Advisory Circular (AC) No. 107-001
Guidance on Safety Management Systems Development
An operator's safety management plan defines how the certificate holder will establish, implement and maintain its SMS. It should represent a logical design detailing how the SMS will be implemented and maintained. It should contain four principle things:
- A definition of the fundamental approach an organization will adopt for managing safety within their organization, including a safety policy that clearly defines the organization's philosophical approach to safety and the performance goals it has established for itself
- Clearly defined roles and responsibilities for all personnel involved in safety.
- A description of the safety management system components
- A description of how the safety performance is measured.
- A safety policy is a statement of what an organization is committed to in regards to the safety of technical operations. It should be signed by the accountable executive and should clearly state the organization's intentions, management principles and aspirations for continuous improvement in the safety level. This can be achieved through documented policies describing what organizational processes and structures it will use to achieve the SMS. It should also contain a statement outlining the organization's objectives and the outcomes it hopes to achieve through its SMS.
- Your safety policy can be as simple or as complex as you choose to make it. The key is to understand that the safety policy is not simply a platitude that no one thinks about after it is published. On the contrary, the safety policy must be seen to have value; it must be the philosophy that everyone adheres to in their everyday activities. It must form the foundation of the SMS you wish to build and adhere to.
Typically, an organization's safety policy will comprise the following elements:
General Statement of Intent
This is sometimes called a mission statement or a corporate policy. Regardless of the terminology, the statement should start by defining what the organization is committed to in regards to safety. For example, TC's statement of intent is: to develop and administer policies, regulations and services for the best possible transportation system for Canada and Canadians - one that is safe, efficient, affordable, integrated and environmentally friendly. Transport Canada's vision is - A transportation system in Canada that is recognized worldwide as safe, secure, efficient, and environmentally responsible.
- Safety objectives clearly define what the organization wants to achieve with its SMS. The objectives, as well as a top-level statement regarding the organization's commitment to achieving improvements in safety, form the basis of the safety policy and should be widely publicized and distributed.
A typical statement outlining the safety objectives of the SMS should include both primary and secondary objectives. For example, «Our primary objective is to make our airline the safest in the world by addressing flight safety issues which:
- Take into account realistic exposure to risk and the resources available to deal with it;
- Employ systems that are acceptable to the regulatory authorities;
- Minimize both the likelihood and consequences of accidents causing damage to people and/or property.
- Provide the means by which the organization can deal proactively with events.
- It is important to ensure that the stated objectives are achievable and clearly define the limits within which the organization will operate. They should be unambiguous, well documented, readily accessible and should be reviewed on a regular basis. In effect, your safety objectives should form the basis for the internal safety goals and performance measures you will use to determine if your SMS is working.
Roles and Responsibilities
- Clearly define who is responsible and who is accountable for safety within the organization. The distinction between responsibility and accountability is subtle but vitally important in a SMS. Accountability means that you are liable for a specific action, for example the accountable executive is held liable for establishing the SMS. The responsibility for establishing the SMS, that is the physical activity of establishing the system, can be delegated to another person. You can therefore, be responsible but not accountable for something.
- The following example of a safety policy can be amended to suit the needs of the organization.
Among our core values, we will include:
- Safety, health and the environment
- Ethical behaviour
- Valuing people
Our fundamental safety beliefs are:
- Safety is a core business and personal value
- Safety is a source of our competitive advantage
- We will strengthen our business by making safety excellence an integral part of all flight and ground activities
- We believe that all accidents and incidents are preventable
- All levels of management are accountable for our safety performance, starting with the Chief Executive Office (CEO) / Managing Director
CORE ELEMENTS OF OUR SAFETY APPROACH
The five core elements of our safety approach include:
Top Management Commitment
- Safety excellence will be a component of our mission
- Senior leaders will hold line management and all employees accountable for safety performance
- Senior leaders and line management will demonstrate their continual commitment to safety
- Safety performance will be an important part of our management/employee evaluation system
- We will recognise and reward flight and ground safety performance
- Before any work is done, we will make everyone aware of the safety rules and processes as well as their personal responsibility to observe them
Clearly Communicated Expectations of Zero Incidents
- We will have a formal written safety goal, and we will ensure everyone understands and accepts that goal
- We will have a communications and motivation system in place to keep our people focused on the safety goal
Auditing &Measuring for Improvement
- Management will ensure regular safety audits are conducted and that everyone will participate in the process
- We will focus our audits on the behaviour of people as well as on the conditions of the operating area
- We will establish both leading and trailing performance indicators to help us evaluate our level of safety
Responsibility of All Employees
- Each one of us will be expected to accept responsibility and accountability for our own behaviour
- Each one of us will have an opportunity to participate in developing safety standards and procedures
- We will openly communicate information about safety incidents and will share the lessons with others
- Each of us will be concerned for the safety of others in our organisation
THE OBJECTIVES OF THE SAFETY PROCESS
- ALL levels of management will be clearly committed to safety
- We will have clear employee safety performance metrics, with clear accountability
- We will have open safety communications
- We will involve everyone in the decision process
- We will provide the necessary training to build and maintain meaningful ground and flight safety leadership skills
- The safety of our employees, customers and suppliers will be a corporate issue
- Establishing a set of safety objectives is key to establishing a successful SMS. Safety objectives define what the organization hopes to accomplish with its SMS. Safety objectives are the broader targets the organization hopes to achieve. They should be published and distributed so that all employees understand what the organization is seeking to accomplish with its SMS.
