Internal SMS audits are an extremely important element in verifying the performance of every aviation safety management system (SMS). They’re also a neglected process in a surprisingly large number of smaller operators' SMS risk management schedules.
Just ask yourself, when was the last time you performed an internal audit on your aviation SMS implementation? Let’s also be clear about what we mean when we say “audit”, as this word is thrown around loosely.
An internal audit:
In short, conducting internal audits is similar to an audit conducted by regulatory compliance authorities, except you are in control of:
You might:
In very small organizations without quality assurance (QA) departments, a safety manager may conduct the internal SMS audit. As those of you who work in small organizations, managers are accustomed to wearing many hats. It is very common for a safety manager to be a full-time pilot or maintenance personnel. The role of safety manager in very small organizations is simply another "extra duty" that is assigned to an employee with good organizational skills.
Beyond this, here are the basic elements needed to conduct internal SMS audits in the aviation industry.
Internal audits should be performed with an aviation SMS audit checklist that has been prepared by a standards-setting organization, such as IATA, IS-BAO, or the Flight Safety Foundation. Alternatively, if you can acquire auditing checklists from your civil aviation authority, this will be the best option, as CAAs SMS auditing checklists generally:
As stated, SMS audit checklists are generally provided upon request by oversight agencies before they audit your organization's SMS implementation. If you don't have the checklist, ask your aviation SMS inspector to provide the checklist to serve as a preparatory tool. This request may save you some considerable time preparing for the audit.
While you could use an SMS auditing checklist from another source, I'd acquire the one from your CAA as their checklist must align with the ICAO standards that their agency is obligated to follow when auditing your company. All member states the answer to ICAO, even the FAA. This does not mean that your CAA can not have higher standards than ICAO. Some do.
Likewise, you can create your own auditing checklist based on company standards. For example, an airport, airline, or other aviation service provider might walk through the FAA's Advisory Circular and create checklist items based on the most important SMS elements highlighted in the Circular. Smaller companies are most likely to create their own checklists when they see that their small size precludes them from demonstrating data-intensive safety performance monitoring capabilities, for example.
Audits are best performed in teams. Team members should be trusted employees in your company, such as
Each team member should be charged with evaluating a particular area that they are familiar with. Your audit team's reliable performance is where checklists demonstrate their undeniable importance. SMS auditors/inspectors don’t necessarily need to be experts in regulatory compliance rules and standards – they only need to have a clear checklist to follow.
The scope of each team member’s responsibility will probably vary depending on their experience and knowledge. Having operational experience is certainly a benefit for any SMS auditor; however, you cannot be assured that inspectors from your CAA will have operational experience. This is obvious if you have heard as many auditing "horror stories" as we have heard.
In any case, the audit team leader must know the capabilities of each audit team member. You might charge one team member with an entire section of the audit, and charge another member with a very specific set of checklist items based on a team member's educational background or previous work experience.
One of the most common use case scenarios for conducting internal SMS audits is to prepare for an impending audit by an oversight agency. The implication here is that you want to ensure past audit findings are now in a state of compliance.
Regardless of the reason for the internal audit, safety managers should review past audits and become familiar with the findings, concerns, and other comments. This information will then be used to
Internal audits are not formal audits. The team conducting the audit should keep in mind the fact that an internal audit is as much a discovery tool as it is an exploration and assessment of “how the SMS implementation is performing.” Doing some of the following will help keep the internal audit process flexible:
The long and short of it is to keep stress at a minimum, take your time, and remain as organized as possible.
Once the internal audit is complete, the safety manager or committee should follow up by doing the following (and in this order):
The above steps are the more or less standard operating procedure for any audit, in any industry.
Choosing a third party to conduct your audit has some pros and cons.
PROS:
CONS:
For the most part, creating an audit team internally will suffice. However, there may be situations where hiring a third party to evaluate your aviation SMS implementation can also be very beneficial, such as when preparing for major oversight audits.
These safety audit checklists should give you a solid idea of what good audit checklists look like.
Last updated July 2024.