A Safety Management System Primer

Aircraft marshaller (Chaleephoto, Shutterstock)

But when the International Civil Aviation Organization (ICAO) adopted it as mandatory in 2006, I realized that even if it proved a waste of time, I would have to, at the very least, go through the SMS motions. And then something unexpected happened. SMS proved not only useful, but it made me a better and safer pilot. SMS has become more than an academic process for my flight department, it has become a philosophy. If you haven’t taken the SMS plunge yet, or if you are still just going through the motions, please consider a short story that illustrates just how useful working through a problem with SMS can be. And then, consider starting an SMS program of your very own or fully embracing the one you already have.

1 — All of us are smarter than one of us

2 — Getting the team on board

3 — Safety Culture

4 — The Key Parts of an SMS

5 — Getting Started

6 — Phased Implementation

7 — “Certification”

8 — SMS in action

9 — Example Accountable Executive Safety Policy Statement

Note: If you are just getting started with Standard Operating Procedures (SOPs) and want to get up to speed with a minimum of fuss, take a look at the SOP Starter Pack.

"It fits!"

The first time I saw our mechanics tow our Gulfstream G450 into our narrow hangar, I was first alarmed that there were no markings for the center of the hangar floor and then by how quickly the entire operation took place. It was as if they were being timed and got bonus points for bravado. I cautioned them that when towing aircraft, the best you can do is a tie: no damage to the aircraft or hangar, there are no prizes for coming in first. They explained the speed was necessary to get over the bump of the hangar door tracks and that they were using a crack in the pavement for alignment. I told them to stop when the main gear was about five feet short of the hangar door tracks and verify the wings would clear before proceeding. So, we did that, and I thought, “job done.”

Over the years I noticed that the aircraft’s position on the hangar floor varied by five or more feet. With a wingspan of 77’ 4”, we should have had ample space within the hangar door opening of 95’ 4”, ideally 9’ on each wing tip. My next solution was to paint a line right down the middle of the hangar. Once again, I thought, “job done.” While that improved our accuracy, we still seemed to vary about 5’ left and right. The nosewheel may have been on my painted centerline, but the main gear were often anything but equidistant from that line. My autocratic rule as their leader wasn’t as effective as I had hoped.

A few years later, our company asked me to replace the G450 with a G500, which has a wingspan of 86’ 4” empty and 87’ 1” with a full load of fuel. Now we would have only 4’ on each wing and our plus or minus 5’ tolerance wasn’t going to be good enough. Our safety officer thought using the SMS process would give each member of the team a chance to “buy in” to my earlier solutions: slow down, don’t proceed unless the nose gear is precisely on centerline. So, expecting only to have my solutions validated by the group, I filed a Hazard Identification and Tracking form, something our safety officer called a “HIT.” What happened next surprised me.

The team immediately identified two reasons behind our accuracy problem. First, we were approaching too fast, trying to build momentum over the steep rise of pavement just before the hangar door tracks. Second, even if the nosewheel was on centerline that didn’t mean we would have the wings centered if the main gear were not also on centerline. That much, I thought, was obvious. But each member of the team identified a different part of the problem. Then the group found a solution that many of us never considered.

Problem: not all our pilots and ground support personnel understood correct marshalling signals and the result was pilots trying to align the aircraft as best they could, quite often ending up with the nosewheel on centerline and the main gear several feet left or right. Only our former airline and Air Force pilots had ever been formally trained on how to give and receive marshalling signals. None of our ground crew had ever received correct training. Solution: a back to basics marshalling course for everyone.

Problem: the tow team believed they could “save” a bad starting position with creative moves before the wings reached the hangar. Quite often they could get the aircraft properly aligned, but more times than not they ended up with “good enough.” Solution: paint additional lines prior to the hangar door, giving maximum tolerances for the main gear. (If the main gear are not within their lines, the tow team wasn’t allowed to proceed and had to back the airplane out for another attempt.)

Problem: the rise in the asphalt prior to the hangar door tracks meant a minimum speed was needed to overcome the inertia of the aircraft going “uphill” into the hangar. I thought the problem was the hangar track itself and beyond repair. But that wasn’t the problem at all. Solution: rebuild the asphalt prior to the hangar door tracks to make the slope more gradual.

It took a few days to train everyone in proper marshalling procedures, a few weeks to get the new lines painted, and a few months to get the slope regraded. A year later we took delivery of our newer (and wider) aircraft and getting the aircraft precisely on centerline is a matter of routine now. The SMS process allowed us to come up with innovative solutions and, just as importantly, gave everyone a deeper understanding of the problem and the reasons behind our new procedures. On those few occasions where the aircraft isn’t properly aligned, there haven’t been any complaints about having to back the aircraft up for a second try. The entire team has joined me in my zeal for precision.

The Hazard Identification and Tracking process also combined with our Flight Operations Quality Assurance (FOQA) system to improve the way we fly. For example, before we adopted an SMS, FOQA identified an occasional unstable approach at Hanscom Field, Bedford, Massachusetts (KBED), our home field. Many locals prefer to fly inside three radio towers which underlie what would be a normal base turn to Runway 29, and we were no exception. When FOQA identified this as a problem, we thought it was a problem with FOQA, not us. This bugged me because it was our lone exception in an otherwise perfect FOQA report each quarter. I called other local operators with FOQA, and it seemed they all accepted the blemish, there was nothing to be done about it. But one of our pilots saw this as a case for what SMS gurus call the Continuous Improvement Opportunity Program (CIOP). The team realized immediately that the solution was to fly outside the towers, for a final approach that was about a half mile longer than what most consider standard. We worried about what our tower would think about us hogging a little more airspace, but a quick phone call put that to rest. Our SMS program spurred us to stop accepting unstable approaches as beyond our control.

I think every flight operation can benefit from an active SMS program; it will not only make your operation safer, it will also forge your personnel into a team where everyone feels empowered to contribute.

You might have heard that achieving an industry-compliant SMS program is simply a matter of finding a vendor, writing a check, and placing a new binder on your safety officer’s desk. You can find someone who will accept your check and produce just such a binder, but that will not, by itself, get you an SMS program that will pass inspection or do you any good. The key idea when adopting an SMS is that it isn’t something you add to your library of rules and regulations, it is something that is integrated into your existing programs and ties everything together. If this makes it seem like adopting an SMS will be a lot of work, that is because it is. While the process should take many years, each step along the way is manageable. The process never really ends, but you will see benefits almost immediately and as your system matures, the benefits will increase.

The first step is to get everyone’s “buy in” and that step begins with senior leaders. Why, they might ask, do we need to adopt this when we’ve gotten along just fine without it? For most of us, the answer will be that you have no choice: it is required. But that isn’t universally true.

If you are a U.S. commercial operator, you must have an SMS program. The regulatory requirement is in 14 CFR 5.1(a), which says, “A certificate holder under part 119 of this chapter authorized to conduct operations in accordance with the requirements of part 121 of this chapter must have a Safety Management System that meets the requirements of this part and is acceptable to the Administrator by March 9, 2018.” Part 119 defines certificate holders as air carriers and commercial operators under 121, 125, 135.

If you are flying under non-commercial rules, Part 91, and fly internationally, the International Civil Aviation Organization (ICAO) Doc 9859, paragraph 8.4.7 says, “In accordance with Annex 19, the State shall require that service providers and international general aviation operators implement SMS.”

In the United States, that leaves a lone exception to the SMS requirement: domestic-only Part 91 operators. If you fall into this category, an SMS program is voluntary but can be economically beneficial. My Part 91 flight department receives a 15 percent annual discount on our insurance, more than offsetting any costs associated with our SMS program.

Once you have leadership behind you, the next step is to get everyone in the organization on board. It will be helpful to have at least one person trained to speak the SMS language and ready to show the way with your next chance to improve your operation. Most organizations hand this over to their safety officer, but I think it is important to realize that in a robust SMS, everyone is a safety officer. The person with the title helps train others, but in the end, it takes everyone to inculcate a good safety culture.

Aircraft inspector, (Gorodenkoff, Shutterstock)

I was an Air Force safety officer a few times, including my last job at Andrews Air Force Base in Maryland as the 89th Airlift Wing’s Chief of Safety. I supervised ten military and civilian safety officers who oversaw everything from the base firearms range to flight operations that included Air Force One. I knew my officers “got it.” They saw everything through a safety lens and could immediately spot problems and almost as quickly come up with solutions. But, like me, their impact was limited to others who also got it. The troops, unfortunately, viewed safety as an impediment to the job. Safety, they believed, was nothing more than platitudes from senior leadership and waiting for bad things to happen. I had to admit that our safety programs were little more than monthly speeches, a few strategically placed posters, and investigations into mishaps. Despite our best efforts, we still had people getting hurt regularly and we did occasionally damage airplanes. We resigned ourselves to a mission-first culture.