- Goal setting is vital to an organization's performance and helps to define a coherent set of targets for accomplishing the organization's overall safety objectives. All organizations have their own ways of setting and expressing goals. In some organizations, the goals are not stated very explicitly. Other organizations set goals formally and document the process. Regardless of how management goals are set, few organizations are good at developing safety goals. The most common weakness in setting safety goals is focusing on outcomes. This usually means counting accidents, but we know that safe companies can have accidents while less safe operations can be lucky and avoid accidents. Although the ultimate goal is 'no accidents', there are more precise and useful ways of measuring safety, especially in a safe system, than counting accidents.
- It is a never-ending struggle to identify and eliminate or control hazards. We will never run out of things to do to make the system safer. Sound management requires that we identify them, decide how to achieve them and hold ourselves accountable for achieving them. Risk management procedures can help managers decide where the greatest risks are and help set priorities. Sound safety objectives and goal setting concentrates on identifying systemic weaknesses and accident precursors, and either eliminating or mitigating them.
- The safety performance of the operation needs to be monitored, proactively and reactively, to ensure that the key safety goals continue to be achieved. Monitoring by audit forms a key element of this activity and should include both a quantitative and qualitative assessment. Meaning that a numeric as well as an effectivity assessment should be applied. The results of all safety performance monitoring should be documented and used as feedback to improve the system.
- It is widely acknowledged that accident rates are not an effective measurement of safety. They are purely reactive and are only effective when the accident rates are high enough. Furthermore, relying on accident rates as a safety performance measure can create a false impression; an assumption that nil accidents indicate the organization is safe. In reality, there will always be latent conditions within the system that might, if left unattended, lead to an accident. A more effective way to measure safety might be to address the individual areas of concern. For example, an assessment of the improvements made to work procedures might be far more effective than measuring accident rates.
- Performance measurement should be integrally linked to the company's stated overall objectives. This requires two things: the development and implementation of a coherent set of safety performance measures; and, a clear linkage between the safety performance measures and the organization's business performance measures. This shows a clear relationship between the organization's safety objectives and the achievement of its organizational and business goals. A simple example is given in table 3 below.
|Objective||Safety Performance Measure|
|Reduction in insurance rates|
Decrease number and severity of hangar incidents
- An essential element of any SMS is the safety reporting policy. To the extent possible, it should be non-punitive and developed, and implemented with all affected parties. This builds confidence in the system but also provides a clear understanding to all employees of what the safety reporting policy actually is.
- From a usability perspective, employees are more likely to report events and cooperate in an investigation when some level of immunity from disciplinary action is offered. When considering the application of a safety reporting policy, the organization should consider whether the event was wilful, deliberate or negligent on the part of the individual involved and the attendant circumstances. For example, has the individual been involved in an event like this before and did the individual participate fully in the investigation. Consideration should also be given to whether or not the individual was exhibiting normative behaviour that was sanctioned by management. In other words, is breaking the rules the norm in the organization and has management sanctioned «corner cutting» in the past? Careful analysis of the circumstances surrounding the event is required to determine whether the reporting policy is applicable or not.
A typical safety reporting policy might include the following statements:
- Safe flight operations are ABC airlines most important commitment. To ensure that commitment, it is imperative that we have uninhibited reporting of all incidents and occurrences that compromise the safety of our operations.
- We ask that each employee accept the responsibility to communicate any information that may affect the integrity of flight safety. Employees must be assured that this communication will never result in reprisal, thus allowing a timely, uninhibited flow of information to occur.
- All employees are advised that ABC Airlines will not initiate disciplinary actions against an employee who discloses an incident or occurrence involving flight safety. This policy cannot apply to criminal, intentional or wilful acts.
- ABC Airlines has developed Safety Reports to be used by all employees for reporting information concerning flight safety. They are designed to protect the identity of the employee who provides information. These forms are readily available in your work area.
- We urge all employees to use this program to help ABC Airlines continue its leadership in providing our customers and employees with the highest level of flight safety.
- A non-punitive approach to safety reporting does not preclude the use of a general approach to discipline in cases where an employee is involved in similar, recurrent events.
- The safety reporting policy should also include features to guard against the deliberate abuse of the system, such as using self-disclosure as a means of obtaining indemnity for deliberate violations of both the letter and spirit of the system.
- An organization should document and define the roles and responsibilities of all personnel in the SMS. Furthermore, a statement should be made attesting that everyone has a responsibility for safety.
The following guidelines highlight some of the key areas that should be documented:
- The safety responsibilities for each position and task
- The competencies required for each position
- The line of responsibility for ensuring all staff are competent and trained for their duties and for ensuring that training takes place, and
- The responsibilities of the manager responsible for externally supplied services. All unapproved contracting companies should meet the organization's own SMS standards or an equivalent to them.
- Diagram 3 shows where existing organizational bodies, such as the safety office, fit into the SMS. To put this in today's context, in many organizations the safety office is considered to be a stand-alone entity equal to any other operational body. The functions specific to the SMS are concentrated within this silo and are not distributed throughout the organization. Safety management is a business function comparable to any other function in the operation. In the same way that financial considerations are integrated into the organization, so should safety management issues. In SMS, safety is considered to be everyone's responsibility and is not unique to the safety office. This model can be applied to any Certificate holder including airports.
- The effective management of safety requires a clear delineation of all lines of authority within the organization. There should be a clear understanding of the accountability, responsibility and authority of all individuals involved in the system. An effort should be made to document and distribute the organogram throughout the organization, thereby promoting a common understanding of everyone's role in the SMS. Diagram 3 offers an example organogram of how the lines of responsibility might be established. In this diagram, the SMS analytical functions are performed within the individual technical areas. The Safety Services office is available to coordinate activities and provide advice where required. This model provides a fully integrated SMS model.
Management's role, responsibilities and accountabilities for the SMS and organizational deficiencies identified through the system should be well defined and the lines of authority clearly understood. As stated in the proposed regulatory requirements, these requirements include:
- The accountable executive is accountable for establishing and maintaining the SMS;
- The functional area, that is the area of direct responsibility, maintenance, airport or flight operations for example, is responsible for the SMS;
- Everyone is responsible for safety in the organization. This includes all technical personnel as well as individuals in other non-technical areas such as marketing and customer service;
- SMS specific functions must be exercised by an individual employed within the operational area in which he/she works. The exception to this rule is in cases where the size of the operation, reasonably precludes the application of dedicated resources to this activity.
The person responsible for the affected functional area is accountable for determining and implementing appropriate comprehensive corrective actions. The reason for this is threefold:
- The functional director, that is the person with direct line responsibility for the affected area, is directly involved in the decision making process. In most cases, he/she has the knowledge and expertise to recommend effective corrective and preventative actions and has the authority to assign the appropriate resources where required.
- The functional director must assume responsibility for safety within his/her own area of responsibility. In this way, he/she is involved in the «safety» process and is accountable for issues that arise in his/her functional area.
- A quality assurance function is provided because event investigations and corrective actions are separate activities. This eliminates the potential for conflict of interest because the person who identifies the problem is not the person who determines what the corrective action is. This does not preclude discussion of safety findings within a safety committee environment; however, the final say on any remedial action resides with the responsible functional director.
- The development of a positive safety culture is predicated on the involvement of all facets of the organization in the safety process. The objective of this requirement, therefore, is to involve all parties in the SMS, thereby fostering a company-wide commitment to safety management.
To ensure that the SMS operates effectively it is essential that the following tasks be delegated to personnel as appropriate. The roles, responsibilities and accountabilities of each individual/position should be well defined and the lines of responsibility clearly understood. As stated in the proposed regulatory requirements, he/she is responsible for:
- Establishing and maintaining a reporting system to collect safety related data
- Conducting hazard identification and risk management analysis
- Conducting periodic reviews to determine the effectiveness of the program
- Developing and evaluating the results of safety initiatives
- Monitoring industry safety concerns that could affect the organization
- Determining the adequacy of training programs, and
- Advising reporters of the results of event analyses.
