertaken by the airline, from company
acquisitions to new maintenance facilities, etc. This results in confidence from board
members and senior managers, regulatory bodies and insurance underwriters, and
importantly, from line managers and employees.
Ê The necessary resources (including the right people) to be anticipated and scheduled.
Ê The anticipation of new safety risks that might be introduced as part of the changes and the
assessment of these risks as part of the safety risk management process.
Ê The setting of specific safety indicators and information that will be the basis of monitoring
safety performance against which the airline will measure the success of the changes. These
new metrics can be the basis for evaluating the company’s on-going safety performance.
Ê The airline to achieve potential cost savings, by eliminating expenses associated with ill
planned changes, such as the acquisition of unsuitable equipment.

4.4 CONTINUOUS IMPROVEMENT OF THE SMS

Any commercial enterprise must embrace the concept of continuous improvement in order to
remain viable in today’s competitive world. SMS are never static and must not be considered
completed once the basic components and elements are in place. The system must continually
evolve based on lessons learned, remediation of hazards, and identification of opportunities for
improvement. Continuous improvement is a characteristic of a process and should be developed
as an organizational culture that enables proactive risk management through process
assessment and improvement (Transport Canada Advisory Circular 107-001, Guidance on SMS
Development, paragraph 3.8 – 3.14).

nd
2 EDITION, OCTOBER 2009 23
 Introduction to Safety Management Systems (SMS)

Continuous improvement may be achieved through application of tools as the well-known “Plan,
Do, Check, Act” (PDCA) pioneered by W. Edward Deming. A summary of the PDCA process is
captured in Figure 7 below.

Plan Ê Determine responsibility

Ê Determine requirements
Ê Assess current processes
Ê Gather baseline data
Ê Set goals and determine performance measures
Ê Formulate action plan
Ê Train
Do Ê Implement action plan
Ê Make adjustments as needed
Ê Gather and organize data
Ê Train
Check Ê Compare new data to baseline
Ê Compare actual performance to goals
Ê Make adjustments as needed
Ê If significant gap(s) remain, re-examine root causes, formulate revised
action plan and return to Do
Ê Train
Act Ê Standardize effective changes
Ê Use data and improved outcomes to promote changes
Ê Set up quality indicators and continue to measure periodically
Ê Look for other places in the organization that might profit by your
experience
Ê Publicize your success
Ê Be a Quality Advocate
Ê Celebrate
Ê Assess to identify other gaps
Figure 7– PDAC Process

24 nd
2 EDITION, OCTOBER 2009
5. SAFETY PROMOTION

An effective SMS requires the personal leadership and involvement of the Accountable
Executive. Safety promotion provides senior management and all employees with clear guidance
as to which role they must play within the SMS. The involvement of senior management towards
safety should be clearly visible to all employees and is fundamental to improve the safety culture,
to provide appropriate safety training across the organization, and to communicate safety
information that will promote adherence to standard procedures and consistent behaviors.

5.1 SAFETY TRAINING AND EDUCATION

Safety training must be tailored to each management level and employee group. In general,
safety training and education fall into the following general categories or activities (ICAO
SMM 9.11.4):
Ê Documented process to identify training requirements
Ê A validation process that measures the effectiveness of training
Ê Indoctrination training incorporating SMS, to include human factors
Ê Initial (general safety) job-specific training
Ê Recurrent safety training
IOSA and State regulatory standards typically require that safety information be included in both
employee initial and recurrent training. Raising employee awareness regarding hazards, recent
incidents and accidents, and the lessons learned from these occurrences, provides the
opportunity for the airline to manage risks through education and shared experiences. The
transparency of sharing de-identified safety reports builds a trust within the organization, thus
creating an atmosphere where employees are willing to submit safety reports without fear of
reprisal.
All employees will require some level of SMS training. The extent to which each employee group
is trained will depend on their function, role, or responsibility. Senior management should receive
general awareness training related to all facets of the SMS. Line employees will primarily need to
know how to identify and report hazards along with a general overview of SMS process.
Management personnel that assume a leadership, investigative, and change management role
will require further detailed information on these processes. Training may include the following
topics:
Ê Roles and responsibilities relative to SMS activities
Ê Event investigation and analysis techniques
Ê Hazard identification
Ê Audit principles
Ê Communication techniques
Ê Cultural characteristics (corporate, just, safety, etc.)
Ê Management system analysis and implementation
Ê Emergency response preparedness
Ê Human and organizational factors

nd
2 EDITION, OCTOBER 2009 25
 Introduction to Safety Management Systems (SMS)

