Passing aviation safety audits is absolutely critical for safety managers, not to mention the accountable executive who is ultimately responsible for aviation safety management systems (SMS) performance.
Their jobs may depend on satisfactorily managing both:
Aviation SMS audits have increasingly become a common and often stressful task at all managerial levels of the aviation industry. Maintaining or acquiring an operating certificate is often the overall objective, but many private aviation service providers need a fully functioning SMS in order to satisfy contractual obligations or acquire new business.
Aviation SMS audits are necessary to ensure the compliance and health of aviation SMS. Moreover, audits give valuable feedback to organizations concerning the integrity of their SMS implementation. Without this feedback, continuous improvement of the SMS would be either:
From a client's perspective, an aviation SMS audit offers some assurance that the service provider has a handle on their safety management processes. When a client neglects to audit an aviation service provider, they could be seen as implicitly accepting the additional risk to their business relationship.
On the flip side of the coin, aviation service providers may outsource safety-critical activities to vendors. To manage risk, the service provider must ensure that their vendor has implemented an acceptable aviation SMS.
It’s only natural than that for safety managers, audits are generally times of stress, anxiety, and focus. For one, poor results from an audit reflect directly on the safety manager, and can:
For the accountable executive, the stakes are higher. For every SMS, the accountable executive is responsible for ensuring the SMS is properly implemented and performed in all areas of the organization. Furthermore, whenever substandard SMS performance is detected or reported, the accountable executive is responsible for correcting the shortcomings.
Poor safety audit results can have severe financial ramifications and can result in the loss of operating licenses for:
It’s no wonder accountable executives, safety officers, and safety teams can be “slightly” tense before audits. There’s a lot at stake. Here are some 101-level tips for preparing and passing aviation safety audits.
This is more a disclaimer than anything. From the start of implementing your aviation SMS, SMS documentation and establishing an SMS data management strategy should be a top priority.
Mainly this means making sure that you have thorough, thoughtful, well-classified, and easy-to-access:
And so on. Any type of documentation that can be associated with the SMS, especially documents that show levels of actual performance, should be included.
It’s why many organizations have a company-specific SMS manual or commercial aviation SMS software – the latter of which makes a good impression on auditors as they are more suspicious of home-grown aviation SMS data management strategies. Thorough documentation and the ability to easily retrieve SMS documentation on demand are the main factors for audit preparation.
In the earlier years of the SMS implementation, SMS auditors did not demand much complexity from the SMS. You may get by the first four years with this documentation:
Safety goals and objectives should correlate with identified KPIs. Many safety professionals use the term SPI for safety performance indicators. They are the same as key performance indicators, except there is a focus on safety, KPIs can be created for many operational areas, such as:
For SMS audits, you will only be asked for KPIs tied to your safety goals and objectives. For this, you will need SMS performance monitoring data.
Ideally, you have been on top of documentation from the start of the SMS implementation process. If so, you can start your audit preparation with this step. Assuming that you have much of your documentation in one place, start by reviewing it and make sure that: Documentation is fully up to date with current practices.
This is because one of the most common findings for an audit is that documented risk management processes and actual risk management activities are not aligned. Documentation and risk management actions should be as close to in sync as possible.
If your SMS manual's risk management processes state that you will do a root cause analysis on every issue, then you had better be doing a root cause analysis on every issue and be able to prove it with supporting documentation. For example, your processes may state that "For every reported safety issue, the safety committee shall perform a root cause analysis in this manner... (list out the steps of the process).
If your processes are highly detailed, then it is easier to catch an operator missing a step or omitting critical details as demanded by the SMS manual. For example, let's say you must capture:
For every managed safety report, you had better provide this supporting data. It may be easier to put qualifiers on your risk management activities. As an example, your SMS manuals may state: "For every reported safety issue with a risk assessment equal or higher than "acceptable with mitigation," then a root cause analysis will be performed according to this process...
A word of caution if you are using commercially available SMS database software. If you describe in exact detail your processes according to how the SMS software performs particular risk management activities, your SMS manual is at risk of becoming outdated whenever the SMS database software is updated. In these cases, it becomes advisable to be cautious and remain purposely vague in detailing your risk management processes.
An example statement in your SMS manual may look like the following if you are using a commercially acquired SMS database:
All reported safety issues that have been risk assessed as "intolerable" must have an investigation completed using the processes in the SMS database software.
You may name the SMS database by name inline, but it is better to have a reference in an "Available Risk Management Tools" section that lists your commercially acquired SMS database by name. This gives you more flexibility should you decide to switch to SMS Pro from another provider. The advantage of using this tactic will be fewer required SMS manual changes when you make the switch.
Another word of caution. Please review your SMS manual if you change SMS databases. Your new SMS database may not always perform the same activities as the previous database. Likewise, your new SMS database may eliminate several systems that were used for SMS activities, such as:
Some full-featured SMS databases claim to be able to address all SMS documentation requirements. This reduces your SMS data management complexity considerably and is a best practice.
When you are reviewing your SMS manual, be especially thorough in areas that involve training, such as procedures, employee duties and responsibilities to the SMS, and the safety reporting system.
Having a well-organized manual or system of documentation will expedite this process. For organizations whose documentation is disorganized, performing reviews and updates will prove to be especially challenging.
Hazard registers can make or break aviation SMS. Professionally designed, hazard-tracking SMS databases are robust and well-organized systems that can handle a vast expanse of data that covers all four SMS pillars. Most operators start their SMS implementations using spreadsheets to manage their hazard registers. They soon learn that spreadsheets are the wrong technology for a sustainable hazard register for the following reasons:
These are enough reasons. The point is that if your SMS is more than 4 years old and your company has more than 100 employees, you need an SMS database. Your spreadsheet hazard register presents too much risk to the accountable executive. Once you move to an SMS database, everyone can breathe a bit easier.
But having that database is solely a means to an end: they are hubs around which to develop sophisticated risk management processes, including
Moreover, demonstrating the use of such sophisticated tools, charts, graphs, etc., further demonstrates tangible evidence of:
Let’s make no mistake, the auditors' impression of the aviation SMS is very important.
If you have an SMS that functions well, but on paper is disorganized or impossible to navigate, it will reflect worse than it actually is in the eyes of the auditor and the audit itself.
In addition to having an up-to-date, robust hazard register with sophisticated tools, make sure you have:
It stands to reason that if you are preparing for an audit, all reported safety issues in the risk management queue should be relatively recent. Otherwise, there may appear to be neglected or abandoned safety reports. Abandoned safety reports would be an inexcusable and major eyesore for any auditor.
Think Christmas: have your documents ready to go in a package so neat you could put a bow on it.
Auditors are people too, with aspects of their job that they probably don’t look forward to. I am willing to bet walking into a disorganized mess of documentation, hazard register, and risk management activities is pretty high on their list of dislikes.
Having prepared all audit documentation beforehand starts the audit off on the right foot. This preparation is a testament to the performance of the SMS.
Internal audits are great practice. They provide SMS management teams some idea of:
Internal audits should use similar auditing criteria as the audit organization. For example, your internal audit might use an SMS audit checklist from the auditing organization. We have some examples at the bottom of this article.
Well, first of all, don’t be surprised by audits. While performing the above steps regularly may seem tedious and tiresome, it will save you much time and energy from being surprised and stressed by an impending audit.
Make sure employees are aware of the audit date and know the “language” of their role based on their responsibility in the SMS. Not only will this help your audit, but it will give employees confidence by providing something to lean on should they interact with the auditor.
Or, if it’s your first audit or you don’t feel quite prepared: simply relax. Focus. Accomplish as much as possible until the date of the audit, but don’t rip your hair out.
Only give what is asked for. Offering too much will appear either:
In other words, offering more than what is asked for doesn’t help your audit findings.
Different auditors will stress different concerns about an SMS. No two auditors will have the exact same audit findings. Don’t be surprised therefore when your current audit findings look different from your last audit.
As stressful as they can be, it's important to remember that audits are beneficial. For one, they act as a valuable and objective reference point for assessing SMS performance. Thus, audits are a natural catalyst for improvement.
Moreover, audits force safety managers/teams to “get their SMS act” together and rigorously stay on top of the aviation SMS, especially the documentation!
Last updated July 2024.