- There is no regulatory requirement to have a safety office. However, it is recognized that in larger organizations a safety office may be useful as a consultative or administrative body. In these cases, the safety office might act as a repository for safety related reports and information, provide an interdepartmental linkage for cross-functional safety events, coordinate occupational health and safety issues, as well as provide risk assessment and data analysis expertise to the functional managers. The safety office should provide data directly to the appropriate manager regarding major safety issues identified by the system. Individuals performing this function report directly to the appropriate responsible manager on issues related to the Certificate. In effect, the safety office becomes a safety services support provider.
- The responsibility for informing the accountable executive of major safety deficiencies identified within their responsible area remains with the appropriate functional director. Furthermore, whilst the safety office may be involved in discussions regarding possible corrective action, it is the responsibility of the functional head to determine what the corrective action will be and to ensure the outcome is monitored and evaluated. The safety office does not have the authority to overturn operational decisions related to safety issues identified by the system or the SMS itself.
- Another form of interdepartmental communication is the safety committee. Safety committees may provide an effective forum for discussion, particularly in larger, more complex organizations and can provide benefits to the organization. Safety committees provide a forum for discussing safety related issues from a cross-functional perspective and may lead to the inclusion of issues that look at safety from a broader viewpoint. Conventional health and safety at work concerns are a good example of this. Frequently, safety issues are not limited to one specific area and require inputs and expertise from a variety of different fields. Safety committees provide a forum for this dialogue and can be utilized to assess the effectiveness of the system from a «big picture» perspective. They also provide a means by which safety achievements can be reviewed and safety information broadcast.
- The safety office may coordinate and provide administrative assistance to the safety committee. The safety committee could also be a stand-alone entity; meaning, one can exist without the other. The accountable executive should chair this committee and all parts of the organization must be represented. This does not preclude the existence of sub-committees with specific areas of responsibility.
If you do choose to use a committee type approach within your SMS, there are a few caveats that should be applied:
- Always take minutes of the meetings. Minutes ensure that action items can be developed, followed up; and highlights of the meetings can be distributed to those not present at the meeting.
- Avoid «committee meeting fatigue» by structuring meetings at an appropriate interval for an appropriate length of time. Always provide and stick to an agenda and deal with business in a timely manner, try to overly lengthy committee meetings.
- Finally, establish the ground rules. Managing by consensus is a wonderful thing when everyone agrees but can create gridlock at other times. Make it clear from the outset that while everyone's opinion is valuable, and everyone will get their say, ultimately someone will have to take a final decision. When it comes to decisions about flight safety, that decision belongs to the appropriate functional manger. It is important that the presence of the accountable executive as chair does not create the impression that the committee's decisions constitute direction to responsible managers on matters that are clearly their responsibility and within their own specialist professional fields.
- A successful SMS requires a focused sense of ownership throughout the system. Whilst it is essential that top management commit to doing whatever it takes to improve safety, it is equally important that all employees feel they have a system that values their input and is responsive to their contributions and ideas. In order to achieve this, all employees should have the opportunity to contribute to the development and implementation of the SMS. Employees are ideally placed to understand the most efficient and appropriate safety management mechanisms for their work environment. Their involvement in the decision-making process not only fosters ownership of the system, it also promotes a positive safety culture.
- In effect, the organization is striving to create a shared vision. As such, it is not sufficient for the accountable executive to make a safety policy statement outlining what the organization is committing to, without first acquiring feedback from all employees. One problem with top-down vision statements is that they reflect management's vision and do not always build on the individuals' personal vision. The result can be an authoritarian statement that does not inspire the achievement of a common goal - in this case safety. When people truly share a common vision they are united in a common aspiration, they have a common identity and they have ownership in the system.
- The involvement of employees or their representatives in the development and maintenance of the SMS will also foster the development of a reporting culture within the organization. If you recall the three prerequisite parts for an SMS, an integral part was the development of a robust system for assuring safety. One means of assuring safety is to encourage voluntary reporting. This cannot be successfully achieved without having some level of trust between employees, management and in some instances bargaining agents. In some cases, it may be necessary to enter into agreements with bargaining agents. Keep in mind that it is far easier to achieve a successful outcome when all parties have participated in the development of the SMS and have a clear understanding of what it is and is not. However, it is important to maintain the distinction between this role and the more traditional functions of collective bargaining.