5.2 SAFETY COMMUNICATION

Effective safety communication is modeled by the Accountable Executive during staff meetings
and cascaded throughout the organization. Tailored communications to each employee group
permits the safety department and line management to adapt safety communications to meet the
needs of each employee group. The safety department should manage safety communications
and work closely with line managers to ensure the materials address work place hazards, human
factors issues, lessons learned from investigations, and industry best practices. Roles and
responsibilities for safety communications must be clearly defined to avoid duplication of efforts
and conflicting information being delivered to line employees.
A number of communications options are available to the corporate staff and line management:
Ê Company website
Ê Email
Ê Safety magazines, newsletters, bulletins
Ê Safety discussions (round table, employee union)

26 nd
2 EDITION, OCTOBER 2009
6. INTEGRATING AIRLINE MANAGEMENT SYSTEMS

The ICAO Safety Management Manual (SMM) describes the existence of multiple systems in a
service provider. However, the guidance material does not provide instructions on how to
integrate these management systems. It is therefore up to organizational leadership teams to
assign specific SMS activities among work groups.
At one end of the spectrum, SMS, Quality Management Systems (QMS) and Security
Management Systems (SeMS) can be used to independently support senior management. In
contrast, another approach is to have the separate component systems merged into an
integrated Airline Management System (integrated-AMS), which incorporates the functions of the
safety, quality and security departments under the direct supervision of the Accountable
Executive. The terms Safety and Quality Management System (SQMS) as well as Integrated
Safety and Quality Management System (iSQMS) have been used to reflect this approach.
There are clear benefits to such integration (ICAO SMM 7.8) including the following:
Ê Reduction of duplication of effort (and therefore cost)
Ê Reduction of overall organizational risk because the integrated risk assessment takes a more
holistic view of the operational hazards
Ê Balance of potentially conflicting objectives
Ê Alignment of risk management and assurance processes across organizational boundaries
Ê Elimination of organizational barriers (silos) to teamwork, communication and community
Ê Diffusion of organizational power systems
A number of carriers have implemented a quarterly Risk Management Review that is jointly
presented by the Directors of safety, quality, security, and environment—focused on identifying
the most significant risks facing the airline from multiple perspectives. The value of this approach
is that the operational risk management process is holistic, i.e., the management team reviews all
of the operational risks that exist in the operation, prioritize these threats to the organization, and
allocate resources to mitigate those risks more effectively.
The IATA Integrated Airline Management Systems Guide for Air Transport Operators provides
detailed information on organizing these systems to meet an organization’s needs.

nd
2 EDITION, OCTOBER 2009 27
 Introduction to Safety Management Systems (SMS)

28 nd
2 EDITION, OCTOBER 2009
7. THE REGULATORY AUTHORITY’S ROLE IN SMS OVERSIGHT

As discussed in Section 1.4, the ICAO safety management Standards and Recommended
Practices (SARPs) are contained in Annexes 1; 6, Parts I and III; 8; 11; 13 and 14.
Safety management SARPs are aimed at two groups: State CAAs and service providers. ICAO
requires that the State establish a State Safety Program (SSP) in order to achieve an acceptable
level of safety in civil aviation. A SSP is a management system for management of safety by the
State. It includes a set of specific activities that must be performed by the State and follows the
same organizational format as an SMS implemented by a service provider, i.e., four components
and eleven elements.
Ê State safety policy and objectives
• State safety legislative framework
• State safety responsibilities and accountabilities
• Accident and incident investigation
• Enforcement police
Ê State safety risk management
• Safety requirements for the service provider’s SMS
• Agreement on the service provider’s safety performance
Ê State safety assurance
• Safety oversight
• Safety data collection, analysis, and exchange
• Safety data-driven targeting of oversight of areas of greater concern or need
Ê State safety promotion
• Internal training, communication and dissemination of safety information
• External training, communication and dissemination of safety information
There are several new concepts being introduced to CAAs that may require significant change in
philosophy, culture, and process among many regulatory agencies. The following identifies a
number of these shifts in regulatory oversight philosophy:
Ê Organizing State safety responsibilities and accountabilities in a principled and structured
manner
Ê Measuring the effectiveness with which safety responsibilities are discharged and safety
accountabilities are fulfilled by the State
Ê Transition from a predominantly prescriptive regulatory environment to an integrated
environment combining prescriptive and performance-based regulatory approaches
Ê The SSP considers regulations as safety risk controls and requires that the process of
rulemaking be done using principles of safety risk management
Ê Monitors the effectiveness and efficiency of regulations as safety risk controls through its
safety assurance component;
Ê Addition of a notion of Acceptable Level of Safety (ALoS) to be achieved by the SSP

nd
2 EDITION, OCTOBER 2009 29
 Introduction to Safety Management Systems (SMS)

