Advisory Circular (AC) No. 107-001

Advisory Circulars logo

Guidance on Safety Management Systems Development

Table of Contents


3.1 Who should use this guide and what is it about?

  1. This guide is intended for Civil Aviation Certificate Holders who have an understanding of what a safety management system is.  If you don't have a basic understanding of SMS, TC's technical publication (TP) 14135, Safety Management Systems For Small Aviation Operations or TP 13739, Introduction to Safety Management Systems may be a good place to start your reading.

  2. This guidance material provides an interpretation of the intent and application of the SMS regulatory requirements in large, more complex operations.  It contains practical examples of how the components that make up an SMS might be implemented and provides an assessment tool for understanding whether or not your organization meets the minimum regulatory requirements.

  3. Depending on the size and complexity of the organization, the tools that make up an organization's SMS will vary. As such, the material contained herein is not intended as prescriptive formula for meeting the regulatory requirements.  The information provided in this guide is offered as an information source for interpreting the regulatory requirements and is intended to pave the way forward to the successful implementation of SMS in your organization.

3.2 What is a Safety Management System?

  1. A SMS is an explicit, comprehensive and proactive process for managing risks that integrates operations and technical systems with financial and human resource management, for all activities related to a CAD.

  2. Practically speaking, a SMS is a business-like approach to safety. In keeping with all management systems, a SMS provides for goal setting, planning, and measuring performance. It concerns itself with organizational safety rather than the conventional health and safety at work concerns. An organization's SMS defines how it intends the management of air safety to be conducted as an integral part of their business management activities. A SMS is woven into the fabric of an organization. It becomes part of the culture; the way people do their jobs.

  3. The organizational structures and activities that make up a SMS are found throughout an organization. Every employee in every department contributes to the safety health of the organization. In some departments safety management activity will be more visible than in others, but the system must be integrated into «the way things are done» throughout the establishment. This will be achieved by the implementation and continuing support of a safety program based on a coherent policy, that leads to well designed procedures.

3.3 Key Generic Features of the SMS Approach

  1. There is no definitive meaning attached to the term «SMS». Every organization, and industry, for that matter, has its own interpretation of what it is. From the Civil Aviation perspective, five generic features characterize a SMS. These are:

    1. A comprehensive systematic approach to the management of aviation safety within an organization, including the interfaces between the company and its suppliers, sub-contractors and business partners.

    2. A principal focus on the hazards of the business and their effects upon those activities critical to flight safety.

    3. The full integration of safety considerations into the business, via the application of management controls to all aspects of the business processes critical to safety.

    4. The use of active monitoring and audit processes to validate that the necessary controls identified through the hazard management process are in place and to ensure continuing active commitment to safety.

    5. The use of Quality Assurance principles, including improvement and feedback mechanisms.

  2. When considering how to meet the SMS CARs requirements some companies may choose to utilize a commercial “off-the-shelf” system. Whilst this might be appropriate for some companies, the program should be tailored to meet the requirements of the individual organization rather than assuming that one size fits all. Attention should also be given to the linkages between the individual components; they should be linked in a systematic way, rather than appearing to be stand-alone units.

  3. Key Components of a Safety Management System

    1. A Safety Management Plan

    2. Documentation Management

    3. Safety Oversight

    4. Training

    5. Quality Assurance

    6. Emergency Response Preparedness

  4. A SMS can be divided into three principle parts, all interlinked and interdependent. The key point to remember is that if any one of these parts is missing, the system will be ineffective. In the diagram below, you can see how each of the regulatory requirements (shown in letters corresponding to 3.3(3) fit into the SMS as a whole. Further, an SMS with all the principle parts in place will allow for continuous improvement because the prerequisites of the Plan, Do, Check, Act Model are already in place.

3.4 Diagram One - Key Generic Features of an Effective SMS

Key Generic Features of an Effective SMS

3.5 The Accountable Executive and Corporate Culture

  1. For a SMS to be effective there has to be a champion; someone with the authority to commit the resources required to implement, maintain and take responsibility for the SMS.