How do you go from a mission-first culture to one that prioritizes safety? You cannot create a safety culture with a few training classes or seminars, and you certainly can’t do it overnight. Adopting an SMS helps develop a healthy safety culture that permeates throughout the entire organization. With practice, repetition, and coaching, a safety culture should become second nature across the entire organization.

Safety Management, (Vitalli Vodolazskyi, Shutterstock)

The key to understanding SMS is realizing that it is a decision-making system designed to change the way you operate. It is built around four components: safety policy, safety risk management, safety assurance, and safety promotion. You will need all four components to reap all the benefits of a robust SMS program.

A safety policy is where the organization sets its Standard Operating Procedures (SOPs) and management conveys its commitment to the safety program. This is typically done in a flight operations manual or other written document that provides easy access to every member of the organization. If you don’t have such a document, you can start with the SOPs in your aircraft manual and a letter from the company that basically says you will follow those, and the company will employ a policy that encourages all members to report any safety issues. (See “Example Accountable Executive Safety Policy Letter.”, below)

A safety risk management program provides a mechanism for people to report potential problems and for the organization to mitigate those problems in a collaborative process. It can be as simple as a blank form or an email to the safety officer, followed by one or more people coming up with a fix.

Safety assurance is a way to monitor and measure how things are going, including those things that have been addressed by the safety risk management program. In short, it answers the question, “did our fixes work?”

Safety promotion lets everyone know that they are a part of the SMS, the organization’s safety priority, reporting procedures, and how risks are mitigated. It should involve regular training and participation.

You may already have most of the basic components of a functioning SMS in place or you may be starting from square one. Back in 2008, I was convinced we could bring ourselves up to whatever SMS requirements were needed to fly internationally and only pay for our audits to document our SMS status. This method helped us to really understand the nuts and bolts of our SMS, but it was a lot of work and took too much of my time. I recommend you get help when getting started.

The easiest way to spool up your SMS program is to hire a company specializing in getting you up to speed quickly; just type “SMS for business aviation” in your favorite Internet search engine. These providers will take your existing manuals and procedures, make them SMS compliant, and will shepherd you through your first audit. Jim Hosey, President of Aviation Consulting / Auditing LLC, offers some insight into the process when going this route. “A smaller flight department will need six months to a year to get started. A larger flight department can spool up in half that time because they have more people to handle the work. In either case, you can be at one hundred percent in two to three years.” He recommends membership in the Business Aviation Safety Consortium (BASC), www.aviationconsortium.com, to streamline the process. Membership runs $5,000 annually.

You don’t have to use a consultant or vendor to start your SMS program, you can do it on your own. Fortunately, there is a lot of help available today to flatten the SMS learning curve. The National Business Aviation Association (NBAA) holds regular SMS Implementation Workshops, normally scheduled at their annual Business Aviation Convention & Exhibition. See https://www.nbaa.org for more information. FlightSafety International and the International Business Aviation Council (IBAC) have co-developed an SMS course designed for flight department managers and those tasked with developing an SMS. See https://www.flightsafety.com/ for details.

I recommend you look at Advisory Circular 120-92B, Safety Management Systems for Aviation Service Providers. While this AC is meant for Part 121 Certificate Holders, the guidance is helpful for anyone getting started with SMS. Another great resource is: https://www.faa.gov/about/initiatives/gasafetyoutreach.

When IBAC first introduced the International Standard for Business Aircraft Operations (IS-BAO) in 2002, the acknowledged progression was to move from an entry level called “Stage 1” and eventually to “Stage 3.” Some operators thought that Stage 3 meant you were done and that from that point on you could coast. Of course, this isn’t true. You don’t need to follow the IS-BAO model at all, but you do need to implement your SMS with the idea it is a continuing process. AC 120-92B recommends a phased approach using four levels of implementation.

SMS implementation levels, AC 120-92B, fig. 401

Level 1 is for planning and organization. This is where you get everyone on board, identify what you already have and what you will be needing. I recommend sending at least your safety officer to training. Hiring a consultant at this point can speed the remaining steps considerably.

Under level 2, you have in place a basic safety management system and will develop your safety risk management and assurance programs. Members of your organization should be able to identify hazards and unacceptable risks, know how to report these, and participate in teams designed to identify solutions and mitigate the risks.

With level 3, you will have a fully functional SMS and will be able to further use your safety risk management and assurance programs in a proactive manner.

Level 4 is for continuous improvement. All required SMS processes are in place, and you will continuously monitor your SMS for the life of your organization.

If you are a U.S. commercial operator, you will need to prove you have a qualified SMS under 14 CFR 5. If you are flying internationally as a U.S. operator under Part 91, you will need to prove you have a qualified SMS under ICAO Doc 9859. The most effective way to prove your SMS bona fides is through an audit from an approved SMS auditor. This will provide more than just peace of mind; it should expedite international ramp inspections. If, for example, you are given a Safety Assessment of Foreign Aircraft (SAFA) under the European Union Ramp Inspection Program (EU-RIP), having an SMS Certificate from an accredited auditor may satisfy many of the inspector’s questions.

With or without that piece of paper saying you have an SMS program, you should realize that SMS is never done, it is a continuing process. Even after you have your operation in what appears to be “tip top” shape, realize that SMS will be needed to face the changes sure to come.

There is no doubt a SMS can improve your organization during the early implementation and development stages, but the benefits may prove even more valuable with the inevitable changes over time. In the many years since we considered our SMS fully implemented, we’ve used several parts of our program to face challenges as they occurred and even to anticipate them before they could become problems. Here are a few examples of our processes in action.

Our Hazard Identification and Tracking (HIT) program quickly became my favorite as it slayed one problem after another. Everything from the way we towed our aircraft to the way we entered a VFR traffic pattern was improved. But it really earned its place in our arsenal the day I was called about one of our passengers slipping on our hangar floor. The center of our hangar floor had an anti-slip coating, but on that day the ramp was covered in snow and the passenger decided to take a shortcut away from the center. The solution, of course, was to recoat the entire floor with the abrasive coating. The reason I was impressed was that the hangar manager, who felt somewhat responsible, didn’t think twice about filing the HIT. I can imagine a few years ago the thought would have been to dismiss the incident as “one of those things” and I might not ever have heard about it.

A good SMS program should have an Emergency Response Plan (ERP) that is well thought out and has been practiced regularly. We had such a plan but never practiced it until one of our audits flagged us for this. At our first practice, a line technician said there was no way he was going to remember the right words if he were contacted by the press so his plan would be to do the “Sergeant Schultz” routine, saying “I know nothing.” One of our pilots filed a Continuous Improvement Opportunity Program (CIOP), saying we should give everyone a wallet card with the pre-approved statement. Along the way the team also thought it would be good to have key phone numbers on the reverse of the card.

We give everyone in our organization a chance to rate our “Operator Safety-Risk Profile” at least once a year and whenever we have changes in personnel or equipment. The form we use track operational things like our local airport’s approaches, technical factors like problems with our aircraft, and human factors like the number of pilots or mechanics. Over the years our only instances of identified elevated risk happened after one of our pilots was medically grounded just as another quit and when our aircraft’s operations were significantly curtailed due to a fleetwide limitation. In both cases we were able to proactively adjust our operations to accommodate the elevated risks.

You are not alone if you recoil from all the alphabet spaghetti. HIT? ERP? CIOP? Those acronyms are purely optional; the important thing is the culture that goes along with them. A good safety culture fosters in everyone the idea they can report any problem without fear of repercussion. They should appreciate that no matter where in the organization they are, they can come up with an idea to make things better and know that idea will be treated seriously.

Our Safety Management System has proven itself time and again, coming up with innovative solutions to identified problems and anticipating other risks before they become problems. SMS has made us all safety officers and has changed our operational culture into a safety culture.

If you don’t have an SMS program, you need one. It will take time, but you can get there in small steps. You will reap benefits with each step along the way. If you already have an SMS but you haven’t given it a thought since your last audit, you should evaluate your safety culture with the thought you can make it even better.

Your safety policy must include a statement from the organization’s “accountable executive.” Appendix 4 of Advisory Circular 120-92B presents a flowchart to help you determine who your accountable executive is. The AC also provides an example policy statement:

14 CFR Part 5, Safety Management Systems for Certificate Holders Operating under 14 CFR Part 121.

Advisory Circular 120-92B, Safety Management Systems for Aviation Service Providers, U.S. Department of Transportation, Federal Aviation Administration, 1/8/15.

Annex 6 to the Convention on International Civil Aviation, Part 1, International Commercial Air Transport, Aeroplanes, Eleventh Edition, July 2016.

International Civil Aviation Organization (ICAO) Document 9859, ICAO Safety Management Manual, Fourth Edition, 2018.

FAA Public SMS Web site: http://www.faa.gov/about/initiatives/sms/specifics_by_aviation_industry_type/

ICAO SMS Training Web site: https://www.icao.int/training/pages/safety-management-training-programme-(smtp).aspx