The relationship between the SSP and SMS must be clearly understood by both the service
provider and the CAA. States are not expected to develop an SMS as the SSP fulfills an
equivalent role. The relationship between the State and service provider may be best understood
in terms of protection and production. This relationship is depicted in Figure 8 (ICAO SMM 6.8.1)

Figure 8 – SMS and SSP Relationship

In a performance-based safety environment, the approach is flexible and dynamic. Safety

regulations are used as safety risk controls, i.e., regulations are developed to respond to and
control safety risks. Oversight of compliance within the regulatory framework is supported by
data-based identification and prioritization of safety risks. There are two objectives: regulatory
compliance as a baseline and verification of effective safety performance. The SSP considers
safety risk management and safety assurance as the two core activities of regulatory authorities.
Transport Canada has extensive experience developing guidelines and standards for Canadian
operators. Their perspective may be illustrative of the regulator’s expectations of an operator’s
SMS (Transport Canada Advisory Circular 107-001, paragraph 3.3). Transport Canada has
identified the following five generic features that characterize an SMS:
Ê A comprehensive systematic approach to the management of aviation safety within an
organization, including the interfaces between the company and its suppliers, sub-contractors
and business partners
Ê A principal focus on the hazards of the business and their effects upon those activities critical
to flight safety
Ê The full integration of safety considerations into the business, via the application of
management controls to all aspects of the business processes critical to safety

30 nd
2 EDITION, OCTOBER 2009
 The Regulatory Authority’s Role in SMS Oversight

Ê The use of active monitoring and audit processes to validate that the necessary controls
identified through the hazard management process are in place and to ensure continuing
active commitment to safety
Ê The use of Quality Assurance principles, including improvement and feedback mechanisms
These features may evolve as ICAO and State standards mature. However, Transport Canada
has taken a common sense approach to SMS and recognized the need to integrate SMS into the
airline’s existing management system. Their experience reinforces the importance of continuous
improvement using the Plan, Do, Check and Act model supported by the organization’s
Accountable Executive.

nd
2 EDITION, OCTOBER 2009 31
 Introduction to Safety Management Systems (SMS)

32 nd
2 EDITION, OCTOBER 2009
8. SMS IMPLEMENTATION

The planning and implementation of a successful SMS takes time and effort. No one SMS is ideal
for all organizations. It is necessary to adapt the SMS depending on the size and complexity of
the organization in order to gain the greatest benefit.

8.1 GAP ANALYSIS

One of the first steps for an airline to take in order to implement an SMS is to asses which
structures are already in place versus the SMS requirements. This process is called a gap
analysis. ICAO has developed a generic SMS gap analysis checklist that will be of assistance in
making an initial assessment. This checklist can be found in Chapter 7 Appendix 2 of the ICAO
SMM. It is recommended that airlines conduct a gap analysis at the start of the SMS
implementation process as many of the elements required under SMS might already be in place.

8.2 SAFETY MANAGEMENT PLAN

The next step in the SMS implementation is to ensure that an airline has a safety management
plan. The principle elements of the safety management plan are (Transport Canada Advisory
Circular 107-001, paragraphs 4.0 – 4.18) the following:
Ê A definition of the fundamental approach a company will adopt for managing safety within the
organization. This includes a safety policy statement that clearly defines the company’s
philosophical approach to safety and the performance goals it has set.
Ê Clearly defined roles and responsibilities for all personnel involved in safety, including chains
of delegation to cover absences and changes of key personnel.
Ê A description of the SMS components (system assessment).

8.3 SAFETY POLICY

Following the system assessment, the airline needs to develop a safety policy, which is endorsed
by the highest level of management.
An operator’s safety policy should clearly state the company’s intentions, management principles
and aspirations for continuous improvement in the safety level of the company’s operations and
activities. The policy must be thoroughly documented, describing what organizational processes
and structures it will use to achieve the SMS.
The safety policy must include a description of each SMS element in a similar manner to the
descriptions of other systems in documents such as the company Operations Manual,
Maintenance Control Manual or Maintenance Policy Manual.

