SMS For Small Organizations: March 2015

SMS for Small Organizations
SMS for Small

Organizations
March 2015
1|Page
Table of Contents
Introduction................................................................................................1
Guidance to Small Organizations on Implementing SMS ................................................... 1
How Complex is the Small Organization? ......................................................................... 1
1 Safety Policy and Objectives ....................................................................3
1.1 Management Commitment and Responsibility ............................................................. 3
1.2 Safety Accountabilities .............................................................................................. 4
1.3 Appointment of Key Safety Personnel......................................................................... 4
1.4 Coordination of Emergency Response Planning .......................................................... 5
1.5 SMS Documentation ................................................................................................. 5
2 Safety Risk Management ..........................................................................6
2.1 Hazard Identification ................................................................................................. 6
2.2 Safety Risk Assessment and Mitigation ...................................................................... 9
3 Safety Assurance .....................................................................................9
3.1 Safety Performance Monitoring and Measurement....................................................... 9
3.2 The Management of Change ................................................................................... 12
3.3 Continuous Improvement of the SMS ....................................................................... 13
4 Safety Promotion ................................................................................... 14
4.1 Training and Education ........................................................................................... 14
4.2 Safety Communication ............................................................................................ 15
5 Dealing with Contractors and Other Organizations ................................ 15
5.1 People Contracting to You ....................................................................................... 15
5.2 Organizations That You Supply with Products or Services .......................................... 16
Appendix 1: A Step by Step Guide for Small Aviation Organizations —...... 17
Guidance for Implementation ................................................................... 17
Appendix 2: Example of a Very Small Organization SMS Manual ............... 21
Appendix 3: A Sample SMS Manual Format for a Small Organization ........ 23
Appendix 4: Sample Hazard Logs .............................................................. 24
Hazard Log for a Small Organization......................................................................................24
Hazard Log for Very Small Organization ................................................................................24
Appendix 5: Safety Report Form Template for a Small Organization ......... 25
Appendix 6: Safety Report Form Template for a Very Small Organization . 27
Appendix 7: The Five Whys Approach for Root Cause Analysis.................. 29
Appendix 8: Investigation Form Template for a Small Organization ......... 31
Appendix 9: Risk Management Procedures for a Small Organization......... 33
Appendix 10: Risk Management Procedures for a Very Small Org. ............ 35
Appendix 11: Safety Performance Indicators for a Small Organization ..... 36
Appendix 12: Corrective and Preventive Action Report Template.............. 37
Appendix 13: Management of Change Template........................................ 38
i|Page
Introduction
Guidance to Small Organizations on Implementing SMS
The introduction of safety management systems (SMS) across the aviation industry
brings some specific challenges for small organizations. Indeed, some small
organizations may feel that SMS is too complex or too costly to implement. This
guidance has been written for any small organization that operates or provides services
in civil aviation.
We hope to show that implementing an SMS is probably much simpler than you think;
many small organizations already have many of the elements of an SMS in place.
Throughout this guidance, we consider an organization with between five and twenty
staff as a Small organization, and one with less than five staff as Very Small. However,
your regulator may not define smaller organizations this way.
SMS can be boiled down to a very simple concept:
 Actively look for safety issues in your operations, products, or services;
 Develop corrective actions to reduce the risks those safety issues present; and
 Monitor to be sure that you have appropriately controlled those risks.
An SMS does not have to be complicated to be effective.
Before starting to implement your SMS, talk to your regulator to find out what is required
for the size of your organization. Then carry out a gap analysis to compare what you
have already with what is required and see what is missing. As with any management
system, it is also important to remember that your SMS should be customized to reflect
your organization and the operating environment. But read the rest of this guide first!
How Complex is the Small Organization?

It is not just the size of the organization that matters but the risk and complexity of the
activity.
Complexity considerations include:
 Operating environment (mountainous terrain, arctic operations, offshore
operations, etc.);
 Types of operations (passenger operations, cargo, aerial work, Emergency
Medical Services, etc.);
 Fleet complexity, such as number of aircraft or aircraft types;
 Number of locations (bases);
 Maintenance organisations; number of ratings, types of product ratings,
specialized work, technologies employed, number of customers and sub-
contractors;
 Types of products and parts designed/manufactured;
 Number of aircraft movements (aerodromes and Air Navigation Service
Providers(ANSPs));
 Surrounding terrain and levels of equipment at aerodromes;
1|Page
 Density and complexity of traffic for ANSPs;

 Extent of contracted activities; and
 Number of runways and taxiways at aerodromes.
Your regulator may decide what constitutes a “small organization.” Several regulators
have produced guidance material covering SMS for small organizations, listed in
Appendix 17, Existing Regulatory Guidance Material. It might be useful to draw your
regulator’s attention to some of this guidance material.
Visit the Safety Management International Collaboration Group (SM ICG) page on
SKYbrary, where you will find some useful links to additional SMS material in the SMS
for Small Organizations article, located under the Guidance/Tools heading. This will
include guidance, tools, forms, and templates that can be customized for your
organization. You will need to contact an SM ICG member to gain access to a
customizable version of the templates and tools (see contact information on the back
page).
Appendix 1, A Step by Step Guide for Small Aviation Organizations — Guidance for
Implementation, provides a step by step guide on how to implement and develop your
SMS to help make your organization safer.
The following guidance material contains some thoughts on how you might implement
the 12 International Civil Aviation Organization (ICAO) elements of an SMS. As a
reminder, make sure that you review your own regulator’s requirements and guidance
as they will need to be complied with first.
2|Page
1 Safety Policy and Objectives

The policy and objectives set out what you want to achieve. It is the best place to start;
if you do not know what you want to do, you are probably going to have a really hard
time doing anything useful!
Safety objectives define what your organization hopes to accomplish with your SMS. It
is a statement of a desired outcome and should be a short, high-level statement of your
safety priorities. Safety objectives should address your organization’s most significant
risks. Goals or targets should be established to achieve each safety objective. Ideally
they should be SMART:
Specific Each target should be focused on one thing only.
Measurable You should able to measure whether or not you hit the target.
Achievable The target should be within your organization’s capabilities.
Relevant The target should be something of importance or significance to safety.
Timed There should be a deadline for achieving the target.
Example:
Safety objective To gain a full picture of the safety hazards in our

operation.
Goals or targets Conduct quarterly hazard identification workshops.
Increase the number of voluntary reports received by
20% this year.
Safety performance indicators Number of hazard identification workshops carried out
this year.
Number of new hazards identified through workshops
conducted this year.
Number of hazard reports received per employee this
year versus last year.
(See Section 3.1 for further information on safety
performance indicators (SPIs).)
Ideally, you should include your safety objectives and how you intend to achieve them in
a simple safety plan.
1.1 Management Commitment and Responsibility

Management commitment means that the management is totally committed to safety.
Develop a statement of your commitment by writing and signing your Safety Policy.
Make it clear that you will do what it takes to meet that commitment. Outline your safety
reporting policy; your staff needs to know that you will operate a fair reporting system,
3|Page
and what type of behavior would attract disciplinary action. Then sign it, post it in a
prominent place – and live up to it!
Your Safety Policy should set out what you want to achieve and how you mean to
achieve it. In addition to your safety commitment statement and your safety reporting
policy, it should also include your key safety objectives.
It is important that everyone sees the Safety Policy. In a Small organization, you could
circulate it and have everyone sign as having read it, as well as posting it on the notice
board.
For a Very Small organization, the Safety Policy can be very brief, as demonstrated in
Appendix 2, Example of a Very Small Organization SMS Manual.
1.2 Safety Accountabilities

Nominate the Accountable Executive who has the ultimate accountability for Safety – it
is probably you.
1.3 Appointment of Key Safety Personnel

In a Small organization, it is a good idea to appoint someone to look after the day-to-day
running of the SMS. They will be responsible for making sure that safety reports are
acted on and documented, etc. This person may need some training to be as effective
as possible in his/her SMS role.
In a Very Small organization, this might be the Accountable Executive.
1.3.1 Person Responsible for the SMS

The person responsible for the SMS should ideally have some operational experience
and understand the systems that support your operation. He/she should have an
understanding of safety management principles, ideally acquired through formal training
and practical experience. In a Very Small organization, this may be acquired from SMS
guidance material.
1.3.2 Responsibilities
The person responsible for the SMS will:
 Ensure that the SMS processes are established, implemented, and maintained;
 Promote safety awareness and a positive safety culture;
 Liaise with the authorities on safety-related issues;
 Exchange valuable lessons learned with other organizations;
 Manage internal incident and accident investigations;
 Ensure identified hazards and issues are being managed;
 Maintain safety documentation; and
 Organize safety training.
4|Page
1.4 Coordination of Emergency Response Planning

Coordinate your emergency response plan (ERP) with other organizations that may be
affected and with the emergency services, so that you all know where to go and what to
expect if they get the call. If you do not have an ERP, think about the sort of
emergencies you might face and work from there.
1.5 SMS Documentation

You do need to document your SMS, but you probably have some of the documentation
already, and the rest should be fairly easy to put in place. You have your Safety Policy
and objectives and you have named your key safety personnel. You will need some
documentation about your risk management processes, incident investigations, and so
on (these are covered later). Your SMS Manual might be a very short, simple document
mainly referencing your existing procedures, or you might just add a section to your
operating manual. For more information, see Appendix 2, Example of a Very Small
Organization SMS Manual.
1.5.1 Considerations for Documentation

SMS documentation is the basis for sharing your Safety Policy and explaining your SMS
processes to everyone. In addition, it is important that there are records of your safety
management activity. For Small or Very Small organizations, clear documentation
makes sure that everyone including your staff members, your contractors, and your
regulator understand your SMS.
Keep your SMS documentation simple, concise and to the point. You may need to
produce an SMS manual, but it can refer to existing documentation that covers SMS
requirements.
Sample SMS Manuals are available and might be used as a basis for your own, but do
not simply copy them. Yours should be a living document that reflects the structure, the
processes and the features of your organization. Appendix 3, A Sample SMS Manual
Format for a Small Organization, provides an example of a contents page for an SMS
Manual.
The SMS documentation does not need to exactly follow the format of the regulatory
framework, but it should describe clearly who does what, when, where, and how as well
as show that your SMS meets the requirements. Don’t forget that SMS Documentation
includes additional records such as:
 Records of audits, safety meetings and management reviews;
 Records of risk assessments; and
 A Hazard log or risk register with records of actions.
5|Page
1.5.2 Writing Procedures

A good SMS will have good supporting procedures related to the operational processes
to be followed. To ensure these are effective and error free, we recommend that you
consider the following seven points.
1) Be Clear and Concise. Make sure procedures are easy to understand and
follow.
2) Be Correct. Make sure they are grammatically correct with no spelling errors.
3) Be Consistent. Use the same format and delivery system for all procedures.
4) Be Complete. Review and test a procedure with someone who does not know it,
to make sure no steps have been omitted.
5) Be in Context. Ensure that actions properly describe the activity to be
performed.
6) Be in Control. Incorporate feedback and process controls to be effective and
remain effective.
7) Be Compliant. Make sure that procedures comply with any requirements, such
as user needs, national regulations, and company policies.
2 Safety Risk Management

This is where you work out the risks you face and decide how to reduce them.
2.1 Hazard Identification

Hazard identification is vital and sometimes it is easier to refer to hazards as safety
issues. Safety issues can be anything that could lead to an aircraft accident; unless you
know what hazards are out there, you cannot identify the risks they pose. And if you do
not know what the risks are, you cannot do anything about them.
Do not leave the identification of safety issues to chance; develop a simple process to
actively look for safety issues. Some safety issues can be identified from occurrence or
incident reports, some may be reported by individuals, and others may be the result of
proactive brainstorming sessions. Encourage everyone to report any safety issues they
find. Where aviation safety is concerned, it is better to follow a few false trails than to
miss a lurking disaster. Publicly celebrate good reporting.
You will need a Hazard Log to record the safety issues people find or think of, but it can
be very simple. It might be a notebook in the crew room or a sheet on the notice board.
It should be easily accessible and visible; it is for everyone. Encourage people to
comment on the safety issues others have logged.
Appendix 4, Sample Hazard Logs, contains examples of Hazard logs for Small and Very
Small organizations.
2.1.1 Reporting System