  2. An effective implementation strategy for SMS will involve changes in processes and procedures and will almost certainly involve a shift in the corporate culture.  The safety culture of an organization is defined as “…the product of individual and group values, attitudes, perceptions, competencies and patterns of behaviour, that determine the commitment to, and the style and proficiency of, an organization's health and safety management.”.  Simply put, it is quite literally the way things are done Every organization has a culture, good or bad, safe or unsafe, the corporate culture is reflected in the mode of operation throughout the organisation.  Typically, the tone of the culture is established from the top down.  If the accountable executive is committed to managing safety risks then the way that organization operates will reflect this philosophy.

  3. Managing safety risks, however, involves more than a personal commitment to make safety one's primary obligation.  It often requires an expenditure of capital and resources to achieve a safer operating environment.  That's why the proposed amendments to the Canadian Aviation Regulations define the accountable executive as “…the person [who] has full control of the financial and human resources required for the operation's authorized to be conducted under the operations certificates”

  4. In an SMS environment, the accountable executive and all senior managers are accountable for safety. The dedication and involvement of top management towards safety and safety practices should be clearly visible. It is important that senior management is seen to provide a strong and active leadership role in the SMS. This includes a commitment to provide the resources necessary to attain the strategic safety objectives established by the organization. The following is a list of activities that demonstrate top management’s active commitment to SMS, these include:

    1. Putting safety matters on the agenda of meetings, from the Board level downwards;

    2. Being actively involved in safety activities and reviews at both local and remote sites;

    3. Allocating the necessary resources, such as time and money, to safety matters;

    4. Receiving and acting on safety reports submitted by employees;

    5. Promoting safety topics in publications, and (probably most important of all); and

    6. Setting personal examples in day-to-day work to demonstrate unmistakably that the organization's commitment to safety is real and not merely lip-service, and by clearly and firmly discouraging any actions that could send a contrary message.

  5. The ideal safety culture embodies a spirit of openness and demonstrates support for staff and the systems of work. Senior management should be accessible and dedicated to making the changes necessary to enhance safety. They should be available to discuss emerging trends and safety issues identified through the System. A positive safety culture reinforces the entire safety achievement of the organization and is critical to its success.

3.6 Diagram Two - Elements of Safety Culture

The following diagram demonstrates the types of cultural attributes that indicate a good safety culture

Elements of Safety Culture

3.7 Who is the accountable executive?

  1. The accountable executive is, for all intents and purposes, the certificate holder. In fact, in a sole proprietorship he or she will almost certainly be the certificate holder.

  2. In a corporation, he or she will most likely be the CEO or a senior executive who has been delegated authority similar to that of the CEO.  This is not just a manager with a big budget. It is someone at a level that determines how big the various departmental budgets will be, with full executive control over the organization's activities.  In an airport environment where the owner is the local council, the accountable executive will most likely be the mayor.

  3. The reason for specifying a single accountable executive for all certificates held is to ensure that this responsibility is not simply delegated to the various functional heads responsible for the different certificates. After all, as the individual responsible for the SMS, this person will have to decide whether, for example, to divert funds from new aircraft acquisition to new hangar construction, or from training to test equipment.

  4. The implementation of the accountable executive will ensure that:

    1. Senior management cannot avoid responsibility for systemic failures due to ignorance;

    2. All major safety-related findings are known by the accountable executive; and

    3. The accountable executive is held responsible for safety deficiencies.

  5. The flow chart shown in Staff Instruction 106-001 – Validation of an Accountable Executive will help define who the accountable executive is in your organization.

3.8 Continuous Improvement Cycle

  1. For an SMS to be successful it must never be static.  Just because the basic components and elements of the SMS are in place, it cannot be considered “complete”.  Your organization isn't static: personnel, equipment, routes, runways and the operating environment change all the time.  As the organization changes, so must the SMS.  It must continually evolve using the system outputs and lessons learned. To achieve this state of continuous improvement it is important to understand that all work done in an organization is the result of process.

  2. It has been said that, “The emphasis with assuring quality must focus first on process because a stable, repeatable process is one in which quality can be an emergent property”. In other words, to validate and ensure the effectiveness of a process, the process must a) exist and be understood, and b) be followed repeatedly by all personnel. Once it is confirmed that a process exists and is in use, the output or product of that process can be reviewed to ensure that the desired outcome is in fact being realized. Where the result of a process falls short of expectations, that process can then be adjusted to achieve the desired result.

  3. One way of achieving this state of continuous improvement is to apply the Plan, Do, Check, Act (PDCA) model popularized by W. Edwards Deming.  Dr. Deming's pioneering work in quality management gave rise to a continuous process to achieve better quality products and services, and to improve the processes that deliver them.  Essentially, what the PDCA does is provide a logical process for the development of all SMS elements and components, including processes already in existence within the company.

  4. The PDCA model can be used to develop every aspect of your SMS.  The chart below demonstrates how this can be applied.  While you're reading this, think about an SMS process, voluntary reporting for example, and follow it through the PDCA process.

3.9 Table 1: Plan, Do, Check, Act: A Process for Improvement

  • Determine Responsibility
  • Determine Requirements
  • Assess current processes
  • Gather Baseline Data
  • Set Goals and Determine Performance Measures
  • Formulate Action Plan
  • Train
  • Implement Action Plan
  • Make adjustments as needed
  • Gather and Organize Data
  • Train
  • Compare new data to baseline
  • Compare actual performance to goals
  • Make adjustments as needed
  • If significant gap(s) remain, re-examine root causes, formulate revised Action Plan and return to DO
  • Train
  • Standardize effective changes
  • Use data and improved outcomes to promote changes
  • Set up quality indicators and continue to measure periodically
  • Look for other places in the organization that might profit by your experience
  • Publicize your success
  • Be a Quality Advocate
  • Celebrate
  • Assess to identify other gaps

3.10 PLAN

  1. Determine Responsibility

    It is likely that implementing, improving or replacing processes will involve more than one person, although this is not always the case. Using a group of people to work on quality improvements, especially people who are knowledgeable about, or who have had input into existing processes, will increase the likelihood that they understand and will use the new processes when they are implemented.

  2. Determine Requirements

    The first step in implementing any component or element of an SMS is to determine what is required. Reviewing TC's documentation relating to oversight and other publications, may be helpful. TC's documentation relating to oversight sets out the regulatory criteria for each component and element in a simple-to-use format. This document also sets out the expectations that not only meet the required criteria but include additional program characteristics that can be considered best practice.

  3. Assess Current Processes

    1. The next step is to determine where you are in relation to where you want to be; in other words, you must know what processes you currently have in place. Using the voluntary reporting system as an example, it is likely that your organization already has some type of process for personnel to voice safety concerns. It may be informal or it may be established and documented, such as the safety reporting system required by air operators operating under Subpart 705. It is probable, however, that not all of the required criteria will be in place; there may not be a non-punitive reporting policy for example, and the scope of the reporting program may be directed to specific groups of employees, rather than all employees of the organization.

    2. Your task at this point is to determine the shortcomings of current processes and a good way to do this is by using the Gap Analysis Form provided in Appendix B of TP 14343, (referred to above). Once you have completed the analysis of where you are versus where you want to be, you will have a much clearer idea of the changes and additions that have to be made. These changes and additions can now be documented in an implementation plan such as the sample provided in Appendix C of the Implementation Procedures Guide for Air Operators and Approved Maintenance Organizations  (TP 14343) andwill become the benchmarks by which you can measure progress of implementation and the effectiveness of the ongoing program element.

  4. Gather Baseline Data

    What data do you have that provides a baseline for where you are now? Before you jump into making improvements or additions, you must know, and be able to show, where you stand. For instance, do you know how many safety reports have been submitted through an existing safety-reporting program in the previous month, or over the past year? What departments are the personnel who submit reports working in? Have personnel who reported safety deficiencies or hazards received a response to their report? Is this type of information in quantifiable terms? The identification of this baseline data is important, as it is from this point that you will be able to measure improvement.

  5. Set Goals and Determine Performance Measures

    1. The next step is to convert the benchmarks (criteria) and baseline data (where you are now) into goals. Be realistic during this activity, and follow the basic principles of goal setting such as writing goals down, stating them positively, prioritizing, and being precise (e.g. increasing the number of reports by X% per month, or increasing awareness of the program across the organization by a specific date). Performance measures can then be determined by asking how you will know if you've met your goals. How many reports have been receiving measured against the baseline? From what departments? Are people aware of the reporting program? Do they know how to submit a report? Do they know what form to use or how to submit a report by email or fax?

    2. An added benefit of following this process is that the safety goals and performance measures established during this activity will form, or link, to the safety goals and performance measures required under the safety management plan. In addition, the quality assurance department will then be able to use the performance measures to determine effectiveness of current or newly established processes. It is important to realize though, that benchmarks, goals and performance measures will change as the program evolves; they may even change as planned activity (theoretical) moves into practical implementation.

  6. Formulate an Action Plan

    Once you have your data, you must formulate a plan for taking action. If you have completed the preceding steps thoroughly, this step should proceed smoothly as all you need do is ask the following question: What is stopping us from achieving our goals? The answers to that question will form the basis for your plan. One of the more important aspects of this phase is ensuring that new and revised processes are documented (refer to Chapter 5).

  7. Train

    Often the most effective training at this stage is “just-in-time” (i.e. as needed) training, brought to members of a working group at the point where they are in need of more skills or information.

3.11 DO

  1. Implement Action Plan

    The assessment and planning that has been put into the development of an implementation plan will pay dividends during this phase; this is especially true if new or revised processes that personnel will be required to follow have been well documented. It is time now to try out what looks good on paper. A working group may implement the plan they have developed, or the plans and recommendations may be turned over to another group for implementation.

  2. Make Adjustments as Needed

    Sometimes plans look better on paper! As mentioned earlier, it may become necessary to make adjustments or changes to the plan and to documented processes.

  3. Gather and Organize Data

    Since you have baseline data gathered before you implemented changes, you will want to measure again after the plan is implemented. This measurement will tell you whether there has been an improvement in the process and if you have achieved your objective(s). You can use your data to substantiate to other people that your effort has been successful. The display of this data is valuable, both to you and to people who want to know what you and/or the working group have done.

  4. Train

    There are two elements of training to consider at this point; training for personnel (i.e., the training component of SMS) and any additional training required by the implementation team. In addition to general SMS principles, SMS training for personnel will focus on those components/elements being implemented. Like any other phase of SMS implementation, personnel training must be considered dynamic, which is to say that you'll want to be open to feedback and expect that some fine-tuning will be needed. A good way to facilitate this is to end each training session with a “what went well – what needs improvement” segment. You will also want to align training sessions with new elements/components as they come on line, so expect that your training plan will include a number of shorter component/element-specific training sessions over the implementation period.

3.12 CHECK

  1. Compare New Data to Baseline

    What does your data tell you? At this point in your improvement process, you should be able to determine if your action plan (the Do part of PDCA) is accomplishing what you designed it to do.

  2. Compare Performance to Goals

    Review the goals you set in the planning phase and determine whether or not you are meeting them. This is where the thought that went into performance measurement really pays off, as you'll have clearly defined measures to assist in evaluating the effectiveness of planned implementation activities.

  3. Make Adjustments as Needed

    With the information you now have, you and/or your working group will have the opportunity to determine what needs fine-tuning or what changes are required to improve your results. Are planned processes being followed? Are they effective? Can they be improved upon so that the operation is more efficient?

  4. If Significant Gaps Remain:

    If you are grappling with a particularly difficult and involved phase, you may find that you need to rethink the Action Plan and make changes in the original plan. If so, return to the DO phase and follow through like before. This is not a setback. Anything that provides information and points you in the right direction is progress.

  5. Train

    Be vigilant to changes that will necessitate changes to training programs and ensure that a process has been developed to make personnel aware of these changes.

3.13 ACT

  1. Standardize Effective Changes

    When you know that your plan works, you will make it a part of the way you do business.

  2. Use Data and Improved Outcomes to Sell Changes

    You can take the opportunity to show your data to the sceptics, proving how the changes are saving resources and/or improving service to stakeholders.

