United Kingdom Overseas Territories Aviation Circular Safety Management Systems See also the OTAC 'Documenting the SMS' OTAC 119-3 125-1 139-2 140-2 145-7 171-2 172-4 173-2 176-3 Issue 3 24 June 2009 Effective: on issue GENERAL Overseas Territories Aviation Circulars are issued to provide advice, guidance and information on standards, practices and procedures necessary to support Overseas Territory Aviation Requirements. They are not in themselves law but may amplify a provision of the Air Navigation (Overseas Territories) Order or provide practical guidance on meeting a requirement contained in the Overseas Territories Aviation Requirements. PURPOSE This OTAC describes the overall concept for the implementation of Safety Management Systems (SMS) in the Territories. It applies to all those parts of the aviation industry such as aircraft operators, maintenance organisations, ATS providers and aerodrome operators required to implement SMS. RELATED REQUIREMENTS This Circular relates to all OTAR Parts which require the establishment and use of a safety management system. The OTAC Documenting the SMS gives useful advice on ways to implement the systems described in this Circular. Other OTACs may provide additional guidance relating to the type of operation. CHANGE INFORMATION This issue adopts ICAO terminology in relation to safety performance. ENQUIRIES Enquiries regarding the content of this Circular should be addressed to Manager PQS, Air Safety Support International at the address on the ASSI website www.airsafety.aero, to the appropriate Overseas Territory Aviation Authority or to any office of ASSI. OTAC s/n 046
CONTENTS 1 DEFINITIONS... 3 2 BACKGROUND... 3 3 IT MAKES GOOD SENSE... 3 4 THE REQUIREMENTS IN THE OTARS... 4 5 WHAT DO THE REQUIREMENTS MEAN?... 5 6 HOW SHOULD WE GO ABOUT IMPLEMENTING SMS?... 8 7 SAFETY CULTURE IS ESSENTIAL... 9 8 FURTHER ADVICE AND GUIDANCE... 10 APPENDIX A COMPONENTS OF A SAFETY MANAGEMENT SYSTEM... 11 OTAC s/n 046 Issue 3 Page 2 of 12
1 Definitions The following definitions are reproduced from OTAR Part 1 for ease of reference: Quality assurance means all those planned and systematic actions necessary to provide adequate confidence that a system, component, or facility will perform satisfactorily in service. Safety management system (SMS) means a systematic approach to managing safety, including the necessary organizational structures, accountabilities, policies and procedures. 2 Background 2.1 Aviation safety has traditionally focused on compliance with regulatory requirements and reacted to undesirable events by prescribing measures to prevent recurrence. A different approach is needed to keep safety risks at an acceptable level as the industry continues to develop. Safety management systems are designed to complement regulatory compliance by the proactive use of best practices. 2.2 ICAO has published Standards in several of the Annexes to the Chicago Convention requiring States to place requirements on operators and service providers to implement SMS. 2.3 The ICAO Standards stipulate: (a) (b) that the SMS must clearly define lines of safety accountability throughout the organisation, including a direct accountability for safety on the part of senior management; and the functions that the SMS is expected to achieve. 3 It makes good sense 3.1 Using SMS is simply adopting a businesslike approach to safety, similar to the way that finances are managed. Unless a company experiences a loss, or critically assesses both the direct and indirect costs of an occurrence, the full implications are unlikely to be appreciated. The direct costs are usually easy to quantify, they include damage to the aircraft, compensation for injuries and damage to property and are usually settled through an insurance claim. 3.2 The indirect costs are more difficult to assess, these are often not covered or fully reimbursed by the company s insurance and the impact is often delayed. This includes items such as: loss of business and reputation legal fees and damage claims medical costs not covered by worker s compensation cost of lost use of equipment (loss of income) time lost by injured person(s) and cost of replacement workers increased insurance premiums aircraft recovery and clean-up fines OTAC s/n 046 Issue 3 Page 3 of 12
3.3 Use of an SMS has clear business benefits: stability, safety and customer support customers are aware some operations are safer than others possible reduction in insurance premiums through demonstration of control of safety risks good work/life balance practices, for example adjustment of rosters to avoid most tiring shift/sector will give safety benefits, and can also improve staff/crew morale - potentially lowering staff turnover and reducing training costs a proactive approach to safety can be demonstrated with documented evidence in the event of an incident or accident. 3.4 The cost of implementing and maintaining SMS becomes less significant and well worth the investment when contrasted with the cost of doing nothing. It makes sound business - as well as safety - sense. 4 The requirements in the OTARs 4.1 For ease of interpretation, a common format has been adopted in the various OTAR parts, e.g. for aerodromes, air traffic services and the operation and maintenance of aircraft. However, it must be emphasised that the SMS will need to be designed to meet the specific needs of the individual organisation. 4.2 The ICAO Standards have been incorporated into the various OTAR Parts as follows: (a) Each <applicant for/holder of a certificate/approval> shall establish a safety management system appropriate to the size and complexity of the operation, for the proactive management of safety, that integrates the management of operations and technical systems with financial and human resource management, and that reflects quality assurance principles. (b) The safety management system shall include policy and objectives for continuous improvement to the organisation s overall safety performance. (c) The safety management system shall clearly define lines of safety accountability throughout the operator's organisation, including a direct accountability for safety on the part of senior management. (d) The safety management system shall include, as a minimum, the following: (1) processes to identify actual and potential safety hazards and assess the associated risks; and (2) processes to develop and implement remedial action necessary to maintain agreed safety performance; and (3) provision for continuous monitoring and regular assessment of the safety performance; and (4) recurring processes for continuous improvement of the performance of the safety management system; and OTAC s/n 046 Issue 3 Page 4 of 12
(5) quality assurance processes to: (i) (ii) (iii) identify applicable requirements, regulations and standards and demonstrate compliance with them; ensure technical manuals, checklists and other documentation are appropriately maintained and incorporate the latest amendments; and ensure that training programmes maintain staff proficiency and competency. (e) The safety management system shall be described in relevant documentation, and shall be acceptable to the Governor. 5 What do the requirements mean? The following paragraphs give some suggestions in italics to explain what the requirements mean in real terms, with the smaller company very much in mind. Larger, more complex organisations may also find this a useful starting point. Note: There are pointers to additional guidance of at the end of this OTAC. (a) Each <applicant for/holder of a certificate/approval> shall establish a safety management system appropriate to the size and complexity of the operation, for the proactive management of safety, that integrates the management of operations and technical systems with financial and human resource management, and that reflects quality assurance principles. Safety management system is defined in paragraph 1. To be effective, the SMS must be tailored to suit the type of operation. The objective is to weave SMS into the fabric of the organisation - to fully integrate SMS into its management methods. This includes a commitment to provide the necessary resources. When putting the SMS in place, it must be customised so that it suits the organisation. Each of the following components is necessary in some way, regardless of the size or type of operation. It is the extent or detail of the component that needs to be tailored to the operation. At the same time, the application of quality assurance principles is essential to ensure that the SMS is used and maintained effectively. (b) The safety management system shall include policy and objectives for continuous improvement to the organisation s overall safety performance. There needs to be a clear statement of the organisation's policy, management principles and intentions, for a continuous process of improvement to the safety performance. Objectives for improvement should be stated meaningfully - and this implies an element of safety performance measurement. Accident rates are not an effective measurement of safety, for in reality there will always be latent unsafe conditions within the system that might, if left unattended, lead to an accident. For example, an assessment of the improvements made to work/operating procedures might be far more effective than considering accident rates. OTAC s/n 046 Issue 3 Page 5 of 12
Note: The designated regulator will, in the context of SMS evaluations, consider the acceptability of the safety objectives and activities set by the regulated organisation, including the degree of measurability that has been provided (safety performance indicators and safety performance targets), and thereby agree the acceptable level of safety performance. (c) The safety management system shall clearly define lines of safety accountability throughout the operator's organisation, including a direct accountability for safety on the part of senior management. The organisation should document and define the roles and responsibilities of all personnel in the SMS, and ensure that all personnel are aware of their responsibilities. Furthermore, it should be clearly stated that everyone has a responsibility for safety. The responsibility for implementing and managing the components of an SMS will normally be given to the nominated postholders for specific parts of a larger organisation, for example the Operations Manager, Maintenance Manager etc. That person will in turn be held accountable to show that he or she has made a reasonable effort to implement SMS. The SMS will not function effectively unless there is management buy-in and leadership. Accountable managers and nominated postholders should take a leading role in involving employees and developing an active safety culture within their organisation. The Chief Executive and/or Accountable Manager of the organisation need to send a clear signal in writing to all its personnel, stating that this is the way they want the operation to function. Staff need to know that they can count on management to support their safety initiatives. (d) The safety management system shall include, as a minimum, the following: (1) processes to identify actual and potential safety hazards and assess the associated risks; This means there is a need to have some formalized processes for proactive and reactive identification of hazards, risk assessment, and the mitigation of risks. Note: A 'hazard' is any situation or condition that has the potential to cause damage or injury. 'Risks' are the potential adverse consequences of a hazard, and are assessed in terms of their severity and likelihood. 'Proactive' in this context means actively seeking out safety hazards; and conducting safety assessments: initially; at regular intervals; and whenever changes are planned. OTAC s/n 046 Issue 3 Page 6 of 12
A safety reporting scheme is needed, to collate information and identify hazards from unsafe condition/error reports and accident and incident reports, and to ensure that the occurrence reporting requirements of OTAR Part 13 are met. Confidence in communicating safety concerns without fear of blame is vital to success in this area, and can only be developed by example. Some operators communicate their non-punitive disciplinary policy to staff by having it printed on the hazard reporting forms. It must be praiseworthy to report if something is not working properly. When hazards are identified, risk assessment can be approached in a variety of ways, including risk analysis matrices and "safety risk profiling". It is important to choose a method that suits the particular operation. (2) a process to develop and implement remedial action necessary to maintain agreed safety performance; and Mitigation is then needed: either to eradicate the hazard, or to reduce the severity or likelihood of the risks. Equally, there is a need to have processes to ensure implementation of the methods chosen to mitigate risks; i.e. closing the loop - communication and feedback to staff, and ensuring that manuals and instructions are kept up-todate. (3) provision for continuous monitoring and regular assessment of the safety performance; and The organisation needs to define its processes for monitoring and evaluation to ensure that: remedial actions have been implemented as planned; mitigation is effective; and the SMS remains effective and relevant to the operation. (4) recurring processes for continuous improvement of the performance of the safety management system; and Once or twice a year should work well provided this is done thoroughly. To be effective this will encompass all parts of the operation to identify strengths, weaknesses and areas of risk, and will follow a carefully prepared checklist. A written report should be provided to the Accountable Manager, which will provide the information needed for a management review. (5) quality assurance processes to: (i) identify applicable requirements, regulations and standards and demonstrate compliance with them; OTAC s/n 046 Issue 3 Page 7 of 12
(ii) ensure technical manuals, checklists and other documentation are appropriately maintained and incorporate the latest amendments; and (iii) ensure that training programmes maintain staff proficiency and competency. The operation of the SMS should reflect the application of quality assurance principles throughout. In an established organisation these methods should already be in use. (e) The safety management system shall be described in relevant documentation, and shall be acceptable to the Governor. The SMS needs to be documented to ensure traceability, standardisation and communication, and if necessary to enable co-ordination with external service providers and contactors. The policies and procedures relating to the SMS will typically be expressed as a component of existing manuals (e.g. the Aerodrome Manual, Unit Manual of Air Traffic Services, Operations Manual, Maintenance Control Manual etc.) but may be contained in a separate SMS manual if the company prefers. In any case, detailed local procedures in other documents can be cross-referenced, so the SMS manual is likely to be thin. The documentation must include a description of each component of the system and should clearly describe the interrelationships between each of these components. This is essential if company personnel, and the regulator, are to understand how the whole system is integrated. The organisation must have a process for documenting the regulations, standards and exemptions by which it is regulated for the various activities it conducts. To be acceptable to the Governor, the SMS documentation will also include: training provisions for all staff, including SMS training; and an emergency response plan. 6 How should we go about implementing SMS? 6.1 Management commitment and company policy are needed from the beginning. Once managers have a good understanding of the required components for an SMS it is possible to make an outline plan for its development. 6.2 Whilst it is essential that top management commit to doing whatever it takes to improve safety, it is equally important that all employees feel they have a system that values their input and is responsive to their contributions and ideas. In order to achieve this, all employees should have the opportunity to contribute to the development and implementation of the SMS. 6.3 To start with, find out what components and elements are already in place, and identify the parts that are missing. This is called "Gap Analysis" and is an excellent way to identify the areas that will need to be addressed. In an established organisation it is likely that the majority of the functions needed for SMS will already be in use. A summary of SMS components is provided in Appendix A. OTAC s/n 046 Issue 3 Page 8 of 12
6.4 The following steps are suggested: (a) (b) Identify the existing safety and documents systems that are already in use. It may help to record these in the form of a table, and support this with any necessary description. Ensure that the Accountable Manager, or equivalent position, has been appropriately designated (see separate OTAC). (c) Develop and publish the company policy in relation to SMS (see paragraph 5.1(b) above). (d) Document the company's plan for communicating and implementing this policy, i.e. for developing any required components, identifying who will do what, and timescales; including: Liaison with the relevant Overseas Territory Aviation Authority - if an exemption is needed to allow time for compliance, the OTAA will need to see that a realistic implementation plan is in place. Consider writing a concise SMS manual, using cross-references to existing procedures, as appropriate. Identify and record the safety performance measures that will be used. Plan training so that all staff will be able to understand and operate the SMS, so that it will work effectively. Plan for the SMS to be audited. 6.5 Although the steps are very logical and simple to follow, they can be fairly time consuming and manpower intensive. It may be that having looked at what must be done a company or organisation will feel that it needs some outside help. While this could be helpful, the choice of the source of assistance must be made very carefully. It is no use buying a system off the shelf and then trying either to modify the system to suit company practice or, worse still, trying to modify company practice to suit the system. 6.6 The aim of any organisation in documenting their SMS should be to write what you do and do what you write, and no more. Only those tasks or actions and associated documentation which are required to make the SMS effective should be added. 7 Safety culture is essential 7.1 An active safety culture can be considered as the heart that is vital to the continuing success of an SMS - it gives the dynamic energy needed to ensure that the system will provide a continuous cycle of improvement as intended. This can only be developed by leadership, commitment and setting a good example. 7.2 Accountable managers and nominated postholders should take a leading role in developing an active safety culture within their organisation, so that SMS becomes an integral part of the management and work practices of the organization - the way we do things round here. OTAC s/n 046 Issue 3 Page 9 of 12
7.3 Senior management commitment is crucial and this needs to be demonstrated on a regular basis. 8 Further advice and guidance 8.1 This OTAC is one of two on the subject of SMS. See also 'Documenting the SMS' for suggestions about manuals, and examples of policy statements, objectives, forms and methods to consider. 8.2 There are many excellent websites providing a wealth of information about SMS. Here are a few: http://www.tc.gc.ca/civilaviation/maintenance/sms/menu.htm http://www.casa.gov.au/sms/index.htm http://www.ibac.org/is-bao/isbao.htm http://www.caa.co.uk/ OTAC s/n 046 Issue 3 Page 10 of 12
Appendix A Components of a Safety Management System The following list summarises the main elements needed for an SMS to be developed where required under the Overseas Territories Aviation Requirements (OTARs). 1 Safety policy A clear statement of the organisation's policy, management principles and intentions, for a continuous process of improvement to the safety performance. 2 Objectives for improvement Planning the safety objectives, and choosing effective methods for safety performance measurement. 3 Roles and responsibilities Defined in writing for all personnel; and a process for ensuring that everyone is aware of their responsibilities. 4 Identification of hazards Proactive - an initial hazard identification process; a safety reporting scheme; and safety assessments conducted at regular intervals, and whenever changes are planned. Reactive - collating information from unsafe condition/error reports and accident and incident reports, and ensuring that the requirements of OTAR Part 13 are met. 5 Risk assessment and mitigation A method for the analysis of risks, and deciding how these will be mitigated; and ensuring implementation, communication and feedback to staff. 6 Monitoring and evaluation Conducting reviews or audits of the SMS processes, and applying conventional quality assurance principles, ensuring that remedial actions have been implemented as planned and that the SMS remains effective and relevant to the operation. Reports made to the Accountable Manager to enable management review. 7 Documentation Documenting all the SMS processes - either as a component of existing manuals or in a separate SMS manual. Include a description of each component of the system and describe the interrelationships between each of these components; and co-ordination with external service providers and contactors, if necessary. Detailed local procedures in other documents can be cross-referenced, so the SMS manual is likely to be thin. Documenting the regulations, standards and exemptions by which the organisation is regulated. Training provisions for all staff, including SMS training. An emergency response plan, for each location. OTAC s/n 046 Issue 3 Page 11 of 12
The components of the Safety Management System can be seen to form a continuous cycle of improvement, as illustrated in the diagram below. SMS - a continuous cycle for safety improvement OTAC s/n 046 Issue 3 Page 12 of 12