The dust has settled since the FAA has released "Safety Management Systems for Domestic, Flag, and Supplemental Operations Certificate Holders." Being an aviation SMS geek, I finally got around to reading it with a critical eye.
If you are the safety manager for a part 121 carrier, chances are that you have already read it. I'm wondering whether other safety managers are seeing what I'm seeing, or am I misunderstanding these Part 5 SMS requirements?
What struck me first was subsection 5.3 General Requirements:
(a) Any certificate holder required to have a Safety Management System under this part must submit the Safety
Management System to the Administrator for acceptance. The SMS must be appropriate to the size, scope, and complexity of the certificate holder’s operation and include at least the following components:(1) Safety policy in accordance with the requirements of subpart B of this part;
It is no surprise that the SMS must be submitted to the administrator for acceptance; however, if you are the newly appointed SMS manager, you had better be familiar with this requirement.
There are some other little quirks I noticed that may trip you up, even if you are an experienced aviation safety professional. If you are like me, I sometimes scan and don't read with a critical eye. Let's see if you caught these other hidden traps.
What does this mean to you, regarding "appropriate to the size, scope, and complexity of the certificate holder’s operation?" EASA has definitions for complex and non-complex operators. Does anybody have any references as to what the FAA means here? The FAA may have similar definitions. Please shoot me a comment if you know where to find it.
I can probably guess that an operator with fewer than 100 employees can have a paper-based system with MS Excel reports. Safety communications can probably be accomplished in face-to-face meetings. I guess there is quite a bit of room for a subjective evaluation during the auditing, just as we saw with the Canadians in the early years of their SMS implementations.
Other than that, I'll leave it alone and let you use your best judgment.
Let's review Subpart B-Safety Policy. I'll highlight areas I wish to discuss drawing your attention.
Subpart 5.21 Safety policy.
(a) The certificate holder must have a safety policy that includes at least the following:
This is a pretty ambitious safety policy. Your safety policy must include at least:
Let's not beat up "safety objectives" up too much. According to Subpart 5.5 Definitions, "Safety objective means a measurable goal or desirable outcome related to safety."
Let's naturally assume our safety objectives may include:
This statement set the warning bells off: "A safety reporting policy that defines requirements for employee reporting of safety hazards or issues."
Does this make sense? A policy embedded within another policy? I believe the best way to interpret this is that the Safety Policy must include a reference to the "safety reporting policy."
My reasoning is that a policy is more useful to end-users when it is readable and digestible. I doubt whether any auditor will launch a finding if you include a reference to your safety reporting policy within your safety policy. To me, this screams common sense. Has anyone written their safety policy to include the other two policies?
My thought patterns regarding the "Unacceptable Behavior Policy" embedded within the Safety Policy remain the same as the aforementioned safety reporting policy. I recommend simply inserting a reference and not putting this potentially lengthy policy inside the safety policy.
Policies must be useful to the intended audience. Don't write your policies for the regulators, but for your employees.
You may ask why I have chosen this topic to address. For some, it may seem very silly. But how many times have you seen an auditor submit audit findings because they lacked "common sense?" They will take a literal interpretation to make a point. They may not be experts at writing policies, but yes, they are probably experts at writing findings.
I hear audit horror stories frequently from our clients. I usually play a supportive role. If you have any good SMS auditor stories, I'm always open for a good chuckle.
So I don't have to return to review the safety policy in another article, let's finish subsection 5.21 because I have a parting comment.
(b) The safety policy must be signed by the accountable executive described in § 5.25.
(Easy enough to understand. No comment needed.)
(c) The safety policy must be documented and communicated throughout the certificate holder’s organization.
This is one area where I have seen problems surface in the past. Communicating throughout the organization does not mean putting the policy on the shelf and telling everyone where the policy is. This is the way it has been done for years in the traditional safety programs and continues to be practiced even with some IOSA-certified airlines.
I was not shocked when a safety manager at an Asian airline told me that most ground handlers at their airline neither know the policies nor know where to find the policies should an event occur.
"Documented and communicated" needs a lot of work in the airline industry. I should rephrase this: airlines generally do great with documentation, but they commonly fail with communication.
(d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the certificate holder.
Safety policies are living documents. They can change as the environment changes. Don't be afraid to make changes. Can you honestly tell me, as a safety manager, that your account executive is regularly reviewing the safety policy? From where I'm sitting, as a gatekeeper that manages policies and procedures, as well as other aviation SMS software tools, I see three scenarios:
Which scenario does your company practice?
Safety policy templates will save you time when both creating your safety policy and the mandatory reviewing of your safety policy.
When you are reviewing your safety policy, here is an excellent checklist to use.
Last updated May 2024.