- It should be clear, to all concerned, that safety is not negotiable in the usual sense of the term. Furthermore, just because a particular process was introduced for safety reasons does not guarantee that it was necessarily the best solution or that it is “off-limits” for change. Experience has shown that procedures that were felt to be sound from a safety perspective sometimes can have undesirable safety consequences. There are no “sacred cows” in a good SMS, so it is preferable that safety issues should not be entrenched in collective bargaining agreements.
- The utilization of third party service providers is normal practice in aviation. Depending on the nature of the operating environment this may involve both domestic and international service providers. So how do you manage the inherent safety risks involved with dealing with contractors? How do you integrate them into your SMS?
- There are several approaches that can be taken. The first is to insist contractually that all service providers establish their own SMS. While this should give you the confidence that the organization is managing its own safety risks, it might limit the number of service providers available. This approach has been adopted quite successfully in other high-risk industries such as oil and gas; however, it does take a period of adaptation and persistence to enforce this contractual requirement. In the oil and gas industry, this requirement has had a positive effect; providing increased incentive to companies to establish their own SMS.
- Another option would be to extend your own corporate SMS to the service provider. Given the extensive network of service providers employed by some organizations, economically this might not be feasible. In smaller organizations, it might provide the required level of oversight to ensure that risks are being managed effectively.
- A third alternative would be to ensure that service providers have the ability to report safety hazards into your SMS and establish a method of transferring safety information between yourself and the contracting party. This will involve some level of basic training and an exchange of information, but the investment is minimal given the risk associated with using service providers that are often non-regulated.
- Regardless of the approach taken, there should be a documented statement included in the safety management plan detailing how your organization will deal with third party contractors.
- To ensure that the SMS is working effectively the accountable executive should conduct a periodic review of the SMS processes and procedures. To the extent possible, the review should be conducted by individuals not performing tasks directly related to the SMS. The safety manager for example should not be reviewing the SMS, as he or she is an integral part of the system. The review should also include an assessment of how well the organization is achieving its specific safety goals, the success of the corrective action plans and the risk reduction strategies implemented.
- The review is intended to provide a quality review and to provide a continuous improvement function within the SMS. It may be conducted by doing a traditional checklist audit or it may take the form of an effectivity assessment. Whatever the method, the accountable executive should be informed directly of the results. Essentially, this is the accountable executive's report card on how well the system is performing.
|Component 1 - Safety Management Plan||Yes/No|
|Element 1.1 Safety Policy|
|Is a safety management system with defined components established, maintained and adhered to?|
|Is there a safety policy in place?|
|Is the safety policy approved by the accountable executive?|
|Has the organization based its safety management system on the safety policy?|
|Is the safety policy promoted by the accountable executive?|
|Is the safety policy reviewed periodically?|
|Is the safety policy communicated to all employees with the intent that they are made aware of their individual safety obligations?|
|Element 1.2, Non-Punitive Safety Reporting Policy|
|Is there a policy in place that provides immunity from disciplinary action for employees that report safety deficiencies, hazards or occurrences?|
|Element 1.3, Roles &Responsibilities|
|Has an accountable executive been appointed with responsibility for ensuring that the safety management system is properly implemented and performing to requirements in all areas of the organization?|
|Does the accountable executive have control of the financial and human resources required for the proper execution of his/her SMS responsibilities?|
|Does the person managing the operation of the SMS fulfill the required job functions and responsibilities?|
|Are the safety authorities, responsibilities and accountabilities of personnel at all levels of the organization defined and documented?|
|Do all personnel understand their authorities, responsibilities and accountabilities in regards to all safety management processes, decisions and actions?|
|Element 1.4, Communication|
|Are there communication processes in place within the organization that permit the safety management system to function effectively?|
|Are communication processes (written, meetings, electronic, etc.) commensurate with the size and scope of the organization?|
|Is information established and maintained in a suitable medium that provides direction in related documents?|
|Is there a process for the dissemination of safety information throughout the organization and a means of monitoring the effectiveness of this process?|
|Element 1.5, Safety Planning, Objective &Goals|
|Have safety objectives been established?|
|Is there a formal process to develop a coherent set of safety goals necessary to achieve overall safety objectives?|
|Are safety objective and goals publicized and distributed?|
|Element 1.6, Performance Measurement|
|Is there a formal process to develop and maintain a set of performance parameters to be measured?|
|Element 1.7, Management Review|
|Are regular and periodic, planned reviews of company safety performance and achievement including an examination of the company's Safety Management System conducted to ensure its continuing suitability, adequacy and effectiveness?|
|Is there a process to evaluate the effectiveness of corrective actions?|
- Date modified: