SAFETY 1 st SMS DEVELOPMENT GUIDE

Transcription

1 SAFETY 1 st SMS DEVELOPMENT GUIDE

2 TABLE OF CONTENTS Forward... v HOW TO USE THIS GUIDE...1 CHAPTER OVERVIEW... 2 General Introduction to the Safety 1 st Development Guide... 2 Chapter 1: Introduction... 2 Chapter 2: Safety Organization... 2 Chapter 3: Hazard Identification & Safety Reporting... 2 Chapter 4: Accident Prevention Program & Root Cause Analysis... 3 Chapter 5: Safety Risk Management (SRM)... 3 Chapter 6: Human Factors... 3 Chapter 7: Safety Assurance... 3 Chapter 8: Emergency Preparedness... 4 Your Customized Manual... 4 Acronyms, Abbreviations, Definitions & Terminology... 5 CHAPTER 1: INTRODUCTION General Introduction Core Components of a Safety Management System Safety Policy Safety Risk Management (SRM) Safety Assurance Safety Promotion SMS Development and Implementation November 2013 Safety 1 st i

3 4. The FAA and System Safety Summary The Dirty Dozen Document Revision and Control CHAPTER 2: SAFETY ORGANIZATION Safety Management Organization Roles & Responsibilities Safety Manager / Director of Safety Gap Analysis Safety Management Plan SMS Documentation Safety Training Management Safety Awareness and Training Safety Orientation Recurrent Safety Training CHAPTER 3: HAZARD IDENTIFICATION & SAFETY REPORTING...37 Contents: Hazard Identification Process Hazard Identification and Controls Non-Punitive Hazard Reporting Accident / Incident Reporting Investigation Safety Committee Safety Communications November 2013 Safety 1 st ii

4 CHAPTER 4: ACCIDENT PREVENTION PROGRAM & ROOT CAUSE ANALYSIS Accident Prevention Program Safety Data management Root Cause Analysis CHAPTER 5: SAFETY RISK MANAGEMENT...56 The Safety Risk Management Process General SRM Principles Six Steps for SRM Implementing the SRM Process Types of Risk Defined Risk Identification Acceptability of Risk CHAPTER 6: HUMAN FACTORS Human Factors - Overview Introduction The Meaning of Human Factors The Aim of Human Factors in Aviation Safety and Efficiency Factors Affecting Workplace Performance Personality vs. Attitude Crew Resource Management (CRM) and Maintenance Resource Management (MRM) Safety Culture November 2013 Safety 1 st iii

5 CHAPTER 7: SAFETY ASSURANCE Safety Oversight Reactive Process Proactive Safety Assessment Safety Assurance Process Safety Assessment Safety Program Internal Review External Audit Procedures Environmental Compliance CHAPTER 8: EMERGENCY PREPAREDNESS Emergency Preparedness General What impact would an accident have on your company? Role of Senior Management Coordination and Communications Policies Other Organizations and Individuals Major Components of an Emergency Response Plan REFERENCES...97 Additional References November 2013 Safety 1 st iv

6 FORWARD This guide has been adapted from material developed by: the Federal Aviation Administration (FAA); Global Aviation Information Network (GAIN); Transport Canada; and the International Civil Aviation Organization (ICAO) addressing the fundamentals of safety management system structure and content. This guide provides a means for each company to customize this program to companyspecific safety goals and objectives. The Participant Advisories in the borders of this guide are for guidance purposes only. November 2013 Safety 1 st v

7 HOW TO USE THIS GUIDE The Safety 1 st SMS Development Guide provides guidance and instruction for the creation, implementation and use of a safety management system (SMS). This guide reflects enhancements to the traditional SMS for the benefit of participating companies, and addresses the activities commonly performed within air operator, FBO and maintenance organizations. This guide can be used to either develop and implement your own company-specific safety management system; or enhance your current safety program with advanced industry best practices. For ease of use, this guide is organized into eight chapters that allow your safety manager to develop your own customized SMS manual. November 2013 Safety 1 st Page 1

8 CHAPTER OVERVIEW General Introduction to the Safety 1 st SMS Development Guide A safety management system is comprised of three main components: 1) The overall management system, to include policies, procedures, duties, authorities, interfaces, controls, measures, and responsibilities; 2) The training that will be provided to your employees who must perform specific tasks using required (by regulation) and industry accepted practices; and 3) a performance standard that describes how each task will be performed. All three components comprise the elements that will provide a quality standard for participating companies. The following list is an overview of each chapter in this guide. Chapter 1: Introduction General Introduction Core Components of a Safety Management System SMS Development and Implementation The FAA and System Safety The Dirty Dozen Chapter 2: Safety Organization Safety Management Organization Roles and Responsibilities Gap Analysis Safety Management Plan SMS Documentation Safety Training Chapter 3: Hazard Identification & Safety Reporting Hazard Identification Process November 2013 Safety 1 st Page 2

9 Accident/Incident Reporting Non-Punitive Hazard Reporting Investigation Safety Committee Safety Communications Chapter 4: Accident Prevention Program & Root Cause Analysis Accident Prevention Program Safety Data Management Root Cause Analysis Chapter 5: Safety Risk Management (SRM) Safety Risk Management Process o o o o o o SRM Principles Six Steps for SRM Implementing the SRM Process Types of Risk Defined Risk Identification Acceptability of Risk Chapter 6: Human Factors Human Factors Overview Safety Culture Chapter 7: Safety Assurance Safety Oversight November 2013 Safety 1 st Page 3

10 Safety Assurance Process Safety Program Internal Review External Audit Procedures Environmental Compliance Chapter 8: Emergency Preparedness What impact would an accident have on your company? Role of Senior Management Coordination and Communications Policies Other Organizations and Individuals Major Components of an Emergency Response Plan Your Customized Manual Using the Safety 1 st SMS Development Guide to create your companyspecific document. o The Safety 1 st guide as your quality standard for conducting all technical functions associated with air, ground and maintenance operations (as applicable). o Developing your internal controlled manual system to assess distribution, ensure timely revisions and track implementation. o Incorporating updates from Safety 1 st and the aviation industry, and ensuring conformance. o Establishing an internal quality assurance assessment of your system s effectiveness. o Audits. November 2013 Safety 1 st Page 4

11 Acronyms, Abbreviations, Definitions & Terminology A Accident (ICAO Annex 13): An occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, in which: a. A person is fatally or seriously injured as a result of: Being in the aircraft, or Direct contact with any part of an aircraft, including parts which have become detached from the aircraft, or Direct exposure to jet blast, except when the injuries are from natural causes, self-inflicted or inflicted by other persons, or when the injuries are to stowaways hiding outside the areas normally available to the passengers and crew; or b. The aircraft sustains damage or structural failure which: Adversely affect the structural strength, performance or flight characteristics of the aircraft, and Would normally require major repair or replacement of the affected component, except for engine failure or damage, when the damage is limited to the engine, its cowlings or accessories; or for damage limited to propellers, wing tips, antennas, tires, brakes, fairings, small dents or puncture holes in the aircraft skin; or c. An aircraft is missing, completely damaged, or inaccessible. Note: An injury resulting in death within 30 days of the accident is classified as fatal. Accountability: The obligation or willingness to accept responsibility for the execution or performance of an assigned function, duty, task or action; implies being answerable (i.e., accountable) to a higher authority for ensuring such responsibility is executed or performed. Accountable Executive: Single, identifiable person who: (1) Is the final authority over operations authorized to be conducted under the certificate holder s certificate(s); (2) Controls the financial resources required for the operations to be conducted under the certificate holder s certificate(s); (3) Controls the human resources required for the operations authorized to be conducted under the certificate November 2013 Safety 1 st Page 5

12 holder s certificate(s); (4) Retains ultimate responsibility for the safety performance of the operations conducted under the certificate holder s certificate. Aircraft Accident (49 CFR Part 830): An occurrence associated with the operation of an aircraft, which takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage. (Also see Substantial Damage. ) Aircraft Operation: Operation of an aircraft with the intent of flight. Aviation Safety Action Program (ASAP): A reporting program that allows employees of participating air carriers and repair station certificate holders to identify and report safety issues to management and to the FAA for resolution, without fear that the FAA will use reports accepted under the program to take legal enforcement action against them, or that companies will use such information to take disciplinary action. Assumptions: Characteristics or requirements of a system or system state that are not verified. Audit: The structured and objective assessment used to determine the level of conformity to your company s operating manuals, safety program, technical guidance, regulations, etc. Aviation Safety Reporting System (ASRS): A voluntary program administered by NASA that receives, processes, and analyzes reports of unsafe occurrences and hazardous situations that are voluntarily submitted by pilots, air traffic controllers, and others. Information collected by the ASRS is used to identify hazards and safety discrepancies in the National Airspace System. It is also used to formulate policy and to strengthen the foundation of aviation human factors safety research. B Best Practice: A strategy, process, approach, method, tool or technique that is generally recognized as being effective in helping an operator achieve operational objectives. C Causes: Actions, omissions, events, conditions, or a combination thereof, which led to an accident or incident. Causes can occur by themselves or in combinations. November 2013 Safety 1 st Page 6

13 Control: Anything that mitigates the risk of a hazard s effects. A control can be a key procedure, responsibility, or decision-making position within the organization, department or functional area. (Note: Comprehensive evaluations focus on verifying and testing the controls within flight, ground and maintenance operations.) Comprehensive Evaluations: Periodic reviews of company operations performed by the Safety Manager. The independence of these reviews is intended to improve the ability of your company to verify that systems are effectively evolving with company growth and to ensure that technical issues are adequately considered in strategic decisions. Comprehensive Fix: A fix in which all corrective measures have been completed to the satisfaction of the company. Concern: A conclusion by the auditor, supported by objective evidence, that does not demonstrate a finding, but rather a condition that could become a finding. Corrective Action: The action(s) taken to eliminate or mitigate the cause of or to reduce the effects of a detected non-conformity or other undesirable situation. Corrective Action Plan (CAP): The total plan to close all Findings through implementation of comprehensive and permanent corrective action(s). Corrective Action Record (CAR): A document that identifies the need for corrective action based on a Finding, and provides a history of implementation and verification of the corrective action. D Documented: A specification published in a company operating manual, handbook, or other official company medium. It is distinct from records because it is the written description of policies, processes, procedures, objectives, requirements, authorities, responsibilities, or work instructions. E Effect: The potential outcome or harm of the hazard if it occurs in the defined system state. F November 2013 Safety 1 st Page 7

14 Finding: A condition, supported by objective evidence that demonstrates nonconformance with a specific standard. Flight Operations Quality Assurance (FOQA): The voluntary collection, analysis, and sharing of routine flight operation data, obtained by analysis of flight data recorder information. G Ground Incident: An occurrence not associated with the operation of an aircraft, causing injury that does not require professional medical attention, or minor damage to an aircraft or other equipment. Ground Operations: The department, company or vendor responsible for all ground (ramp) operations. H Hazard: Any real or potential condition that can cause injury, illness, or death to people; damage to or loss of a system, equipment, or property; or damage to the operating environment. A hazard is a condition that is a prerequisite to an accident or incident. Human Factors: Human factors involves gathering information about human abilities, limitations, and other characteristics and applying it to tools, machines, systems, tasks, jobs, and environments to produce safe, comfortable, and effective human use. In aviation, human factors is the study and application to better understand how humans can most safely and efficiently be integrated with the technology. That understanding is then translated into design, training, policies, or procedures to help humans perform better. I ICAO (International Civil Aviation Organization): A specialized agency of the United Nations that sets standards and regulations necessary for aviation safety, security, efficiency and regularity, and aviation environmental protection. The Organization serves as the forum for cooperation in all fields of civil aviation among its Member States. ICAO Annex 6: Standards and recommended practices for the international operation of aircraft. Annex 6, Part I is applicable to commercial air transport in November 2013 Safety 1 st Page 8

15 airplanes; Part II is applicable to general aviation operations in airplanes; and Part III is applicable to both commercial air transport and general aviation operations in helicopters. ICAO Annex 13: The international recommended standard for aircraft accident and incident investigation. Incident (49 CFR Part 830): An occurrence other than an accident, associated with the operation of an aircraft, which affects or could affect the safety of operations. Investigation: A process conducted for the purpose of accident prevention, which includes the gathering and analysis of information, the drawing of conclusions, including the determination of causes and, when appropriate, the making of safety recommendations. Investigator-in-charge: A person, commission or other body charged, on the basis of his/her/their qualifications, with the responsibility for the organization, conduct and control of an investigation. L Likelihood: The estimated probability or frequency, in quantitative or qualitative terms, of an occurrence related to a hazard. (Also see Hazard. ) N Near Miss (Serious Incident): An incident involving circumstances indicating that an accident nearly occurred. The difference between an accident and a serious incident lies only in the result. Non-Conformity: Non-fulfillment of specifications contained in the applied standard as determined by the auditor in terms of having been documented and/or implemented by the company. O Objective Evidence: Information, which can be proved to be true, based on facts obtained through observation, measurement, test or other means. November 2013 Safety 1 st Page 9

16 Occupational Injury: An injury sustained by an employee on your payroll whether they are labor, executive, hourly, salary, part-time, seasonal or migrant worker and who sustain the work related injury, illness or death. OSHA: Occupational Safety & Health Administration OSHA 1910: That portion of the Occupational Safety and Health Act that pertains to general industry regulations. OSHA 300 Log: The OSHA-required form for maintaining occupational injury and illness records. P PPE (Personal Protective Equipment): Equipment for protecting the eyes, face, head, ears, extremities, protective clothing, respiratory devices and protective shields. Q Quality: The degree to which a system consistently meets specified requirements, satisfies stated needs, or produces desired outcomes. Quality Assurance: All those planned and systematic actions necessary to provide adequate confidence that a product or service will satisfy given requirements for quality. Quality System: The organizational structure, responsibilities, procedures and resources for implementing and maintaining the quality policy and objectives. R Recommended Best Practice: A strategy, process, approach, method, tool or technique that is generally recognized as being effective in helping an operator to achieve operational objectives. Risk: The composite of predicted severity and likelihood of the potential effect of a hazard in the worst credible system state. Types of risk include: a. Identified risk: That risk that has been determined to exist using analytical tools. The time and costs of analysis efforts, the quality of the risk management November 2013 Safety 1 st Page 10

17 program, and the state of the technology involved affect the amount of risk that can be identified b. Unidentified risk: That risk that has not yet been identified. Some risk is not identifiable or measurable, but is no less important. Mishap investigations may reveal some previously unidentified risks. c. Total risk: The sum of identified and unidentified risk. Ideally, identified risk will comprise the larger portion of the two. d. Acceptable risk: The part of identified risk that is allowed to persist after controls are applied. Risk can be determined acceptable when further efforts to reduce it would cause degradation of the probability of success of the operation, or when a point of diminishing returns has been reached. e. Unacceptable risk: The portion of identified risk that cannot be tolerated, but must be either eliminated or controlled. f. Residual risk: The remaining safety risk that exists after all control techniques have been implemented or exhausted, and all controls have been verified. Only verified controls can be used for the assessment of residual safety risk. Root Cause Analysis: A systematic approach to identifying, investigating, categorizing, and eliminating the root causes of safety related incidents. S Safety: A condition in which the risk of harm or damage is limited to an acceptable level. Safety Management System (SMS): A formal, top-down business-like approach to managing safety risk. It includes systematic procedures, practices and policies for the management of safety. It also includes safety risk management, safety policy, safety assurance, and safety promotion. NOTE: The extent of the SMS documentation can differ from one organization to another due to the size of the organization and type of activities. The documentation can be in any form or type of medium. Severity: The consequence or impact of a hazard in terms of degree of loss or harm. November 2013 Safety 1 st Page 11

18 Substantial Damage (49 CFR Part 830): Damage or failure which adversely affects the structural strength, performance or flight characteristics of the aircraft, and which would normally require major repair or replacement of the affected component. Engine failure or damage limited to an engine if only one engine fails or is damaged, bent fairings or cowling, dented skin, small punctured holes in the skin or fabric, ground damage to rotor or propeller blades, and damage to landing gear, wheels, tires, flaps, engine accessories, brakes, or wingtips are not considered substantial damage for the purpose of this Part. System: An integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, equipment, information, procedures, facilities, software, and support services. System Safety: The application of special technical and managerial skills in a systematic, forward-looking manner to identify and control hazards throughout the life cycle of a project, program, or activity. System State: An expression of the various conditions, characterized by quantities or qualities, in which a system can exist. T Top Management: The person or group of people who direct and control an organization (ref: ISO definition 3.2.7). V Validated: The act of determining factual evidence for a certain condition or situation. Verified: The ability to prove that something exists or is true, or to make certain that something is correct. W Work Related Injury or Illness: An injury or illness that is caused by an event or exposure in the work environment that either caused or contributed to the resulting condition or significantly aggravated a pre-existing injury or illness. Workrelatedness is presumed for injuries and illnesses resulting from events or exposures occurring in the work environment. November 2013 Safety 1 st Page 12

19 CHAPTER 1: INTRODUCTION Contents: 1. General Introduction 2. Core Components of a Safety Management System Safety Policy Safety Risk Management Safety Assurance Safety Promotion 3. SMS Development & Implementation Level 1: Planning and Organization Level 2: Reactive Processes Level 3: Proactive and Predictive Processes Level 4: Safety Assurance and Continuous Improvement 4. The FAA and System Safety 5. Summary 6. The Dirty Dozen 7. Document Revision and Control November 2013 Safety 1 st Page 13

20 Participant Advisory: SMS can be adapted to both large and small organizations. Managers that desire to make a positive impact on their safety performance will find SMS achieves results, by raising awareness at every level of the organization, building in responsibility and providing a logical, data driven approach to managing risk. 1. GENERAL INTRODUCTION This guide outlines the foundation of SMS, and provides guidance on tailoring SMS to your company s operations. To ensure this program works as effectively as possible in your organization, every employee must be empowered to achieve the highest levels of safety. Every employee must be responsible and appropriately accountable for safety during aircraft flight, ground and maintenance operations. This guide will define all the applicable components of a Safety Management System (SMS). The SMS components outlined in this guide serve as an operational guide for the daily management of all safety activities. SMS is a systematic, comprehensive process for the management of safety risks that integrates operations and technical systems with financial and human resource management, for all activities related to flight, ground and maintenance operations. SMS is a data driven, business-like approach to safety management. In common with all other management systems, the SMS provides for goal setting, planning, and performance measurement. It concerns itself with organizational safety, rather than conventional health and safety issues at work. The SMS defines how your company intends the management of safety to be conducted as an integral part of its business management activities. As with many aspects of managing a company, the approach and strategy for the SMS is based on the 3 P model illustrated below. Each part of your strategy must connect and rely on each other to ensure the model will always be strong. In the 3 P model of safety management: November 2013 Safety 1 st Page 14

21 There is a Policy approved and supported at the highest level. Processes that make up the safety management system are documented, implemented and used to manage the company s activities. People (staff) managing and running the business have been trained on the SMS and are expected to follow approved policy and processes. The elements of the SMS outlined in this guide conform to FAA Advisory Circular (AC) A, Safety Management Systems for Aviation Service Providers, and the International Civil Aviation Organization (ICAO) SMS Framework. The information in this guide outlines the principles of safety management and its application to flight, maintenance and ground operations. The documented elements contained in this guide are the individual building blocks of the system, and should be introduced in a well thought out, managed process supported by top management. The implementation of the SMS and its components should be phased to ensure the success of each element. Aspects of some of the elements may already be in place in your company, but might need to be modified in order to conform to the requirements of the safety management system your company ultimately develops. 2. CORE COMPONENTS OF A SAFETY MANAGEMENT SYSTEM SMS is an integrated collection of processes, procedures and programs that ensure a formal and proactive approach to system safety through risk management. The following describes the four main components of an SMS: Safety Policy All management systems must define policies, procedures and organizational structures to accomplish their goals. Under Safety Policy, the following activities take place: Top management defines the organization s safety policy and conveys its expectations, objectives, commitments and accountabilities to its employees. November 2013 Safety 1 st Page 15

22 The organization defines documents and communicates the safety roles, responsibilities and authorities throughout its organization. The organization appoints a management representative to manage, monitor and coordinate the SMS processes. The organization develops and implements procedures that it will follow in the event of an accident or incident or operational emergency to mitigate the effects of these events. The organization establishes documented safety policies, objectives, procedures, a document/record management process and a safety management plan that meet organizational safety expectations and objectives. Safety Risk Management (SRM) A formal system of hazard identification and safety risk management (SRM) is essential to controlling risk to acceptable levels. Under Safety Risk Management, the organization: Develops and maintains a process that ensures that hazards in operations are identified. Hazards are identified from the analysis of critical design and performance factors, processes and activities in sufficient detail to determine associated level of risk and risk acceptability. Analyzes its systems, operations and operational environment to gain an understanding of critical design and performance factors, processes and activities to identify hazards. Identifies and documents the hazards in its operations that are likely to cause death, serious physical harm, or damage to equipment or property in sufficient detail to determine associated level of risk and risk acceptability. Develops and maintains a process that ensures analysis, assessment and control of the safety risks in system operations. Determines and analyzes the severity and likelihood of potential events associated with identified hazards, and will identify risk factors associated with unacceptable levels of severity or likelihood. November 2013 Safety 1 st Page 16

23 Assesses risk associated with each identified hazard and defines risk acceptance procedures and levels of management that can make safety risk acceptance decisions. Designs and implements a risk control for each identified hazard for which there is unacceptable risk, to reduce risk to acceptable levels. The potential for residual risk and substitute risk is analyzed before implementing any risk controls. Safety Assurance Once SRM controls are identified and operational, the company must ensure the controls continue to be effective in a changing environment. The safety assurance (SA) function provides for this, using system safety and quality management concepts and processes. Under Safety Assurance, the organization: Monitors, measures, and evaluates the performance and effectiveness of risk controls. Develops and maintains a means to monitor, measure and verify the safety performance of the organization, and to validate the effectiveness of safety risk controls. Continuously monitors operational data, including products and services received from contractors, to identify hazards, measure the effectiveness of safety risk controls, and assess system performance. Performs regularly scheduled internal audits of its operational processes, including those performed by contractors, to verify safety performance and evaluate the effectiveness of safety risk controls. Conducts internal evaluations of the SMS and operational processes at planned intervals, to determine that the SMS conforms to its objectives and expectations. Includes the results of assessments performed by oversight (FAA) and other organizations in its analysis of data. November 2013 Safety 1 st Page 17

24 Establishes procedures to collect data and investigate incidents, accidents, and instances of potential regulatory noncompliance to identify potential new hazards and risk control failures. Establishes and maintains a confidential employee safety reporting and feedback system. Data obtained from this system is monitored to identify emerging hazards and to assess performance of risk controls in the operational systems. Analyzes the data collected in this Section to assess the performance and effectiveness of risk controls in the organization s operational processes and the SMS, and to identify root causes of non-conformances and potential new hazards. Performs an assessment of the safety performance and effectiveness of risk controls, conformance to SMS expectations and the objectives of the safety policy. Develops and maintains a process to identify changes within the organization or its operational environment that may affect established processes and services and to describe the arrangements to assure safety performance before implementing changes. Develops and maintains a process to identify the causes of sub-standard safety performance, determine the implications of sub-standard safety performance and eliminate or mitigate such causes. Takes corrective and preventive action to eliminate the causes, or potential causes of nonconformance identified during analysis, to prevent recurrence. Conducts regular reviews of the SMS to assess the performance and effectiveness of the organization s operational processes and the need for improvements. Safety Promotion The company must promote safety as a core value with processes that support a sound safety culture. Under Safety Promotion, the organization: Promotes the growth of a positive safety culture and communicates it throughout the organization. November 2013 Safety 1 st Page 18

25 Ensures that personnel are trained and competent to perform the SMS duties. The scope of safety training is commensurate with the individual s involvement in the SMS. Documents competency requirements for safety-related positions and key safety personnel and ensures those requirements are met. Develops, documents, delivers and regularly evaluates training necessary to meet competency requirements. Communicates the outputs of its SMS to all employees, and provides its oversight organization access to SMS outputs in accordance with established agreements and disclosure programs. 3. SMS DEVELOPMENT AND IMPLEMENTATION There are four levels of SMS implementation, which provide for a progressive system development: Level 1: Planning and Organization; Level 2: Reactive Processes; Level 3: Proactive and Predictive Processes; Level 4: Safety Assurance and Continuous Improvement. Each level involves the following activities: Level 1: Planning and Organization The organization will: Establish a statement of commitment, signed by the CEO / Accountable Executive, to the development and implementation of the SMS. Designate a management official responsible for SMS implementation. Define safety-related positions for those who will participate in SMS development and implementation. Conduct a documented gap analysis between the organization s existing system and SMS guidelines. November 2013 Safety 1 st Page 19

26 Develop a comprehensive SMS implementation plan for the entire organization based on the results of the gap analysis. Develop an SMS training plan for all employees. Level 2: Reactive Processes The organization will: Document and implement a voluntary non-punitive employee reporting program. Document policies and procedures to conduct a reactive analysis and assessment of hazards, and to implement corrective actions to mitigate future risk. Apply SMS processes and procedures to at least one existing hazard, and initiate the risk mitigation process. Conduct SMS training for the staff directly involved in the SMS on reactive processes. Update the SMS implementation and training plans for the entire organization. Level 3: Proactive and Predictive Processes During Level 3, the organization will demonstrate that, in addition to the components already developed and implemented during Level 2, it also has a process for the proactive identification of hazards and associated methods of collecting, storing and distributing data and a risk management process. The organization will: Document all processes and procedures for operating the SMS, from information gathering through Safety Risk Management and mitigation. Conduct hazard analyses on all current operating processes. As appropriate, revise documented SMS implementation plan for the entire organization. As appropriate, revise documented policies and procedures. November 2013 Safety 1 st Page 20

27 Level 4: Safety Assurance and Continuous Improvement During Level 4, the organization will demonstrate that, in addition to the components developed and implemented during Levels 2 and 3, it has also developed and implemented processes for: Recurrent training Quality management Emergency preparedness As appropriate, revise documented safety management plan As appropriate, revise documented policies and procedures The safety assurance process should include a method for validation of control, evaluation of results, and development of any necessary changes to the SMS. A safety management system is progressive in its development. The expectation is to strive for, and realize, continuous improvement. 4. THE FAA AND SYSTEM SAFETY In 2006, the FAA issued Order , which established a policy of managing safety through a process-oriented system or system safety process. This process applies to all FAA management activities and its safety oversight relationship with the aviation industry. In October 2010, the FAA released Advisory Circular (AC) A, Safety Management Systems for Aviation Service Providers. The purpose of the AC is to encourage any organization providing aviation services, e.g., airlines, air charter operators, corporate flight departments, maintenance repair organizations, pilot schools, repair stations, etc., to develop and implement an SMS. The material in this guide conforms to the requirements of AC120-92A and the ICAO standards for SMS. Safety Risk Management (SRM) and Safety Assurance (SA) Processes November 2013 Safety 1 st Page 21

28 5. SUMMARY The following is a summary of the benefits that SMS provides for your company: A comprehensive, systematic approach to the management of flight, ground and maintenance safety, including the interfaces between the company, customers, and vendors. A focus on flight, ground and maintenance operations; hazard identification, management and the effects on activities critical to safety. The full integration of flight, ground and maintenance safety considerations, via the application of management controls to all aspects of operations critical to safety. The use of active monitoring and audit processes to validate that the controls identified in the hazard management process are in place, and to ensure an active commitment to safety. The use of quality management principles, including improvement and feedback mechanisms. 6. THE DIRTY DOZEN November 2013 Safety 1 st Page 22

29 The Federal Aviation Administration (FAA) has identified 12 main causes of human error leading or contributing to accidents, often referred to as the dirty dozen: Lack of Communication; Complacency; Lack of Knowledge; Distraction; Lack of Teamwork; Fatigue; Lack of Resources, Pressure; Lack of Assertiveness; Stress; Lack of Situational Awareness; and Norms (behavior that is not required, but expected at the workplace). Your company, in cooperation with the Safety 1 st Team, strives to eliminate these causal contributors by aggressively supporting the principles outlined in this industry specific safety management system. The organizational structures and activities that make up your company s SMS are designed to enhance safety throughout the organization. Every employee in every department contributes to the safety of the organization. The system must be integrated into a safety culture or the way things are done throughout the company. This will be achieved by the implementation and continuing support of a documented safety program based on a coherent policy, which leads to well designed and maintained procedures. 7. DOCUMENT REVISION AND CONTROL The SMS documentation that your company develops as part of this program shall have a method of revision and control, to provide accurate and timely updates to all employees. The revision status shall be identified by the revision date on each page of your SMS documentation. No revision service for this guide is provided. The most current version of the guide will be maintained on the Safety 1 st Website. November 2013 Safety 1 st Page 23

30 This guide is not a regulatory-approved document and does not supersede any requirements mandated by local, state or federal authorities, nor does it supersede or amend any manufacturer's guidance, manuals, or any other approved documentation. This document is provided for guidance purposes only. Safety 1 st does not accept any liability for incidents arising from the use of the guidance materials contained in this document. November 2013 Safety 1 st Page 24

31 CHAPTER 2: SAFETY ORGANIZATION Contents: 1. Safety Management Organization 2. Duties & Responsibilities 3. Safety 1 st Shared Responsibilities 4. Gap Analysis 5. Safety Management Plan 6. SMS Documentation 7. Training November 2013 Safety 1 st Management System Page 25

32 Participant Advisory: 1. SAFETY MANAGEMENT ORGANIZATION Whether your organization is a one-location operation or has a highly centralized corporate structure with numerous outlying facilities, it s important to ensure that the safety communication structure touches all facilities and operations. Safety Manager Accountable Executive / Top Managment Safety Committee Safety is not a corporate only function, but one that must be visible in the field on a daily basis. Safety is not the sole responsibility of the Safety Manager, but the responsibility of managers, supervisors, and every employee. The Safety Manager must be empowered by your company to facilitate, assist and guide your company to establish and maintain a robust safety program. Flight Operations Maintenance Department Line Service Scheduling & Flight Following Safety Organization: To be effective, the Safety Manager should report directly to the highest level within the management structure. While this section outlines individual roles and responsibilities, it s important to emphasize that everyone has a responsibility for safety. By implementing SMS, your company is committing to achieving and maintaining the highest levels of safety within the aviation services industry and to providing the resources necessary to ensure that all strategic safety objectives established in this guide are achieved. The authority and responsibility to implement SMS in your company rests with Top Management. Note: Top Management is defined as, the person or group of people who direct or control an organization. Top management makes decisions that affect everyone in the organization, and is held responsible for the success or failure of the company. In large organizations, this can be the Chief Executive Officer (CEO), president or board of directors. In smaller organizations, it might be the company owner. The responsibility for maintaining the SMS normally rests with the Safety Manager. However, every employee has specific accountabilities. After orientation and safety training, all employees will be assigned duties and responsibilities to ensure your company s safety management system is as effective as possible. November 2013 Safety 1 st Page 26

33 Participant Advisory: The Safety Manager s reporting structure: Industry best practice recommends that the Safety Manager position report to the highest level in the organization, such as the CEO/President. The Safety Manager should not report directly to Operations, as this reporting relationship can be hindered by the need to get the job done at the expense of doing it safely. It s vital to the effectiveness of this program that safety communication is not hindered in any way. The following list of activities demonstrates top management s active commitment to the SMS: Including safety matters on the agenda of meetings from the Board of Directors level down Being actively involved in safety activities and reviews at both home office and base locations (as applicable) Allocating the necessary resources, such as time and funding, to safety matters Setting personal examples in day-to-day work Receiving and acting on safety reports submitted by employees Promoting safety topics in company publications Walk the Walk Talk the Talk - Safety First. The Accountable Executive is responsible: to ensure the company achieves its business and quality objectives, for the safety and efficiency of company operations, and for authorizing budgets accordingly. The Accountable Executive will assess safety resource needs requested by the Safety Manager. The Accountable Executive is responsible for managing all components of the SMS. The Accountable Executive may direct the Safety Manager to produce an annual aviation safety report that will be authorized by the Accountable Executive. The Accountable Executive will act, or appoint a management representative, as Chair of the Safety Committee. The Safety Manager reports to the Accountable Executive and is responsible for proposing safety policy, monitoring its implementation and providing an independent overview of company activities in so far as they affect safety; maintenance, review and revision of the safety program; timely advice and assistance on safety matters to managers at all levels; and a reporting system for hazards. All managers are committed to support the safety management system, and share the overall commitment to safety as expressed by the Accountable Executive. November 2013 Safety 1 st Page 27

34 2. ROLES & RESPONSIBILITIES Your organization shall document and define the roles and responsibilities of all personnel in the safety management system, especially the following positions (as applicable): Director of Operations, Director of Maintenance, Chief Pilot, and operational employee groups such as pilots, dispatchers/schedulers, mechanics, line service and customer service representatives. This should include a statement that everyone is both responsible and accountable for safety. Top management s dedication and involvement to safety should be clearly visible. It s important that top management is viewed as providing strong and active leadership in the safety management system. This includes a commitment to provide the resources necessary to attain strategic safety objectives established by the organization. Safety Manager / Director of Safety The Safety Manager is responsible for ensuring that the safety and health management process is established, communicated, implemented, audited, measured and continuously improved for your company and its customers. This should be accomplished in the following duties and responsibilities: Prepare and maintaining your company s SMS. Serve as a safety and health (if applicable) resource for operational departments and employees. Assist in the organization/development of documented workplace safety business plans. Assist in the operational and safety planning processes, e.g., safety performance goals. Maintain company safety management information data. Provide human factors guidance and program development. Provide guidance or secure guidance on regulatory compliance issues. Provide regular safety communication through various means. Provide or make available industrial hygiene services (if applicable). Establish and maintain the chemical safety management process (MSDS) (if applicable). November 2013 Safety 1 st Page 28

35 Support continuous safety improvement programs and abide by Company SMS audit policies and procedures. Conduct hazard assessments and audits, and perform frequent observations of all aspects of employee and technical operations. Provide hazard control recommendations to top management for review. Report safety resource management needs to top management. Conduct and/or coordinate all safety training and ensure all applicable employees train in accordance with your SMS. Facilitate environmental compliance (if applicable). Conduct and/or coordinate emergency response exercises. Review reports of safety-related events. Represent the company with government agencies and professional associations on safety and environmental matters. Serve as recorder of safety committee meetings. Provide emergency management tools and services. To enhance the level of safety professionalism and effectiveness at your company, the safety manager can be more effective by participating in formal safety education. Participation in industry safety meetings, conferences or schools is an essential part of the continuing education of the safety manager. Training should include areas such as: Corporate Safety Culture Safety/Internal Evaluation Philosophy Safety/Internal Data Collection and Analysis Programs Operational Risk Management Root Cause Analysis Incident/Accident Prevention and Investigation Human Factors The safety manager should have extensive operational experience and professional qualifications in aviation. This would include knowledge and understanding of: Aviation Safety/Audit Programs Aviation Safety Standards November 2013 Safety 1 st Page 29

36 Safe Aviation Operating Practices OSHA Regulations (as applicable) The Safety Manager should also receive advanced training in safety management by attending an accredited safety management course. A list of institutions offering these courses is provided in the References section of this guide. Documentation of Roles and Responsibilities of Other Key SMS Personnel The following highlight the areas that should be documented for key SMS personnel: The safety responsibilities for each position and task. The competencies required for each position. The line of responsibility for ensuring all staff are competent and trained for their duties, and for ensuring that training takes place. The responsibilities of the manager responsible for externally supplied services, such as training, maintenance, etc. All contracting companies should meet the SMS standards equivalent to those established by your company. 3. GAP ANALYSIS The next step in the SMS process is to develop an implementation plan for the entire organization. But, where do you begin? A good place to start is a comparison of your current safety program with the four SMS components. This comparison or gap analysis helps identify areas of your safety program that need further development in order to have a fully operational SMS in your company. Safety 1 st provides two separate gap analysis tools. The first is the FAA Air Carrier Detailed Gap Analysis Tool (to download click here), designed for FAR 135 air charter operators, and reviews the following activities (as applicable): Flight operations Dispatch/flight following Maintenance and inspection Cabin safety Ground handling and servicing Cargo handling November 2013 Safety 1 st Page 30

37 Training The second tool is the SMS Gap Analysis Survey (to download click here), and is designed for FBOs. Both gap analysis tools review a company s adherence to the SMS components outlined in FAA Advisory Circular (AC) A. 4. SAFETY MANAGEMENT PLAN In order for your company to implement an effective SMS, it s important to define the organization s safety objectives, what form the safety system will take and who will assume responsibility for the safety system. This involves defining the organization s overall approach to integrating safety as a primary business function. The Safety 1 st SMS contains three principle objectives: Define a clear corporate safety policy. Define roles, responsibilities, and organizational reporting structures for all personnel involved in safety. A description of the SMS components. Your company s safety policy should clearly state the company s intentions, management system, and objectives to achieve continuous improvements in safety. This can be accomplished through documented policies describing what organizational processes and structures it will use to achieve the SMS. This should also contain a statement outlining the company s objectives and the outcomes it hopes to achieve through its SMS. Other elements should include: Establishing safety as a core value. Setting safety goals that will be revised annually based on performance. Measuring safety performance. An effective safety policy must clearly communicate top management s commitment. This commitment should explain how the company will devote appropriate time, resources, and attention to organizational safety. (A sample company safety commitment policy can be accessed by clicking here.) Top management s commitment should be documented in a manner that expresses clear direction. The safety policy should allocate responsibilities and hold employees accountable for meeting safety performance goals. November 2013 Safety 1 st Page 31

38 The safety policy should include top management s commitment to: Implement and maintain the SMS. Continuously improve the level of safety. Manage safety risk. Comply with applicable regulatory requirements. Encourage employees to report safety issues without reprisal. The safety policy should: Establish clear standards for acceptable behavior for all employees. Provide management guidance for setting safety objectives. Be documented. Be communicated with visible management endorsement to all employees and responsible parties. Be reviewed periodically to ensure it remains relevant and appropriate to the organization. Identify responsibility and accountability of management and employees with respect to safety performance The table below is an example of how to develop safety objectives. OBJECTIVE Business Objectives: Reduce Costs Safety Objectives: Decrease the number and severity of hangar rash incidents Your company s specific objectives SAFETY PERFORMANCE MEASURES Reduction in insurance rates Total number of events Number of damage-only events Number of near-miss accidents Lessons learned from event analyses Number of corrective action plans developed and implemented. November 2013 Safety 1 st Page 32

39 5. SMS DOCUMENTATION The SMS that your company ultimately develops must document the following program elements: Company Safety Policy and Objectives Duties and Responsibilities Safety Focal Point Hazard Identification Accident/Incident Reporting Self-Disclosure Safety Investigation Safety Committee Safety Communications Accident Prevention Safety Data Management Quality System Oversight Each SMS program element should address the following three documentation requirements: The identification of applicable health and safety and industry regulations, standards, and accepted practices. Consolidated documentation describing the systems for each component of the SMS. The implementation of changes required by changes to health, safety, industry regulations, standards, and recommended practices. Note: A sample SMS implementation timeline can be accessed by clicking here. 6. SAFETY TRAINING Training is fundamental to effective job performance. Effective performance means compliance with the requirements of safety, profitability and quality. To meet this training need, it s important to establish a program that ensures: November 2013 Safety 1 st Page 33

40 A systematic analysis, to identify the training needs of each job function The establishment of training plans to meet the identified needs The training is assessed and is effective, in that each training session has been understood and the training program is relevant Training involves the review of all occupations; analysis and observation of critical activities, accident and incident analysis and statutory requirements. The objective of all training is to provide employees with the skills and knowledge to carry out their duties safely and effectively. All appropriate training methods including the additional training provided for Safety 1st participants should be used. Additionally, there is no substitute for practical onthe-job instruction in some occupations. Whatever training techniques are adopted, it s important that the effectiveness of the training is assessed and that training records are maintained. Periodic reviews of the training program are required to ensure that it remains relevant and effective. Management Safety Awareness and Training For the successful operation of any management system, it s essential that the management team understand the principles on which the system is based. Effective training of management ensures this objective. Training should provide everyone with supervisory responsibility the necessary skills to implement and maintain the SMS. The training of managers and supervisors should include: Initial training, soon after appointment to a supervisory position, to acquaint new managers and supervisors with the principles of the SMS, their responsibilities and accountability for safety and statutory requirements. Detailed training in the SMS, to include the background and rationale behind each element. Skills training in relevant areas such as communications and safety auditing. Conducting group meetings. Learning how to focus on safety - no matter what the task. Regular update and refresher training as applicable. Training courses should be tailored to ensure that managers and supervisors are familiar with the principles of your company s SMS and their responsibilities and November 2013 Safety 1 st Page 34

41 accountabilities for safety. On-site training ensures that all staff are acquainted with the relevant information appropriate to their function. For successful SMS implementation, it s also important that the safety manager receive training early-on. The safety manager needs to understand the details of the SMS, and techniques for implementing its elements. As the focal point for the system, the safety manager should be thoroughly conversant with the program and safety management principles. Safety Orientation Safety orientation in the work place begins on the first day of employment or job reassignment. The plan for conducting initial safety orientation of an employee should include: A thorough review of your company s SMS. The employee s supervisor should assist the employee regarding the general content of the safety program. Emphasis should be placed on employee specific rules, policies and procedures that will directly affect the employee in the performance of his/her duties. Each employee should be advised by his/her direct supervisor that compliance with rules and policies of the SMS is a condition of employment. Every employee will have job-specific training and trained by his/her supervisor on the proper performance of his/her duties to ensure these duties are carried out in a safe and proper manner. Job-specific training can be accomplished by computer-based, and/or on-thejob training. The safety manager should, based on job hazard analyses of the employee s job, determine and schedule required safety training. The following steps should be completed before releasing an employee to carry out a specific job function unsupervised: The supervisor should carefully review with the employee all general and specific rules, policies, and procedures to ensure the safety of company operations and compliance with appropriate labor statutes. November 2013 Safety 1 st Page 35

42 Employees should be given verbal instruction and specific directions on the proper performance of work practices. As required, employees should be given a demonstration of job tasks. Employees should be observed performing actual work previously demonstrated. As necessary, remedial instruction will be provided to correct training deficiencies prior to final release of an employee to perform unsupervised work. Employees and supervisors should be given safe operating instructions, if available, from an authorized equipment vendor prior to the use and operation of new equipment or processes. Supervisors should review safe work practice options with employees prior to permitting any new, non-routine, or specialized procedures in the workplace. Recurrent Safety Training The Safety 1 st SMS Guide Applicable continuing education Local operational safety issues Seasonal or event safety issues Industry trends and best practices Lessons learned Locally developed training should be included in the employee-training record, to include course contents, and a syllabus should be maintained at each location or accessible on your company s network. In order for employees to comply with all safety requirements, they need the appropriate information, skills, and training. The training should include initial, recurrent and any updates specific to the SMS. Employee participation in recurrent safety training should be documented in their permanent employee training record. November 2013 Safety 1 st Page 36

43 CHAPTER 3: HAZARD IDENTIFICATION & SAFETY REPORTING Contents: 1. Hazard Identification Process 2. Non-Punitive Hazard Reporting 3. Accident/Incident Reporting 4. Investigation 5. Safety Committee 6. Safety Communication November 2013 Safety 1 st Page 37

44 1. HAZARD IDENTIFICATION PROCESS This section provides guidance to develop your company s hazard identification process. A hazard is any real or potential condition that can cause injury, illness, or death to people; damage to or loss of a system, equipment, or property; or damage to the operating environment. The safety manager should involve all operational and technical departments, such as flight operations, maintenance, dispatch, line service and customer service, and any other departments as appropriate (e.g., risk management, human resources) in the hazard identification process. Involving these groups or personnel will help minimize errors and omissions, ensure a quality analysis, and encourage employee buy in to the process. The hazard identification process consists of four steps: Step One: Review the company s incident/accident history with all operational and applicable administrative departments, e.g., risk management, human resources, etc. The review should focus on indicators of existing hazards and associated controls (if any) and determine whether the hazards were correctly identified and/or the associated controls were adequate. Step Two: Conduct a preliminary job assessment, such as a job hazard analysis (see page 40). The safety manager should review with all operational employees the hazards they know currently exist in each work area, job assignment, and within the airport environment. Brainstorming should be encouraged during these discussions to foster new ideas to either eliminate or control hazards. It s important to understand all the steps or tasks associated with each job. One method of understanding job tasks is to observe employees performing the job and list each step as it s accomplished. Record enough information without making it too lengthy. Obtain input from the employee performing the job. Review the recorded job steps or tasks with the employee to ensure nothing important is omitted. Note: Reassure the employee being observed that the intent of this exercise is to evaluate the job itself, not the employee s performance. If any hazards are identified that pose an immediate danger to employees, customers, aircraft, equipment or facilities, the safety manager should take immediate preventive action. Do not wait to complete a job hazard analysis. November 2013 Safety 1 st Page 38

45 Step Three: List, rank, and set priorities for the identified hazards. List jobs with hazards that present unacceptable risks, based on those most likely to occur and with the most severe consequences. Step Four: Identify effective controls to reduce or better manage the hazards associated with the task or job. Hazard Identification and Controls There are many ways of identifying hazards and quantifying risks, but success requires thinking by people who are unencumbered by past ideas and experiences. Some hazards might be obvious, such as a lack of training, or they might be subtle, such as the insidious effects of long-term fatigue from long duty or work days. Depending on the size and complexity of your operation, there are several useful methods of identifying hazards: Brainstorming - small discussion groups meet to generate ideas in a nonjudgmental way. Formal review of standards, procedures and systems. Staff surveys or questionnaires. One person standing back from the operation and critically observing. Internally or externally conducted safety assessments. Confidential reporting systems. An effective tool for identifying hazards is the job hazard analysis. A job hazard analysis (JHA) is an exercise in safety detective work. The safety manager should provide the following guidance to all operational and technical departments and affected employees in identifying hazards to allow them to better complete a JHA. The goal is to identify hazards by asking: What can go wrong? What are the consequences? How could it arise? How likely is it that the hazard will occur? Documenting the answers to the previous questions in a consistent manner will help identify hazards and implement hazard controls. November 2013 Safety 1 st Page 39

46 A good hazard scenario describes: Where it is happening (environment)? Who or what it is happening to (exposure)? What precipitates the hazard (trigger)? The outcome that would result should it occur (consequence)? Any other contributing factors? Note: Rarely is a hazard a simple case of one singular cause resulting in one singular effect. Often, many contributing factors line up a certain way to create the hazard. Job Hazard Analysis Date: Job Title/Task: Aircraft Fueling Department: Line Service JHA No.: Line Service 1 Personal Protective Equipment: Vest, Eye & Hearing Protection, Gloves Basic Job Steps Hazards Hazard Control 1. Drive fuel truck to aircraft. 1. Truck unsafe to operate. Audited By / Date: Consequences: Damage to property Injuries Fuel Spill Approved By: 1. Inspect the truck at the start of each shift. 2. Train each driver on inspection procedures. 3. Perform scheduled maintenance/inspections. 4. Remove truck from service if unsafe to use. NOTE: A sample Job Hazard Analysis form can be accessed by clicking here. Alternative Hazard Identification Techniques One example of a system to proactively identify hazards is to establish groups to identify safety hazards by the following steps: November 2013 Safety 1 st Page 40

47 Identify potential operational hazards that could threaten the safety of employees, customers, passengers, company facilities, company assets, or customer property Rank the severity of the hazards Identify current defenses Evaluate the effectiveness of each defense Identify additional defenses. Assess the Hazards The next step in the process is to critically assess the hazards and rank risks. Factors to consider are: the likelihood of the occurrence and the severity of the consequences. For example, an in-flight fire might be a rare occurrence, but could be catastrophic. It would rank above a bird strike which, although much more likely to occur, is normally less severe. There are various ways of conducting this assessment. Further information is provided in Chapter 5, Safety Risk Management. Identify the Defenses Once the hazards are identified and their risks approximately ranked, defenses (controls) to protect against the hazards should be identified. Examples include: Ensuring that operating procedures are properly documented and implemented. For example, a defense against an unoccupied vehicle rolling into an aircraft would be a policy requiring that all vehicles be chocked, with the parking brake set and in park. Implementing automated caution and warning systems. Installing protective guards and shields. Requiring the use of personal protective equipment. Assess the Defenses (Hazard Controls) The appropriateness of hazard controls should be assessed. How effective are the hazard controls? Would they prevent the occurrence (i.e., do they remove the hazard and eliminate or minimize the risk), or do they minimize the likelihood or the consequences? If the controls minimize the hazard and likelihood of occurrence, how effective are they? An example of determining the effectiveness of a hazard control is to ask questions. For example, are employees trained on the use of the fire extinguishers, and are the extinguishers inspected and maintained? November 2013 Safety 1 st Page 41

48 Identify the Need for Hazard Elimination and Avoidance, or for Further Defenses Each hazard and its control should be critically examined to determine whether the risk is appropriately managed or controlled. If the risk is properly managed or controlled, the operation can continue. If not, steps should be taken to either improve the hazard control or to remove/avoid the hazard. For example, the company provides recurrent training for all employees in the correct use of fire extinguishers. In some instances, a range of solutions to a risk may be available. Some are typically engineering solutions (e.g., redesign), which are generally the most effective, but may be expensive. Others involve control (e.g., operating procedures) and personnel (e.g., training) and may be less costly. In practice, a balance needs to be found between the cost and practicality of the various solutions. The safety manager should recommend change or action to top management. Whether or not the recommendation is acted upon needs to be monitored, and a further cycle of risk management performed. System Risks A system is defined as an integrated set of constituent elements that are combined in an operational or support environment to accomplish a specific mission or objective. System elements can include people, hardware, software, procedures, facilities, services, etc. Systems can have extensive human interaction, complicated machines and environmental exposures. Humans must monitor systems (e.g., pilot, aircraft, etc.), and conduct design, maintenance, assembly and installation efforts. The automation can be comprised of extensive hardware, software and firmware. If automation is not appropriately designed, potentially unacceptable system risks or system accidents can result. Environmental considerations can be extreme: harsh climates, noise, radiation, etc. Hazard Prevention In order to prevent hazards, information obtained from a JHA can be used to implement hazard control measures recommended in the analysis for each job. The safety manager should provide recommendations for hazard control to top management for review. Except for hazards requiring immediate attention, top management should provide feedback to the safety manager within five business days after initial receipt of the recommendations. The following is the order of precedence and effectiveness when implementing hazard controls: November 2013 Safety 1 st Page 42

49 Engineering Control Administrative Control Personal Protective Equipment 1. Engineering controls include: Eliminate/minimize the hazard: Design the facility, equipment, or process to remove the hazard, or substitute processes, equipment, materials or other factors to reduce the hazard. Enclose the hazard, such as enclosures for noisy equipment. Isolate the hazard with inter-locks, guards or other means. Remove or redirect the hazard, such as with local and exhaust ventilation/jet blast. 2. Administrative controls include: Documented standard operating procedures and safe work practices. Exposure time limitations. Monitoring the use of hazardous materials. Alarms, signs, whistles, and warnings. Buddy system Training 3. Personal Protective Equipment (PPE) includes items, such as respirators, hearing protection, protective clothing, reflective clothing and safety glasses. These may be acceptable as a control method in the following circumstances: When engineering controls are not feasible or do not totally eliminate the hazard. While engineering controls are being developed. When safe work practices do not provide sufficient additional protection. During emergencies when engineering controls may not be feasible. The use of one hazard control method over another higher in the control precedence may be appropriate for providing interim protection until the hazard is either minimized or eliminated permanently. If the hazard cannot be eliminated entirely, the adopted control measures will likely be a combination of all three items instituted simultaneously. November 2013 Safety 1 st Page 43

50 2. NON-PUNITIVE HAZARD REPORTING History has shown that successful companies in safety-critical industries have implemented an SMS to produce significant and permanent improvements in safety. Your company recognizes that, to ensure safety awareness remains constant, the safety culture must encourage openness and trust between management and employees. Everyone should feel free to report incidents and events without the fear of retribution. Reporting situations, events and practices that compromise safety should be a priority for all employees. A near miss that goes unreported due to the fear of retribution could lead to a serious accident. For your SMS to be effective, the organization must have a positive safety culture. Maintaining the safety of flight, ground, and maintenance operations are your company s most important commitment. To ensure that commitment, it s imperative that you have uninhibited reporting of all incidents and occurrences that compromise the safety of your operations. Each employee should accept the responsibility to communicate any information that may affect the integrity of company safety. Employees must be assured that this communication will never result in reprisal, thus allowing a timely, uninhibited flow of information to occur. All employees should be advised that your company will not initiate disciplinary actions against an employee who discloses an incident or occurrence involving safety. This policy cannot apply to criminal or willful infractions. (A sample nonpunitive reporting policy can be accessed by clicking here.) The Hazard Reporting Form should be used by all employees for reporting information concerning company safety. The forms are designed to protect the identity of the employee providing the information, and should be readily available in all work areas. All employees should be encouraged to use this program to help your company provide your customers and employees with the highest level of safety. The Hazard Reporting Form can be accessed by clicking here. Hazard Report Processing Procedures All hazard reports should be forwarded to the safety manager for initial processing. November 2013 Safety 1 st Page 44

51 The safety manager should notify the individual submitting the report, usually by , and inform them that the report was received. The safety manager should enter the report information into a confidential database. After reviewing the report, the safety manager should task the responsible department(s) to address the issue(s) identified, usually within 15 days. (This can be accomplished either by a corrective action to correct the issue, or by a corrective action plan with a timeline on when the issue will be corrected.) Depending on the nature of the problem, and with the approval of top management, more time can be allotted. If a corrective action plan is provided, and the issues are not time critical, the follow-up date can be adjusted to reflect the completion date of the corrective action plan. The safety manager should enter the report information into its tracking system and: Track the report as open. The safety manager monitors the progress of the report to ensure the report is answered in the time allotted. Enter all corrective actions in the tracking system and close the report. Notify the report submitter of the report status if the follow-up date is changed and of the corrective action taken when the report is closed. 3. ACCIDENT / INCIDENT REPORTING All accidents and incidents involving any employee or asset should be immediately reported to the safety manager or designated senior manager. The safety manager or designated senior manager should be reachable on a 24-hour basis via an emergency communication listing provided by your company. A written account of the accident or incident should be submitted as soon as possible, normally within 24 hours after the occurrence. To officially report an accident as required by Part 830 of the National Transportation Safety Board s Regulations, NTSB Form , Pilot/Operator Aircraft Accident Report should be completed and can be accessed by clicking here. A plain document can be used if the recommended form is not available. All reports should be faxed or ed to the appropriate personnel within your organization. November 2013 Safety 1 st Page 45

52 The appropriate supervisor/manager should forward the report to the safety manager and all other applicable departments. Pictures and witness statements should be taken immediately, if possible. To the extent possible, the following information should be included in the initial report of an accident or incident, as applicable: Description of the occurrence (include weather conditions, etc.) Time of occurrence Location of the occurrence Number of persons involved Number and description of injuries (all persons) If an aircraft is involved: a. Type, nationality, and registration of the aircraft; b. Name of the owner, and operator of the aircraft; c. Name of the Pilot in Command; d. Date and time of the accident; e. Last point of departure and point of intended landing of the aircraft; f. Position of the aircraft with reference to some easily defined geographical point; g. Number of persons onboard, number fatally injured, and number seriously injured; h. Nature of the accident, the weather and the extent of damage to the aircraft, so far as is known; i. A description of any explosives, radioactive materials, or other dangerous articles carried. Other property or equipment damage Description of hazardous material/restricted articles that may be involved Employee names and names of others involved Description of actions taken to secure damaged equipment and cargo Details of any investigation performed by the airport authority, or other agency Name and phone number of the person reporting the occurrence Name and phone number of witnesses November 2013 Safety 1 st Page 46

53 Name of hospital and doctors treating the injured Accident/Incident Investigation Process All accident/incident and injury reports should be submitted to the safety manager. This should be accomplished within 24 hours of the occurrence. The safety manager, based on the severity of the accident/incident and all other factors will determine the appropriate category of accident/incident (i.e., hangar, ramp, equipment, etc.) in order to facilitate the data collection process. Safety 1 st provides two reporting forms that can be used by your company: an Air Safety Report that can be accessed by clicking here, and a Ground Event Reporting Form that can be accessed by clicking here. Upon receipt of report conclusions, the safety manager will report to the safety committee, which will recommend corrective action(s) and the safety manager will monitor the corrective action plan. The safety manager will notify the individual that originally submitted the report of the corrective action taken in response to the report. If there is any doubt, a report should be filed for any of the following: Inadvertent violation of FARs, company policies and/or procedures. System defect occurs that adversely affects the handling characteristics of ground support equipment or aircraft and renders it unfit for the intended use An emergency is declared Safety equipment or procedures are defective or inadequate Deficiencies exist in operating procedures, manuals or instructions Incorrect loading of fuel, cargo or dangerous goods Ground damage occurs A runway or taxiway excursion/incursion occurs Significant handling difficulties are experienced Communications fail or are impaired Serious loss of braking, aircraft or ground equipment Any part of an aircraft or ground equipment is sabotaged or vandalized Security procedures are breached Foreign Object Damage (FOD) occurs November 2013 Safety 1 st Page 47

54 A co-worker improperly performs their job or puts personnel and/or equipment at risk Equipment abuse Any other event considered to have serious safety implications The aim is to reveal problems and shortcomings that could lead to accidents. Typically such shortcomings can be inadequate equipment or procedures, lack of effective training, or the use of inappropriate materials. The outcome should be action to reduce and control risks. 4. INVESTIGATION ACCIDENT / INCIDENT INVESTIGATION PROCESS If an event or occurrence is determined to be an accident (see definitions section), the procedures listed in the Accident/Incident Investigation Process (Appendix D) and/or your company procedures should be followed. Incident investigations are to be initially performed by the safety manager as soon as possible after an occurrence classified as an incident or accident. The location and details of an occurrence should be carefully analyzed, and all witnesses interviewed, to identify potential contributing factors. This must be accomplished as soon as possible so that corrective measures can be quickly implemented to prevent similar situations from reoccurring. The safety manager should investigate all employee incidents and file an accident/incident or injury report to top management that specifies the corrective action(s) or interim measures taken to prevent a recurrence. If recommendations are included with the report, top management or the safety manager should consider immediate action on those recommendations. When applicable, the safety manager should perform a root cause analysis. A Root Cause Tutorial can be viewed by clicking here. Applicable occurrences resulting in lost time must also be reported to the Human Resources Department who will, in turn, report the occurrence to the Department of Labor (DOL) on the applicable DOL form. Any accident resulting in the death of a worker must be reported immediately to the Human Resources and Safety Departments. Safety 1 st has provided an Accident Investigation Process guide that can be accessed by clicking here. November 2013 Safety 1 st Page 48

55 5. SAFETY COMMITTEE The safety committee should meet at least quarterly, and should accomplish the following: Review status of current accidents and incidents and corrective action(s) Review status of hazard reports and corrective action(s) Review safety audit reports and corrective action(s) Review and resolution of any safety matters brought before the committee. Duties and Responsibilities The safety committee serves as liaison between all company employees and top management. The safety committee approves, rejects or recommends action on any safety related matter brought before them. The safety committee chair signs the meeting minutes, thereby allowing the minutes to be implemented. The safety committee monitors the company s safety training and awareness programs. It is recommended that the CEO or a designated manager serve as chair of the safety committee. The chair will appoint the committee membership. The safety manager will serve as recorder and will prepare meeting agendas and minutes. Safety Committee Management Safety committee management is a function of the safety manager. The following outlines safety committee management protocols: Safety committee meeting schedules should be provided to membership at least one week prior to meeting. The safety committee meeting agenda should be developed and completed prior to publishing meeting schedules. The safety committee meeting agenda should be distributed to each member in conjunction with the meeting schedule. Every effort should be made to resolve each agenda item. After the conclusion of the safety meeting, a draft of the meeting minutes should be prepared and distributed to attendees with a request for revisions, additions or clarifications. November 2013 Safety 1 st Page 49

56 Final safety committee meeting minutes should be signed by the committee chair. The final meeting minutes should then be distributed to all committee members for implementation. Follow up on any open item(s) to ensure corrective actions are in compliance with the action(s) required and within the time period allotted. Safety Committee Chair Responsibilities The following describes the safety committee chair s responsibilities: Obtain group consensus on all issues discussed. Ensure adherence to meeting schedule. Dispute resolution and control of the committee. Safety committee records should be maintained by the safety manager. Agendas and minutes should be retained for a minimum of two years or as prescribed by your company s document retention policy. Participant Advisory: Especially in small companies where the Safety Manager position is out of necessity an additional duty, it may be advisable to enlist the aid of one or more other employees to assist in the generation and dissemination of Safety Communications. 6. SAFETY COMMUNICATIONS Safety communications should heighten safety awareness among all employees. They include the following: 1. The safety manager should distribute, at a minimum, company safety updates to all operational personnel. The updates should include, but not be limited to, the following topics: a. Safety 1 st information b. NATA and NATA Safety 1 st newsletters c. Safety Committee meeting highlights d. Company memos from top management addressing safety e. Incidents and lessons learned f. Workers Compensation data g. Airport provided safety alerts and information h. Industry specific information i. OEM/equipment manufacturer recommendations November 2013 Safety 1 st Page 50

57 j. Other safety-related trends as may be provided by your insurance company or insurance broker k. FAA recommendations, ASRS Callback, FOQA Program (if applicable) l. Company originating Safety Alerts (items reported by fellow employees) m. Other safety related trends as may be provided by your insurance company or broker. 2. The frequency of communication is crucial to keeping safety fresh and on the minds of all employees. Monthly safety communications, where the safety manager supplies the above information to all employees, regardless of shift or location is recommended. You can also stagger your communications to be distributed on a monthly and a quarterly basis. It s important to a constant flow of communication, and to focus on the critical issues. Note: Safety newsletters become ineffective when they fail to focus on the big topics. Yes, you can mention the employee barbeque, however; keep safety as the main theme. Directing safety communications only to specific personnel prevents you from taking advantage of the multiple sets of eyes you have available. All employees should get the message. They could have additional ideas to share on how to solve problems. Take advantage of all of the resources you have available. 3. The safety manager should also maintain a safety page on the company website or on the company s safety bulletin board that lists pertinent safetyrelated information. EMPLOYEE MANAGEMENT INTERNAL COMMUNICATION Employees are encouraged to express their concerns or ideas to the safety manager. Concerns or ideas can be submitted either verbally or in writing. November 2013 Safety 1 st Page 51

58 However, having the ideas documented creates a record that can be tracked and filed. A verbal comment can lose its impact in translation over time. Written correspondence should include employee names and contact information in the event additional information is required and/or to provide feedback. o Feedback is important, as the employees will provide suggestions willingly if they know that they are being taken seriously and that their input matters to top management. Provide frequent feedback to the employee on the progress of the idea or suggestion. Be truthful: if the idea or suggestion won t work, provide an explanation. They ll appreciate being in the loop. Employee generated concerns or suggestions should be shared with appropriate technical departments. November 2013 Safety 1 st Page 52

59 CHAPTER 4: ACCIDENT PREVENTION PROGRAM & ROOT CAUSE ANALYSIS Contents: 1. Accident Prevention Program 2. Safety Data Management 3. Root Cause Analysis November 2013 Safety 1 st Page 53

60 1. ACCIDENT PREVENTION PROGRAM GENERAL The accident prevention program is intended to minimize the accident threat to employees, aircraft, and equipment. This program takes an integrated view of all functions to provide people with a safe and productive environment for the accomplishment of required tasks. It provides for the reporting of unsafe conditions and practices that could result in personal injury or equipment damage. It requires the thorough investigation and resolution of reported or observed conditions that are considered to be a threat to personnel or property. Accident prevention involves every facet of your company s operations and management. Ground personnel should be observant of every phase of line operations and, if they believe unsafe or emergency conditions could arise for which there are no established procedures, they are encouraged to submit a hazard report. The following list of responsibilities provide for rapid communication and resolution of safety matters. The safety manager will: Act as the focal point for all reports, audits, accident prevention matters, and accident/incident reporting/investigation. Coordinate directly with other departments to develop recommendations for interdepartmental safety matters. Investigate accidents and incidents involving flight and ground operations, and develop recommendations to eliminate any identified hazards. Act as liaison with outside agencies concerning accident prevention and investigation. Maintain an active safety training program and have all employees participate in the SMS training. Compile accident and incident data to determine trends requiring preventive actions and provide feedback within flight and ground operations on accident and incident investigations. Conduct audits to determine accident potential involving flight and ground operations personnel, procedures, and equipment and make appropriate recommendations to top management. November 2013 Safety 1 st Page 54

61 2. SAFETY DATA MANAGEMENT SAFETY DATABASE All safety data collected by the safety manager should be entered into a company database for tracking, analysis and trending. 3. ROOT CAUSE ANALYSIS BENEFITS Root Cause Analysis is utilized to eliminate the most basic reason for an undesirable condition or problem. The root cause analysis process is useful because it helps in getting to the real causal factors that lead to an adverse event or undesirable outcome, and provides insight into how an organization can proactively minimize future risks. Root cause analysis can: Identify barriers and the causes of problems, so that permanent solutions can be found. Develop a logical, systematic approach to problem solving. Assist in solving problems with data that already exists. Identify organizational improvement opportunities. Establish repeatable, step-by-step processes, in which one process can confirm the results of another. Root cause analysis focuses on systems and processes, not on people or individual performance, because if a process is broken or needs improvement, then the problem will recur again and again. Ultimately, root cause analysis is about prevention; discovering the root causes of problems so that steps can be taken to prevent a recurrence. Root cause analysis is a valuable tool to evaluate causal factors after an undesirable event. The information can be used to identify problematic areas and to be proactive in preventing a recurrence. This approach enables you to prevent problems before they occur. A tutorial on root cause analysis can be accessed here. This can be used to augment your local investigation and analysis. November 2013 Safety 1 st Page 55

62 CHAPTER 5: SAFETY RISK MANAGEMENT Contents: The Safety Risk Management Process November 2013 Safety 1 st Page 56

63 THE SAFETY RISK MANAGEMENT PROCESS General This section discusses the principles of safety risk management (SRM) and the SRM process. All incidents that could have resulted in an accident should be reported to determine relevant factors and to implement preventive action. SRM is a decision-making tool to systematically identify operational risks and benefits, and determine the best courses of action for any given situation, e.g., performing a risk analysis before every flight. The risk management process is designed to minimize risks in order to prevent accidents, preserve assets, and safeguard the health and welfare of people. Risk management, as discussed throughout this guide is proactive. We manage risk whenever we modify the way we do something to make our chances of success as great as possible, while minimizing the likelihood of failure, injury or loss. It s a commonsense approach to balancing the risks against the benefits to be gained in a situation, then choosing the most effective course of action. Often, the approach to risk management is highly dependent on individual methods and experience levels and is usually highly reactive. It s natural to focus on those hazards that have caused problems in the past. Risk is defined as the probability and severity of an accident or loss from exposure to various hazards, including injury to people and loss of resources. All aviation operations involve risk, and require decisions that include risk assessment and risk management. Safety Risk Management (SRM) is a formal way of thinking about these things. SRM is a six-step process, which identifies operational hazards and takes reasonable measures to reduce risk to personnel, equipment and the mission. Risk management must be a fully integrated part of planning and executing any operation, routinely applied by management, and not a way of reacting when some unforeseen problem occurs. Careful determination of risks, along with analysis and control of the hazards they create results in a plan of action that anticipates November 2013 Safety 1 st Page 57

64 difficulties that could arise under varying conditions, and pre-determines ways of dealing with these difficulties. Managers are responsible for the routine use of risk management at every level of activity, starting with the planning of that activity and continuing through its completion. Figure 5-1 (below) lists the objectives of the SRM process: protecting people, equipment and other resources, while making the most effective use of them. Preventing accidents, and in turn reducing losses, is an important aspect of meeting this objective. In turn, by minimizing the risk of injury and loss, we ultimately reduce costs and stay on schedule. Thus, the fundamental goal of risk management is to enhance the effectiveness of people and equipment by determining how they are most efficiently to be used. Figure 5-1. Objectives of the SRM process include protecting people, equipment and other resources, while making the most effective use of them. SRM Principles Four principles govern all actions associated with safety risk management. These continuously employed principles are applicable before, during and after all tasks and operations, by individuals at all levels of responsibility. November 2013 Safety 1 st Page 58

65 1. Accept No Unnecessary Risk Unnecessary risk is that which carries no commensurate return in terms of benefits or opportunities. Everything involves risk. The most logical choices for accomplishing an operation are those that meet all requirements with the minimum acceptable risk. The corollary to this is accept necessary risk, required to successfully complete the operation or task. 2. Make Risk Decisions at the Appropriate Level Anyone can make a risk decision. However, the appropriate decision-maker is the person who can allocate the resources to reduce or eliminate the risk and implement controls. The decision-maker must be authorized to accept levels of risk typical of the planned operation (i.e., loss of operational effectiveness, normal wear and tear on material). Decisions should be elevated to the next level in the management chain when the available controls will not reduce risk to an acceptable level. 3. Accept Risk When Benefits Outweigh the Costs All identified benefits should be compared against all identified costs. Even high-risk endeavors may be undertaken when there is clear knowledge that the sum of the benefits exceeds the sum of the costs. Balancing costs and benefits is a subjective process, and ultimately the balance may have to be arbitrarily determined by the appropriate decision-maker. 4. Integrate SRM into Planning at all Levels Risks are more easily assessed and managed in the planning stages of an operation. The later changes are made in the process of planning and executing an operation, the more expensive and time-consuming they will become. When applying the SRM process, risk management is a proactive activity that quantitatively assesses identified hazards and assists in selecting actions to maintain an appropriate level of safety when faced with these hazards. Six Steps for SRM Step 1: Identify the Hazard A hazard is defined as any real or potential condition that can cause injury, illness, or death; damage to or loss of a system, equipment or property; or damage to the environment. Experience, common sense, and specific analytical tools help identify risks. (A sample risk management workshop can be accessed by clicking here.) Step 2: Assess the Risk November 2013 Safety 1 st Page 59

66 The assessment step is the application of quantitative and qualitative measures to determine the level of risk associated with specific hazards. This process defines the probability and severity of an accident that could result from the hazards based upon the exposure of humans or assets to the hazards. Step 3: Analyze Risk Control Measures Investigate specific strategies and tools that reduce, mitigate, or eliminate the risk. All risks have three components: probability of occurrence, severity of the hazard, and the exposure of people and equipment to the risk. Effective control measures reduce or eliminate at least one of these. The analysis must take into account the overall costs and benefits of remedial actions, providing alternative choices if possible. Step 4: Make Control Decisions Identify the appropriate decision-maker. That decision-maker must choose the best control or combination of controls, based on the analysis of step 3. Step 5: Implement Risk Controls Management must formulate a plan for applying the controls that have been selected, then provide the time, materials and personnel needed to put these measures in place. Step 6: Supervise and Review Once controls are in place, the process must be periodically reevaluated to ensure their effectiveness. Workers and managers at every level must fulfill their respective roles to assure that the controls are maintained over time. The risk management process continues throughout the life cycle of the system, mission or activity. Implementing the SRM Process To derive maximum benefit from this process, it must be used properly. The following principles are essential. Apply the steps in sequence Each step is a building block for the next, and must be completed before proceeding to the next. If a hazard identification step is interrupted to focus upon the control of a November 2013 Safety 1 st Page 60

67 particular hazard, other, more important hazards may be overlooked. Until all hazards are identified, the remainder of the process is not effective. Maintain a balance in the process All six steps are important. Allocate the time and resources to perform them all. Apply the process in a cycle The supervise and review step should include a fresh look at the operation being analyzed, to see whether new hazards can be identified. Involve people in the process Ensure that the risk controls are mission supportive, and that the people who do the work see them as positive actions. The people who are actually exposed to risks usually know best what works and what does not. Risk versus Benefit Risk management is the logical process of weighing the potential costs of risks against the possible benefits of allowing those risks to stand uncontrolled. Types of Risk Defined Identified risk: That risk that has been determined to exist using analytical tools. The time and costs of analysis efforts, the quality of the risk management program, and the state of the technology involved affect the amount of risk that can be identified. Unidentified risk: That risk that has not yet been identified. Some risk is not identifiable or measurable, but is no less important for that. Mishap investigations may reveal some previously unidentified risks. Total risk: The sum of identified and unidentified risk. Ideally, identified risk will comprise the larger proportion of the two. Acceptable risk: The part of identified risk that is allowed to persist after controls are applied. Risk can be determined acceptable when further efforts to reduce it would cause degradation of the probability of success of the operation, or when a point of diminishing returns has been reached. November 2013 Safety 1 st Page 61

68 Unacceptable risk: That portion of identified risk that cannot be tolerated, but must be either eliminated or controlled. Residual risk: The portion of total risk that remains after management efforts have been employed. Residual risk comprises acceptable risk and unidentified risk. Risk Identification Once hazards have been identified, either through occurrence/hazard reporting, or a safety assessment, the risk management process begins. Risk management is a quantitative evaluation of the potential for injury or loss due to a hazard and the management of that probability. This concept includes both the probability of a loss and its severity. The basic elements of a risk management process are: Risk Analysis Risk Assessment Risk Control Monitoring Risk Analysis is the first element in the risk management process. It includes risk identification and risk estimation. Once a hazard has been identified the risks associated with the hazard must be determined and the amount of risk estimated. Risk Assessment takes the work completed during the risk analysis and goes one step further by conducting a risk evaluation. Here, the probability and severity of the hazard are assessed to determine the approximate level of risk. The risk assessment matrix (Figure 5-2) provides a method to determine the level of risk. November 2013 Safety 1 st Page 62