  3. Set Up Quality Indicators and Continue to Measure Periodically

    The final part of the improvement project is not the end. Quality indicators will tell you what to measure, and those who worked on the project will determine how often to measure. This is an effective way to monitor progress and make sure there is no "backsliding."

  4. Look for Other Places in the Organization that could Profit from your Experience and Publicize your Success

    There may be other areas of the organization struggling with issues similar to yours. If you know about some of those places, you can make a point of reporting your results and offering to share information. Your hard work can benefit more than just your area.

  5. Be a Quality Advocate

    Advertise the benefits of applying a PDCA approach to improving your processes. Apply quality management principles to everything you do and encourage others to do the same.

  6. Celebrate!

    This part of the process is something that happens quite naturally. When you have experienced what can be accomplished through following the quality process and applying your expertise and knowledge to solve a problem, you will want to tell others about your success. It is important to celebrate with your group members and others who helped you along the way.

  7. Assess to Identify Other Gaps

    You are now able to identify other places where you have gaps in performance. As you do, you can cycle back to the PLAN phase of the process.

3.14 Advantages of Using PDCA Methodology

  1. The advantages of using this methodology is:

    1. The methodology provides a simple framework for organizing your action plan.

    2. You will be building consensus among stakeholders as you work through implementing SMS.

    3. The methodology prompts you to determine your baseline data when you begin implementation activities.

    4. Data is a quick, effective way to share results with those interested in your outcomes.

    5. The methodology provides tools for problem solving.

3.15 Why Bother Implementing a SMS?

  1. It's often said that safety makes economic sense. Unless an organization experiences a loss, or critically assesses both the direct and indirect costs of an occurrence, it is often difficult to relate to this statement. The direct costs are usually easy to quantify, they include damage to the aircraft, compensation for injuries and damage to property and are usually settled through an insurance claim.

  2. The indirect costs are a little more difficult to assess, these are often not covered or fully reimbursed by the organization’s insurance and the impact is often delayed. This includes items such as:

    1. Loss of business and reputation;

    2. Legal fees and damage claims;

    3. Medical costs not covered by worker's compensation;

    4. Cost of lost use of equipment (loss of income);

    5. Time lost by injured person(s) and cost of replacement workers;

    6. Increased insurance premiums;

    7. Aircraft recovery and clean-up;

    8. Fines.

  3. The economic argument is even more salient when one considers the following figures produced by the Boeing Aircraft Corporation. Boeing estimated the average cost in U.S. dollars of the following:

    1. In-flight shutdown - $500, 000

    2. Flight cancellation - $50, 000

    3. Flight delay per hour - $10, 000

  4. In an airport environment other costs to consider are things like cost of runway or airport closure

  5. The following table looks at the profit margins required to cover specific yearly incident costs. Taking into account the following figures, it is clear that the cost of implementing and maintaining a SMS becomes less significant and well worth the investment when contrasted with the cost of doing nothing.

  6. Table 2

    Yearly Incident Costs Profit Margin
    1% 2% 3%
    $1,000 $100,000 $50,000 $33,000
    $10,000 $1,000,000 $500,000 $333,000
    $50,000 $5,000,000 $2,500,000 $1,667,000
    $100,000 $10,000,000 $5,000,000 $3,333,000

3.16 Integrating Other Legislative Requirements in your SMS

  1. To fully understand and identify hazards and risks, an organization must consider all aspects of the organization and not just those impacted by the Canadian Aviation Regulations. Reporting and information sharing requirements exist in other bodies of legislation such as the Canada Labour Code and the Canadian Environmental Protection Act. These requirements complement and enhance the SMS requirement of the CARs by providing a broader perspective on the operational hazards and risks that might impact flight safety. Organizations are encouraged to utilize this information in their consideration of operational risk.

  2. In some cases, an organization may benefit from using the same component or element to accomplish multiple legislative requirements, data storage for example. It should be noted, however that compliance with individual legislative requirements will be determined by the Authority responsible for the specific legislative requirements. In no circumstances does compliance with the CARs SMS requirements alleviate an organization's responsibility to comply with other legislative requirements nor does it provide a mechanism for circumventing theses requirements.

Previous Page

Next page

Date modified: