IOsA sms strategy I s s u e d A p r I l

Transcription

1 IOSA sms STRATEGY I s s u e d A p r i l

2

3 Safety & security don t just happen, they are the result of collective consensus and public investment. We owe our children, the most vulnerable citizens in our society, a life free of violence and fear. Nelson Mandela Former President of South Africa

4 Table of Contents Message from Senior Vice President 7 Lexicon 8 ICAO Safety Management Panel 9 Role of IATA 10 Origins of the IOSA SMS Provisions 11 IOSA Provision Audit Results 12 Timeline 13 Actions for ORG ORG ORG ORG ORG

5 Actions for ORG ORG ORG ORG Actions for ORG ORG ORG ORG Actions for ORG ORG ORG

6

7 Message from Senior Vice President Deal Colleagues, I am very pleased to note that for the third consecutive year our Industry has improved its safety performance. I am equally pleased to note that IATA Operational Safety Audit (IOSA) operators had a safety performance rate in 2012 that was 4.3 times better than those not on the IOSA Registry. IOSA is clearly a global standard that continues to improve safety. Safety Management Systems (SMS) is an integral part of IOSA. SMS is no longer a new concept but the shift to performance based management and oversight is one that takes a great deal of time and knowledge. As a result, varying degrees of understanding and subsequently implementation have been observed. Since introducing SMS designated provisions in 2010, over 330 audits have been completed, and the results are encouraging. There has been good progress in implementation but the work is not complete. As the benchmark for global safety management in airlines, IOSA is the ideal mechanism to drive the advancement of SMS implementation. This document will provide the guidance required for Operators to demonstrate conformity with all elements of the ICAO SMS Framework by September I wish to thank the IATA Operations Committee (OPC), the IOSA Oversight Committee (IOC), the IATA Safety Group, and all IATA staff involved for their collaboration and expertise in the creation of this strategy document that will facilitate safety performance improvements for years to come. We must continue to drive the progress of SMS implementation so we can continue to improve our safety performance towards zero accidents, zero fatalities, zero injuries. Günther Matschnigg Senior Vice President Safety, Operations & Infrastructure 7

8 Lexicon ANC AOC CAA CAB CGO DSP ERP FLT GM GRH IATA ICAO IOSA IRM ICAO Air Navigation Commission Air Operators Certificate Civil Aviation Authority Cabin Operations Cargo Operations Operational Control and Flight Dispatch Emergency Response Plan Flight Operations Guidance Material Ground Handling Operations International Air Transport Association International Civil Aviation Organization IATA Operational Safety Audit IATA Reference Manual for Audit Programs ISARPs IOSA Standards and Recommended Practices ISM MNT ORG SAG SMM SMP SMS SRB SSP IOSA Standards Manual Aircraft Engineering and Maintenance Organization and Management System Safety Action Group ICAO Safety Management Manual ICAO Safety Management Panel Safety Management System Safety Review Board State Safety Program 8

9 ICAO Safety Management Panel ICAO created a Safety Management Panel (SMP) responsible for drafting a new Annex for SMS ~ Annex 19. The Phase I mandate of the panel was to integrate all existing SMS provisions, appendices and attachments from the various Annexes into one. This was completed and presented to the Air Navigation Commission (ANC). A State Letter was issued on June 29, 2012 requesting comments by September 28, All comments were reviewed by the ANC and in November 2012 a formal recommendation was made to the ICAO Council. The Council adopted the Annex unanimously on February 25, 2013 with November 2013 applicability. The ANC also approved the future work of the SMP. At a high level, this work entails: 1. Developing amendments to State Safety Program (SSP) provisions; 2. Developing amendments to SMS provisions; 3. Developing Emergency Response Plan (ERP) provisions; and 4. Enhancing provisions for the collection, analysis and protection of safety data and information. The target timeline for applicability of these proposed amendments and their respective guidance material is November

10 Role of IATA As IATA has a representative on the SMP, any changes (including associated timelines) will be added to this strategy ensuring continued alignment with the IOSA SMS SARPs and guidance material. IATA must, through the IOSA program, remain aligned with ICAO SMS activities and lead the implementation effort of the IOSA registered airlines. Work from the SMP must influence the development of the IOSA provisions in a way that ensures IATA stays current and reflects industry reality. 10

11 Origins of the IOSA SMS Provisions In 2010, ICAO published a new Appendix to Annex 6, which contained the Framework for Safety Management Systems, (ICAO SMS Framework). This Framework specifies the four components and various elements that comprise an SMS. When the ICAO SMS Framework was published, approximately half of the SMS elements were already addressed in the IOSA Standards and Recommended Practices (ISARPs). In integrating the ICAO SMS Framework elements into the ISARPs, the IOSA task force decided the following: 1. Elements that were not already included in the ISARPs would be incorporated as new recommended practices (i.e. should provisions); and 2. Elements that were already addressed in the ISARPs would remain in their current state as either a standard (i.e. shall provision) or a recommended practice. As a result, the current IOSA SMS provisions are approximately evenly split between standards and recommended practices. Safety Policy and Objectives ICAO Framework SMS Safety Risk Management Safety Assurance Safety Promotion The IOSA SMS provisions are contained in the IOSA Standards Manual (ISM) in Section 1, entitled Organization and Management System (ORG). Some, but not all, of the ORG SMS provisions are repeated in other sections of the ISM. Those ORG SMS provisions that are repeated in the other sections are identified with an * symbol. For the purpose of this document, only the ORG provisions are referenced. 11

12 IOSA Provision Audit Results The following statistics are based on 334 reports from ISM Editions 3 6 inclusive, date range Q4 2010* to Q Standards Recommended Practices ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG ORG % Non-Conformance ORG ORG ORG ORG ORG IOSA Provision Supporting Documentation ICAO Safety Management Manual (SMM) ~ Doc. 9859, 3rd Ed., 2013 IOSA Standards Manual (ISM) ~ Ed. 6, effective September 2012 IOSA Standards Manual (ISM) ~ Ed. 7, effective September * Note: SMS designated SARPs were first introduced in ISM Ed 3 which became effective October 2010

13 Timeline Mirroring the ICAO recommendation of a five (5) year SMS implementation plan, and recognizing IOSA members successful implementation of current SMS standards, the following timetable has been established for elevating all SMS provisions to standards Introduce Effective Introduce Effective Introduce Effective Introduce Effective ORG ORG ORG 1.6.5* ORG ORG ORG ORG 3.1.1* ORG 3.2.1* ORG ORG ORG 3.1.2* ORG ORG 1.6.5* ORG ORG ORG 3.1.1* Provisions in white are Standard (Mandatory) Provisions: Shall Provisions in blue are Recommended Practice Provisions: Should * ORG SMS provisions that are repeated in operational sections of the ISM Operational Sections of the ISM include: Flight Operations (FTL) Operational Control and Flight Dispatch (DSP) Aircraft Engineering and Maintenance (MNT) Cabin Operations (CAB) Ground Handling Operations (GRH) Cargo Operations (CGO) New or revised provisions are introduced in April and effective in September. 13

14

15 Actions for 2013 ISM Edition 7, effective September

16 A c t i o n s f o r ORG The Operator shall identify one senior management official as the Accountable Executive who is accountable for performance of the management system as specified in ORG An Accountable Executive who: [SMS] 1. Irrespective of other functions, has ultimate responsibility and accountability on behalf of the Operator for the implementation and maintenance of the SMS throughout the organization; 2. Has the authority to ensure the allocation of resources necessary to manage risks to the safety and security of aircraft operations; and 3. Has overall responsibility and is accountable for ensuring operations are conducted in accordance with the conditions and restrictions of the Air Operator Certificate (AOC) and in compliance with applicable regulations and standards of the Operator. (GM) Change With the release of ISM Edition 7, ORG 1.1.2, and will be consolidated as follows: 1. ORG is eliminated because its specifications are incorporated into ORG 1.1.3; 2. ORG is eliminated because designation of an Accountable Executive will be required for all IOSA operators; and 3. ORG and Guidance are revised to eliminate the conditional phrase and include the specifications from ORG Rationale In order to implement an effective SMS program, senior management must be committed to doing so. An Accountable Executive must be identified to ensure that the allocated resources (human and financial) and operational decisions are aligned with the safety strategy of the organization. An SMS requires an organization to identify, mitigate and manage risks related to the safe operation of an aircraft. The scope of the program is quite large as it includes any stakeholders (internal and external) that have a potential impact on the safety performance of the organization. As such, the single Accountable Executive responsible for the SMS program must have the proper authority to establish resources (human and financial), make operational decisions and set the risk threshold of the organization to assure the effective management of their safety risk. 16 Note: This IOSA provision consolidates three previous provisions (ORG 1.1.2, ORG 1.1.3, ORG ) referencing Accountable Executive functions, including the responsibility for SMS, into one provision.

17 Guidance Refer to the IRM for the definitions of Accountability, Accountable Executive, Authority, Aircraft Operations, Responsibility, Safety Risk Management and Senior Management. The requirement for an Accountable Executive is an element of the Safety Policy and Objectives component of the SMS Framework. The designation of an Accountable Executive means the accountability for safety and security performance is placed at a level in the organization having the authority to take action to ensure the SMS is effective. Therefore, the Accountable Executive is typically the chief executive officer (CEO), although, depending on the type and structure of the organization, it could be a different senior official (e.g. chairperson of the board of directors, company owner). The Accountable Executive has the authority, which includes financial control, to make policy decisions, provide adequate resources, resolve operational quality, safety and security issues and, in general, ensure necessary system components are in place and functioning properly. In an SMS, the Accountable Executive typically has: 1. Ultimate responsibility and accountability for the safety of the entire operation together with the implementation and maintenance of the SMS; and 2. Responsibility for ensuring the SMS is properly implemented in all areas of the organization and performing in accordance with specified requirements. The Accountable Executive is also responsible for ensuring the organization is in compliance with requirements of applicable authorities (i.e. regulations) as well as its own policies and procedures which may exceed existing regulations or address areas that are not regulated (e.g. ground handling operations). An operator s policies and procedures are typically published in its Operations Manual. To ensure that the operator continues to meet applicable requirements, the Accountable Executive might designate a manager with the responsibility for monitoring compliance. The role of this manager would be to ensure that the activities of the operator are monitored for compliance with the applicable regulatory requirements, as well as any additional requirements as established by the operator, and that these activities are being carried out properly under the supervision of the relevant head of functional area. Expanded guidance may be found in the ICAO SMM, Document

18 A c t i o n s f o r ORG The Operator should have a corporate safety reporting policy that encourages personnel to report hazards to aircraft operations and, in addition, defines the Operator s policy regarding disciplinary action. Operator s policy regarding disciplinary action. This policy should include: 1. Types of operational behaviors that are unacceptable; and 2. Conditions under which disciplinary action would not apply. [sms] (GM) Change Introduce this provision as a recommended practice under SMS. Rationale It is important for an operator to have a mechanism whereby personnel may report safety hazards and that unsafe behaviors and their consequences are identified. 18

19 Guidance The requirement for an operator to have a safety reporting policy is an element of the Safety Policy and Objectives component of the SMS Framework. Safety reporting is a key aspect of SMS hazard identification and risk management. Such a policy is typically documented in operations manuals or other controlled documents. Consistent with the structure and complexity of the operator s organization, the safety reporting policy may be issued as a stand-alone policy or combined with the safety policy specified in ORG A safety reporting policy encourages and perhaps even provides an incentive for individuals to report hazards and operational deficiencies to management. It also assures personnel that their candid input is highly desired and vital to safe and secure operations. The safety reporting policy is typically reviewed periodically to ensure continuing relevance to the organization. Refer to ORG 3.1.3, and 3.1.5, each of which specifies types of safety reporting. 19

20 A c t i o n s f o r ORG The Operator shall have processes for the communication of safety information throughout the organization to ensure personnel maintain an awareness of the SMS and current operational safety issues. [SMS] (GM) Change Provision upgraded to a standard. Rationale As SMS is a performance-based program, driven by information, communication is a foundational element that must be imbedded in all aspects of the program. For other elements of an SMS to be implemented in an effective manner, proper communication channels must be established. Guidance Safety communication is an element of the Safety Promotion component of the SMS Framework. The general intent of safety communication is to foster a positive safety culture in which all employees receive ongoing information on safety issues, safety metrics, specific hazards existing in the workplace and initiatives to address known safety issues. Such communication typically conveys safety-critical information and explains why particular safety actions are taken and why safety procedures are introduced or changed. Expanded guidance may be found in the ICAO SMM, Document

21 A c t i o n s f o r ORG The Operator should have a program that ensures personnel throughout the organization are trained and competent to perform SMS duties. The scope of such training should be appropriate to each individual s involvement in the SMS. [sms] (GM)* Change Repeat ORG as a recommended practice in the FLT, DSP, MNT, CAB, GRH and CGO sections, with the intent to elevate to a standard in Rationale This recommended practice has the second-highest non-conformity rate of all IOSA SMS provisions. As this is a foundational element of SMS that must be imbedded in all aspects of the program, we must find ways to assist with effective implementation. By introducing the provision into the individual sections prior to elevating it to a standard, we will allow an operator to roll out implementation to specific job functions in accordance to its needs. Guidance SMS training is an element of the Safety Promotion component of the SMS Framework. Within an SMS, all management personnel, including the Accountable Executive and non-management personnel are expected to complete SMS training. The content of this training should be appropriate to the individual s responsibilities and involvement in the SMS A training curriculum typically includes modules that provide an overview of the elements of SMS, such as: 1 Event investigation and analysis techniques; 2 Hazard identification; 3 Risk assessment and mitigation; 4 Audit principles and methodology; 5 Communication techniques; 6 Safety reporting; 7 SMS implementation, analysis and continual improvement; and 8 Emergency response preparedness. Expanded guidance may be found in the ICAO SMM, Document

22 A c t i o n s f o r ORG The Operator should have a hazard identification program that is implemented and integrated throughout the organization. This program should include: 1. A combination of reactive and proactive methods for safety data collection; and 2. Processes for safety data analysis that identify existing hazards and predict future hazards to aircraft operations. [sms] (GM)* Change Simplify the language of this recommended practice as noted above, separating the hazard identification into two parts: data collection and data analysis; and introduce the concept of predictive hazard identification. Rationale Having the ability to predict unknown hazards is a core purpose of SMS and is therefore part of the ICAO requirements. However, demonstrating this capability is the mark of a mature SMS program, as its efficacy is dependent on having the system working as a whole. Since the principle of predictive is not yet incorporated. into IOSA, the introduction of this concept is through guidance material with the intent to elevate to a standard in 2015, when all of the other functional elements are required to be in place. 22

23 Guidance Refer to the IRM for the definitions of Hazard (Aircraft Operations) and Safety Risk. Hazard identification is an element of the Safety Risk Management component of the SMS Framework. The methods used to identify hazards will typically depend on the resources and constraints of each particular organization. Some organizations might deploy comprehensive, technology-intensive hazard identification processes, while organizations with smaller, less complex operations might implement more modest hazard identification processes. Regardless of organizational size or complexity, to ensure all hazards are identified to the extent possible, hazard identification processes are necessarily formalized, coordinated and consistently applied on an on-going basis in all areas of the organization where there is a potential for hazards that could affect aircraft operations. To be effective, reactive and proactive processes are used to acquire information and data, which are then analyzed to identify existing or predict future (i.e. potential) hazards to aircraft operations. Examples of processes that typically yield information or data for hazard identification include: 1. Confidential or other reporting by personnel; 2. Investigation of accidents, incidents, irregularities and other non-normal events; 3. Flight data analysis; 4. Observation of flight crew performance in line operations and training; 5. Quality assurance and/or safety auditing; and 6. Safety information gathering or exchange (external sources). Processes would be designed to identify hazards that might be associated with organizational business changes (e.g. addition of new routes or destinations, acquisition of new aircraft type(s), introduction of significant outsourcing of operational functions). Typically hazards are assigned a tracking number and recorded in a log or database. Each log or database entry would normally include a description of the hazard as well as other information necessary to track associated risk assessment and mitigation activities. Expanded guidance may be found in the ICAO SMM, Document

24

25 Actions for 2014 ISM Edition 8, effective September

26 A c t i o n s f o r ORG The Operator shall designate a manager who is responsible for the implementation, maintenance and day-to-day administration of the SMS throughout the organization on behalf of the Accountable Executive and senior management. [sms] (GM) Change Provision upgraded to a standard. Rationale This provision is required to clearly identify the responsibility for the organization s SMS program as a whole. Ideally, this designated manager is in place right from the beginning, when defining and implementing an SMS. Guidance The requirement for a manager who focuses on the administration and oversight of the SMS on behalf of the Accountable Executive is an element of the Safety Policy and Objectives component of the SMS Framework. The individual assigned responsibility for organizational implementation of an SMS is ideally a management official who reports to the Accountable Executive. Also, depending on the size, structure and scope of an operator s organization, this individual may be assigned functions in addition to those associated with the SMS manager position. The title assigned to the designated manager will vary for each organization. Regardless of title, the manager is the designated organizational focal point for the day-to-day development, administration and maintenance of the SMS (i.e. functions as the SMS champion). It is important that this manager have the necessary degree of authority when coordinating and addressing safety matters throughout the organization. Whereas the designated manager has responsibility for day-to-day oversight of the SMS, overall accountability for organizational safety rests with the Accountable Executive. Likewise, nominated officials (refer to ORG 1.1.4) or operational managers always retain the responsibility (and thus are accountable) for ensuring safety in their respective areas of operations. Expanded guidance may be found in the ICAO SMM, Document Note: This IOSA provision was not in existence before the ICAO SMS Framework was published in Annex 6. Therefore, it was incorporated into the ISARPs as a new recommended practice.

27 A c t i o n s f o r ORG The Operator shall have a corporate safety reporting policy that encourages personnel to report hazards to aircraft operations and, in addition, defines the Operator s policy regarding disciplinary action. Operator s policy regarding disciplinary action. This policy shall include: 1. Types of operational behaviors that are unacceptable; 2. Conditions under which disciplinary action would not apply. [sms] (GM) Change Provision upgraded to a standard. Rationale Following standard IOSA protocol, this standard to be elevated in 2014 after being introduced in Guidance The requirement for an operator to have a safety reporting policy is an element of the Safety Policy and Objectives component of the SMS framework. Safety reporting is a key aspect of SMS hazard identification and risk management. Such a policy, is typically documented in operations manuals or other controlled documents. Consistent with the structure and complexity of the operator s organization, the safety reporting policy may be issued as a stand-alone policy, or combined with the safety policy specified in ORG A safety reporting policy encourages and perhaps even provides incentive for individuals to report hazards and operational deficiencies to management. It also assures personnel that their candid input is highly desired and vital to safe and secure operations. The safety reporting policy is typically reviewed periodically to ensure continuing relevance to the organization. Refer to ORG 3.1.3, and 3.1.5, each of which specifies types of safety reporting. 27

28 A c t i o n s f o r ORG The Operator shall have processes to review and ensure continual improvement of the SMS throughout the organization. These processes shall include: 1. Identification of the cause(s) of substandard performance of the SMS; 2. Determination of the implications of substandard performance of the SMS to operations; and 3. Elimination or mitigation of such cause(s) of substandard performance. [sms] (GM) Change Provision upgraded to a standard. Rationale The necessity for operators to objectively self-assess their SMS program will force them to look at the required elements in a systemic way. Mapping the interdependencies and taking the time to understand how they effectively interact will enhance the organizations knowledge and understanding of their SMS program. This will serve them well with the implementation of more advanced elements. 28

29 Guidance Refer to the IRM for the definitions of Safety Assurance, Safety Action Group (SAG), Safety Review Board (SRB) and Substandard Performance. Continual improvement of the SMS is an element of the Safety Assurance component of the SMS Framework. Continual improvement would normally be overseen by a strategic committee of senior management officials that are familiar with the workings and objectives of the SMS. This committee is typically referred to as a Safety Review Board (SRB), which is a very high level, strategic committee chaired by the Accountable Executive and composed of senior managers, including senior line managers responsible for functional areas in operations (e.g. flight operations, engineering and maintenance, cabin operations). To ensure front line input as part of the SMS review process, an operator would form multiple units of specially selected operational personnel (e.g. managers, supervisors, front line personnel) that function to oversee safety in areas where operations are conducted. Such units are typically referred to as Safety Action Groups (SAGs), which are tactical committees that function to address implementation issues in front line operations to satisfy the strategic directives of the SRB. Expanded guidance may be found in the ICAO SMM, Document

30 A c t i o n s f o r ORG The Operator shall have SMS documentation that includes a description. A description of: 1. The safety policy and objectives, SMS requirements, SMS processes and procedures, the accountabilities, authorities and responsibilities for precesses and procedures, and the SMS outputs; and 2. Its approach to the management of safety, which is contained in a manual as a means of communication throughout the organization. [sms] (GM) Change Provision upgraded to a standard. Rationale Documentation is a foundational element of an SMS that needs to be imbedded in all aspects of the program. This documentation not only facilitates the organization s management of the program (including communication and administration), but also serves a vital role in structuring the oversight process. 30

31 Guidance SMS documentation is an element of the Safety Policy and Objectives component of the SMS Framework. SMS documentation is typically scaled to the size and complexity of the organization. It describes both the corporate and operational areas of safety management to show continuity of the SMS throughout the organization. Typical documentation would include a description of management positions and associated accountabilities, authorities and responsibilities within the SMS. Requirements for SMS documentation will vary according to the individual state safety program (SSP). SMS documentation typically addresses: 1 Scope of the SMS; 2 Safety policy and objectives; 3 Safety accountabilities; 4 Key safety personnel; 5 Documentation control procedures; 6 Coordination of emergency response planning; 7 Hazard identification and risk management schemes; 8 Safety assurance; 9 Safety performance monitoring; To ensure personnel throughout the organization are informed, SMS documentation includes a description of the operator s approach to safety management. Such descriptive information would be contained in a manual and presented in a manner that ensures the SMS information is clearly identifiable. The exact title and structure of such manual will vary with each operator. SMS documentation supports the management of operations and would be subject to management and control as specified in ORG For an operator that is in the process of working toward full SMS implementation, documentation would typically include an SMS implementation plan that details the way the operator will structure its organization, resources and processes to effectively manage safety in operations. The SMS implementation plan is a realistic strategy for implementation of SMS with a realistic timeline of activities. The SMS implementation plan may be a stand-alone document or it can be a distinct SMS section or chapter within an existing organizational document that is approved by the Authority. Where details of the organization s SMS processes are already addressed in existing documents, appropriate cross-referencing to such documents is sufficient. The SMS implementation plan is kept up-to-date by the operator. When significant amendments are made, CAA acceptance might be required. Expanded guidance may be found in the ICAO SMM, Document Safety auditing (safety and quality auditing may be combined); 11 Management of change; 12 Safety promotion; and 13 Outsourced services. 31

32

33 Actions for 2015 ISM Edition 9, effective September

34 A c t i o n s f o r ORG The Operator shall have a program that ensures personnel throughout the organization are trained and competent to perform SMS duties. The scope of such training shall be appropriate to each individual s involvement in the SMS. [sms] (GM)* Change Provision upgraded to a standard. Rationale As noted in the associated 2013 action, this is a foundational element of SMS that must be imbedded in all aspects of the program. By upgrading this provision to a standard, focus will be maintained on this critical element. Guidance SMS training is an element of the Safety Promotion component of the SMS Framework. Within an SMS, all management personnel, including the Accountable Executive, and non-management personnel are expected to complete SMS training. The content of this training should be appropriate to the individual s responsibilities and involvement in the SMS A training curriculum typically includes modules that provide an overview of the elements of SMS, such as: 1 Event investigation and analysis techniques; 2 Hazard identification; 3 Risk assessment and mitigation; 4 Audit principles and methodology; 5 Communication techniques; 6 Safety reporting; 7 SMS implementation, analysis and continual improvement; and 8 Emergency response preparedness. Expanded guidance may be found in the ICAO SMM, Document

35 A c t i o n s f o r ORG The Operator shall have a hazard identification program that is implemented and integrated throughout the organization. This program shall include: 1. A combination of reactive and proactive methods for safety data collection; and 2. Processes for safety data analysis that identify existing hazards and predict future hazards to aircraft operations. [sms] (GM)* Change Provision upgraded to a standard. Rationale Following the rationale as outlined in the associated 2013 action, this provision must be in place for a fully functioning SMS. Guidance Refer to the IRM for the definitions of Hazard (Aircraft Operations) and Safety Risk. Hazard identification is an element of the Safety Risk Management component of the SMS Framework. The methods used to identify hazards will typically depend on the resources and constraints of each particular organization. Some organizations might deploy comprehensive, technology-intensive hazard identification processes, while organizations with smaller, less complex operations might implement more modest hazard identification processes. Regardless of organizational size or complexity, to ensure all hazards are identified to the extent possible, hazard identification processes are necessarily formalized, coordinated and consistently applied on an on-going basis in all areas of the organization where there is a potential for hazards that could affect aircraft operations. To be effective, reactive and proactive processes are used to acquire information and data, which are then analyzed to identify existing or predict future (i.e. potential) hazards to aircraft operations. Examples of processes that typically yield information or data for hazard identification include: 1 Confidential or other reporting by personnel; 2 Investigation of accidents, incidents, irregularities and other non-normal events; 3 Flight data analysis; 4 Observation of flight crew performance in line operations and training; 5 Quality assurance and/or safety auditing; and 6 Safety information gathering or exchange (external sources). Processes would be designed to identify hazards that might be associated with organizational business changes (e.g. addition of new routes or destinations, acquisition of new aircraft type(s), introduction of significant outsourcing of operational functions). Typically hazards are assigned a tracking number and recorded in a log or database. Each log or database entry would normally include a description of the hazard, as well as other information necessary to track associated risk assessment and mitigation activities. Expanded guidance may be found in the ICAO SMM, Document

36 A c t i o n s f o r ORG The Operator shall have a safety risk assessment and mitigation program that includes processes implemented and integrated throughout the organization. This program shall ensure: 1. Hazards are analyzed to determine corresponding safety risks to aircraft operations; 2. Safety risks are assessed to determine the requirement for risk mitigation action(s); and 3. When required, risk mitigation actions are developed and implemented in operations. [sms] (GM)* Change Provision upgraded to a standard. Rationale This provision speaks to the core purpose of implementing an SMS and should be put into effect once relevant information becomes available. However, in prioritizing the elevation of provisions, this is deferred to Guidance Risk assessment and mitigation is an element of the Safety Risk Management component of the SMS Framework. To be completely effective, a risk assessment and mitigation program would typically be implemented in a manner that: 1 Is active in all areas of the organization where there is a potential for hazards that could affect aircraft operations; and 2 Has some form of central coordination to ensure all existing or potential hazards that have been identified are subjected to risk assessment and, if applicable, mitigation. The safety risks associated with an identified existing or potential hazard are assessed in the context of the potentially damaging consequences related to the hazard. Safety risks are generally expressed in two components: 1 Likelihood of an occurrence; and 2 Severity of the consequence of an occurrence. Typically, matrices that quantify safety risk acceptance levels are developed to ensure standardization and consistency in the risk assessment process. Separate matrices with different risk acceptance criteria are sometimes utilized to address long-term versus short-term operations. A risk register is often employed for the purpose of documenting risk assessment information and monitoring risk mitigation (control) actions. Expanded guidance may be found in the ICAO SMM, Document

37 A c t i o n s f o r ORG The Operator shall ensure the ERP, as specified in ORG The ERP shall provide for: 1. A transition from normal to emergency operations; 2. A return to normal operations; and 3. Coordination with all relevant external organizations during the course of ERP execution. [sms] (GM) Change Provision upgraded to a standard. Rationale The upgrade of this provision has been scheduled for 2015, to allow anticipated enhancements from ICAO to be incorporated. Guidance ERP transition and reporting is an element of the Safety Policy and Objectives component of the SMS Framework. Expanded guidance may be found in the ICAO SMM, Document

38

39 Actions for 2016 ISM Edition 10, effective September

40 A c t i o n s f o r ORG The Operator shall have a safety management system (SMS) that is implemented and integrated throughout the organization to ensure management of the safety risks associated with aircraft operations. [sms] (GM) Change Provision upgraded to a standard. Rationale This provision by its very nature cannot be found in conformity unless an Operator has achieved conformity with all standards identified by the [SMS] designation, and is therefore amongst the last provisions to be upgraded. Guidance Refer to the IRM for the definitions of Safety Management System (SMS) and State Safety Program (SSP). IOSA specifications for an operator s SMS are derived from the SMS Framework, which is published in Annex 19 to the Convention on International Civil Aviation (ICAO Annex 19). The SMS Framework specifies the four major components and 12 elements that make up the basic structure of an SMS. Where applicable, an SMS is designed and implemented in accordance with the State Safety Program (SSP). The manner in which the elements of SMS are implemented typically reflects the size and complexity of the operator s organization. In general, an SMS is designed and implemented to: Identify safety hazards in operations; Ensure remedial action is implemented to control safety risks; Provide for ongoing monitoring and assessment of safety performance; Make continual improvement to the level of safety in operations. The specific requirements for each operator s SMS will normally be found in the regulations associated with the SSP. In addition, states would typically publish guidance designed to assist operators in the implementation of SMS. A description of an operator s SMS is contained in documentation as specified in ORG Expanded guidance may be found in the ICAO Safety Management Manual (ICAO SMM), Document