8.4 PROVISION OF RESOURCES

Once the planning and policy stages have been established, the provision of resources must be
considered to implement the policy and plan. The Accountable Executive must have the authority
and control to provide financial and human resources to ensure that the SMS is effective.
Part of the resource allocation includes an employee selection process to ensure that positions
within the organization are filled by personnel on the basis of appropriate knowledge, skills,
training and experience.
The airline has a duty to ensure that the responsibilities and activities assigned to specific
positions within the SMS are practical and can be reasonably accomplished, particularly for
positions that require multiple functional responsibilities or maintenance of a specific technical
proficiency.

nd
2 EDITION, OCTOBER 2009 33
 Introduction to Safety Management Systems (SMS)

Therefore, personnel who perform functions that impact operational safety are required to
maintain competence on the basis of continued education and training and, if applicable for a
particular position, to continue to satisfy specific regulatory requirements. In addition, the airline
must have a process for recording the satisfaction of training and qualification requirements for
personnel who perform functions affecting operational safety.

8.5 OUTSOURCING OF SERVICES

It is common practice for some operational functions to be outsourced to external contractors. It
remains the responsibility of the airline to ensure that the service is performed to the safety
standards that would pertain if they were performed in-house. These facts should be borne in
mind at the outset of any operational function. Purchasing policies must therefore include controls
to ensure the compliance with safety standards.
Contractor selection procedures need to include a review of the contractor’s safety management
arrangements as well as any previous safety records. The contractor must be made aware of the
airline’s SMS and their responsibilities relative to it. The airline, or its designated approved
representative, will need to carry out an audit of the services provided before commencement of
work, and throughout the contract, to ensure that safety standards are observed continually.

8.6 PHASED APPROACH TO SMS IMPLEMENTATION

In order to effectively manage the workload associated with the implementation of an SMS, it is
recommended that airlines adopt a phased approach. This phased approach breaks down the
SMS into manageable parts. During each of the phases, a certain number of elements are
implemented at the airline, thus allowing for a building-block approach. ICAO recommends a
four-phased approach to SMS implementation. Additional information on the phased approach to
SMS implementation can be found in the IATA SMS Implementation Guide and the ICAO Safety
Management Manual, second edition.

34 nd
2 EDITION, OCTOBER 2009
9. CONCLUSION

This guide has sought to provide an overview of the constituent parts of an SMS, and practical
advice, including possible methods of implementation in an organization. The document used a
compilation of guidance from other IATA publications, and publications by ICAO, the United
States, the United Kingdom, and Canada.
While aviation is already the safest form of travel, a successful SMS will help to make air
transportation even safer. This approach will utilize the assessment of potential risk
supplemented with operational knowledge and professional judgment to enhance aviation safety.
A genuine commitment to safety throughout the organization is essential for a successful SMS,
as is a non-punitive reporting culture to generate free flow of information regarding perceived
errors, hazards and their associated risks.
The structure of an SMS will continuously evolve and grow, assisted by a periodic review process
and the implementation of changes to eliminate or mitigate any risks that may have been
discovered.
Detailed guidance on best practices for planning, implementing and operating an SMS can be
found in the IATA SMS Best Practice Implementation Guide.

nd
2 EDITION, OCTOBER 2009 35
 Introduction to Safety Management Systems (SMS)

RESOURCES

IATA Operational Safety Audit (IOSA) – Standards Manual (ISM)

IATA Security Management Systems for Air Transport Operators
IATA Airport Handling Manual (AHM)
ICAO Doc. 9422 – Accident Prevention Manual
ICAO Doc 9859 – Safety Management Manual (SMM) Second Edition – 2009
Safety Management Systems in Aviation, 2008, Ashgate Publishing Company, Alan J. Stolzer, Carl D.
Halford, and John J. Goglia
European Strategic Safety Initiative, Safety Management System and Safety Culture Working Group:
Guidance on Hazard Identification, Safety Culture Framework for the ECAST SMS-WG, Guidance on
Organizational Structures, March 2009
Just Culture – Balancing Safety and Accountability, 2007, Ashgate Publish Company, Sidney Dekker
FAA Safety Management System Advisory Circular 120-92
Transport Canada Guidance on Safety Management System Development Advisory Circular 107-001
UK CAA Safety Management Systems – Guidance to Organizations
Australia CASA Safety Management Systems for Regular Public Transport Operations CAAP SMS-1(0)

nd
2 EDITION, OCTOBER 2009 36
 to order : International Air Transport Association
www.iataonline.com

custserv@iata.org

+1 800 71 66 32 60

+1 (514) 874 9659

Ref. No: 8402-01

Printed in Canada ISBN 978-92-9233-287-7