FAA Part 5 Requirements - Can a Layman Understand This?

The dust has settled since the FAA has released "Safety Management Systems for Domestic, Flag, and Supplemental Operations Certificate Holders." Being an aviation SMS geek, I finally got around to reading it with a critical eye.

If you are the safety manager for a part 121 carrier, chances are that you have already read it. I'm wondering whether other safety managers are seeing what I'm seeing, or am I misunderstanding these Part 5 SMS requirements?

Related FAA 14 CFR Part 5 Articles

• Overview of FAA Part 5 Requirements
• FAA Part 5 - Safety Assurance - You May Not Be Prepared
• FAA Part 5 | Safety Policy Compliance

What struck me first was subsection 5.3 General Requirements:

(a) Any certificate holder required to have a Safety Management System under this part must submit the Safety
Management System to the Administrator for acceptance. The SMS must be appropriate to the size, scope, and complexity of the certificate holder’s operation and include at least the following components:

(1) Safety policy in accordance with the requirements of subpart B of this part;

It is no surprise that the SMS must be submitted to the administrator for acceptance; however, if you are the newly appointed SMS manager, you had better be familiar with this requirement.

There are some other little quirks I noticed that may trip you up, even if you are an experienced aviation safety professional. If you are like me, I sometimes scan and don't read with a critical eye. Let's see if you caught these other hidden traps.

Appropriate to Size, Scope, and Complexity

What does this mean to you, regarding "appropriate to the size, scope, and complexity of the certificate holder’s operation?" EASA has definitions for complex and non-complex operators. Does anybody have any references as to what the FAA means here? The FAA may have similar definitions. Please shoot me a comment if you know where to find it.

I can probably guess that an operator with fewer than 100 employees can have a paper-based system with MS Excel reports. Safety communications can probably be accomplished in face-to-face meetings. I guess there is quite a bit of room for a subjective evaluation during the auditing, just as we saw with the Canadians in the early years of their SMS implementations.

Other than that, I'll leave it alone and let you use your best judgment.

Safety Policy in Accordance With Subpart B

Let's review Subpart B-Safety Policy. I'll highlight areas I wish to discuss drawing your attention.

Subpart 5.21 Safety policy.

(a) The certificate holder must have a safety policy that includes at least the following:

1. The safety objectives of the certificate holder.
2. A commitment of the certificate holder to fulfill the organization’s safety objectives.
3. A clear statement about the provision of the necessary resources for the implementation of the SMS.
4. A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.
5. A policy that defines unacceptable behavior and conditions for disciplinary action.
6. An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.

Related FAA 14 CFR Part 5 Articles

• FAA Part 5 Compliance: Safety Promotion (the "Overlooked Pillar")
• FAA Part 5 Compliance | Safety Assurance Analysis of Data Component
• FAA Part 5 Compliance | Safety Assurance Performance Monitoring and Data Acquisition Components

Dissecting Subpart B Safety Policy

This is a pretty ambitious safety policy. Your safety policy must include at least:

• Safety objectives;
• Safety reporting policy; and
• A policy that defines unacceptable behavior

Let's not beat up "safety objectives" up too much. According to Subpart 5.5 Definitions, "Safety objective means a measurable goal or desirable outcome related to safety."

Sample List of Safety Objectives for Aviation SMS

Let's naturally assume our safety objectives may include:

• Develop and embed a safety culture recognizing the importance and value of effective aviation safety management;
• Clearly, define all staff accountabilities and responsibilities for the development and delivery of aviation safety strategy and performance;
• Minimize operational risk to a point that is as low as reasonably practicable/achievable;
• Ensure externally supplied systems and services impacting our operational safety meet appropriate safety standards;
• Comply with legislative and regulatory requirements and standards;
• Ensure all staff are provided with adequate and appropriate aviation safety information and training;
• Ensure sufficiently skilled and trained resources are available to implement safety strategy and policy;
• Establish and measure safety performance against realistic objectives and/or targets;
• Continually improve our safety performance; and
• Conduct safety and management reviews and ensure that relevant action is taken.

Related FAA 14 CFR Part 5 Articles

• FAA Part 5 Compliance | Safety Assurance Continuous Improvement
• FAA Part 5 Compliance | Safety Risk Management Risk Control Component
• FAA Part 5 Compliance | Safety Risk Management Risk Assessment Element

Safety Reporting Policy Part of Safety Policy

This statement set the warning bells off: "A safety reporting policy that defines requirements for employee reporting of safety hazards or issues."

Does this make sense? A policy embedded within another policy? I believe the best way to interpret this is that the Safety Policy must include a reference to the "safety reporting policy."

My reasoning is that a policy is more useful to end-users when it is readable and digestible. I doubt whether any auditor will launch a finding if you include a reference to your safety reporting policy within your safety policy. To me, this screams common sense. Has anyone written their safety policy to include the other two policies?

Policy Detailing Unacceptable Behavior and Conditions for Disciplinary Action

My thought patterns regarding the "Unacceptable Behavior Policy" embedded within the Safety Policy remain the same as the aforementioned safety reporting policy. I recommend simply inserting a reference and not putting this potentially lengthy policy inside the safety policy.

Policies must be useful to the intended audience. Don't write your policies for the regulators, but for your employees.

Why Pick at Safety Policy Details?

You may ask why I have chosen this topic to address. For some, it may seem very silly. But how many times have you seen an auditor submit audit findings because they lacked "common sense?" They will take a literal interpretation to make a point. They may not be experts at writing policies, but yes, they are probably experts at writing findings.

I hear audit horror stories frequently from our clients. I usually play a supportive role. If you have any good SMS auditor stories, I'm always open for a good chuckle.

Before I Leave Safety Policy

So I don't have to return to review the safety policy in another article, let's finish subsection 5.21 because I have a parting comment.

(b) The safety policy must be signed by the accountable executive described in § 5.25.

(Easy enough to understand. No comment needed.)

(c) The safety policy must be documented and communicated throughout the certificate holder’s organization.

This is one area where I have seen problems surface in the past. Communicating throughout the organization does not mean putting the policy on the shelf and telling everyone where the policy is. This is the way it has been done for years in the traditional safety programs and continues to be practiced even with some IOSA-certified airlines.

I was not shocked when a safety manager at an Asian airline told me that most ground handlers at their airline neither know the policies nor know where to find the policies should an event occur.

"Documented and communicated" needs a lot of work in the airline industry. I should rephrase this: airlines generally do great with documentation, but they commonly fail with communication.

(d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the certificate holder.

Safety policies are living documents. They can change as the environment changes. Don't be afraid to make changes. Can you honestly tell me, as a safety manager, that your account executive is regularly reviewing the safety policy? From where I'm sitting, as a gatekeeper that manages policies and procedures, as well as other aviation SMS software tools, I see three scenarios:

1. Safety manager reviews on behalf of the accountable executive;
2. Accountable manager reviews with the group in a group safety committee meeting; or
3. Safety manager posts signed safety policy only at the beginning of the aviation SMS implementation.

Which scenario does your company practice?

Related FAA 14 CFR Part 5 Articles

• FAA Part 5 Compliance | Safety Risk Management System Description Requirement
• FAA Part 5 Compliance | Safety Risk Management Risk Analysis Requirement
• FAA Part 5 Compliance | Safety Risk Management Hazard Identification Requirement

Safety policy templates will save you time when both creating your safety policy and the mandatory reviewing of your safety policy.

When you are reviewing your safety policy, here is an excellent checklist to use.

Last updated August 2023.