41 A c t i o n s f o r ORG The Operator shall have processes for setting performance measures as a means to monitor the operational safety performance of the organization and to validate the effectiveness of safety risk controls. [sms] (GM)* Change Provision upgraded to a standard. Rationale This provision is dependent on all of the foundational elements of an SMS to be in place and working effectively. Therefore, it is one of the last provisions to be elevated to a standard. Guidance Refer to the IRM for the definition of Performance Measures. Setting measurable safety objectives is an element of the Safety Assurance component of the SMS Framework. By setting performance measures, an operator is able to track and compare its operational performance against a target (i.e. the performance objective, typically expressed as a rate or number reduction) over a period of time (e.g. one year). Achievement of the target (or objective) would represent an improvement in the operational performance. The use of performance measures is an effective method to determine if desired safety outcomes are being achieved. Performance measures also focus attention on the performance of the organization in managing operational risks and maintaining compliance with relevant regulatory requirements. In addressing operational performance, meaningful measures typically focus on lower level (i.e. lower consequence) occurrences or conditions that are considered by the operator to be precursors to serious events. Performance measures may be specific to a certain area of operation or may be broad and apply to the entire system. In addressing compliance, meaningful measures, as a minimum, would focus on compliance with significant regulatory requirements (as determined by the operator) in all operational areas. Ideally, performance measures are designed to be challenging, which, in turn, enhances the effectiveness of the risk management system. Performance measures may be set in almost any operational or maintenance area. Some possible examples include: 1 Flight operations (e.g. tail strikes on landing, unsatisfactory line or training evaluations); 2 Operational control (e.g. diversions due to fuel); 3 Engineering and maintenance (e.g. in-flight engine shutdowns, aircraft component or equipment failures); 4 Cabin operations (e.g. inadvertent slide deployments); 5 Ground handling (e.g. aircraft damages due to vehicles or equipment); 6 Cargo operations (e.g. dangerous goods spills); and 7 Operational security (e.g. unauthorized interference or access events). Expanded guidance may be found in the ICAO SMM, Document Note: This IOSA provision was not in existence before the ICAO SMS Framework was published in Annex 6. Therefore, it was incorporated into the ISARPs as a new recommended practice. 41

42 A c t i o n s f o r ORG The Operator shall have a process to identify changes within or external to the organization that have the potential to affect the safety of aircraft operations. This process shall include: 1. For internal changes, ensure safety risk is considered before such changes are implemented; and 2. For external changes, evaluate the adequacy of existing risk controls when such changes will affect the operational environment. [sms] (GM) Change Provision upgraded to a standard. Rationale This provision is dependent on all of the foundational elements of an SMS to be in place and working effectively. Therefore, it is one of the last provisions to be elevated to a standard. Guidance Refer to the IRM for the definition of Change Management. Change management is an element of the Safety Assurance component of the SMS Framework. Change management is considered a proactive hazard identification activity in an SMS. Change may affect the appropriateness or effectiveness of existing safety risk mitigation strategies. In addition, new hazards and related safety risks may be inadvertently introduced into an operation whenever change occurs. A change management process is designed to ensure risk management is applied to any internal or external changes that have the potential to affect established operational processes, procedures, products and services. Internal changes typically include organizational expansion, contraction or consolidation, new initiatives, business decisions as well as the introduction of new or the modification of existing systems, equipment, programs, products or services. External changes could include new regulatory requirements or changes to the operating environment (e.g. new security regulations, amendments to the dangerous goods regulations, changes to the air traffic control system). Expanded guidance may be found in the ICAO SMM, Document

43 Future Review This SMS strategy is a living document that will be reviewed and, if applicable, amended to reflect ongoing regulatory activity. Governance This strategy is a joint effort of two key stakeholders: the Global Audit Programs Department and the Global Safety Department, both part of IATA s SO&I Division. Its purpose is to facilitate the implementation of SMS elements throughout the airline industry in an organized way. The governance of the IOSA provisions remains unchanged and continues to follow existing procedures through the IOC. Supporting Programs this process shall include: IATA is committed to supporting all IOSA members For internal (existing changes, and potential) ensure safety in providing risk the is considered necessary assistance before such to changes successfully are implemented; an SMS. Available programs include: For external changes, evaluate the adequacy IATA Safety of existing Training risk Courses controls (Distance when 1 such learning changes and Instructor will affect led); the operational 2 environment. IATA Consulting; [sms] GM 3 IATF SMS Implementation Program; 4 Auditor training and support; and 5 Regional workshops. Other support initiatives may be identified and developed by IATA, as a result of monitoring program results, or in response to requests from members or other stakeholders.

44 Printed in Canada Material No: ISBN