Hazards or safety occurrences can only be controlled if their existence is known.
Underlying issues that have the potential to endanger the safety of aircraft operations
can be identified through a safety reporting system. Safety reporting can be reactive
(from an event that has happened) or proactive (from a potentially unsafe situation
being identified).
6|Page
Reporting of less significant incidents, which may not be subject to mandatory reporting,
should be actively encouraged. This will give you a better understanding of what is
going on and allow you to monitor your organization’s safety performance and help to
identify developing safety trends. Encourage all issues to be reported and then decide if
they need investigating.
For the reporting system to be effective, everyone connected to the organization,
whether internally or externally, needs to actively participate. Everyone needs to be
clear about how to report, what to report and who to report it to. Information from the
reports can then be used to identify safety risks so that appropriate action can be taken.
You can also ask organizations and customers that use your products or services to
report any safety issues that are related to what you have provided. Be sure to give
feedback to the person reporting an event so they can see that reports are taken
seriously and acted on; this will encourage further reporting.
The Safety Reporting Form is a good way to gather this vital information. The person
responsible for the SMS (described in Section 1.3.1) is the best person to manage
these reports and assign them to the appropriate person for action. Safety reporting in a
Very Small organization may be by word of mouth but it is important that it is still
documented so it is not lost or forgotten. Examples of templates for a Safety Reporting
Form can be found in Appendix 5, Safety Report Form Template for a Small
Organization, and Appendix 6, Safety Report Form Template for a Very Small
Organization.
Safety reports should be used to enhance safety rather than to apportion blame. To
encourage reporting without fear of repercussion, it is important that staff members
understand the open and just culture expressed in your reporting policy.
2.1.2 Reporting Policy

For Very Small organizations, a separate reporting policy may not be required if
individuals are intimately involved in most aspects of the organization’s operations and
employees feel free to report safety-related information.
A Small organization should have a reporting policy so that everyone has a clear
understanding of the organization’s values regarding the reporting of safety-related
information and how it encourages a healthy reporting culture.
In a Small organization, the reporting policy could be combined with the Safety Policy
and should:
 Encourage employees to report hazards, incidents or accidents; and
 Define the conditions under which punitive disciplinary action would be
considered (e.g., illegal activity, negligence, wilful misconduct).
A sample Safety Reporting Policy is as follows:
Our organization fully supports and encourages a culture of openness and trust
between all personnel. This cannot be achieved unless employees feel they are able to
report occurrences or hazards without the fear of unwarranted retribution. To that end,
7|Page
personnel reporting safety-related issues shall not be subject to disciplinary action

except where there is clear evidence of:
 Gross negligence;
 Intentional disregard of regulations or procedures;
 Attempted cover up;
 Criminal intent; or
 Use of illicit substances.
2.1.3 Investigation
There are times when further investigation of a safety issue is necessary to determine
the exact cause and the contributing factors. You do not want to develop a corrective
action only to find you have not solved the underlying problem. Using a root cause
analysis method for investigations will help to get to the main issue that is causing your
problems.
You may not have the time or resources to investigate everything that is reported, so it
is best to define when you will investigate an issue. For example, it does not make
sense to investigate a problem that is of negligible consequence, but you would
certainly want to investigate a problem that is both likely and potentially serious.
A simple approach is to review the safety reports and any operational occurrences and
then use the risk matrix to assess the need to investigate. Document the investigation
and add the outcomes to the Hazard Log. The following is a generic investigation
approach.
 Gather information.
o What happened, when, and where?
o What is the impact on the organization?
o What were the conditions and actions that led to the safety issue?
o Who was involved?
 Interview those involved.
 Analyze the information.
o Examine all the facts and determine what happened and why (the root
causes).
o Assess whether this event or something similar has happened before
o Identify contributory factors, such as:
 Job factors (e.g., Did the work require too much or too little attention?
Were there distractions or conflicting demands? Were the procedures
adequate and properly understood?);
 Human factors (e.g., physical ability (size and strength), competence
(knowledge, skill and experience), fatigue, stress, morale, alcohol or
drugs);
 Organizational factors (e.g., work pressure, long hours, availability of
sufficient resources, quality of supervision, safety culture);
 Plant and equipment factors (e.g.. clarity of the controls and
8|Page
instrumentation, layout, the role of unusual circumstances); and

 Unsafe acts: Most safety issues are caused by unsafe acts whether
deliberate or unintentional. By identifying unsafe acts and
understanding what drives them you can establish a lasting and
valuable safety culture.
 Identify suitable corrective actions.
 Draw up the action plan and implement it.
o Corrective actions may need to be prioritized due to resources and
practical implementation timescales. Keep employees fully informed of
the corrective action plan and progress with its implementation.
Appendix 7, The Five Whys Approach for Root Cause Analysis, provides an example of
this method.
Upon completion of the investigation using this example or another method, you should
document the results of the investigation and summarize on the Hazard Log for tracking
purposes and to identify any follow up activities. Follow up is needed to ensure the
problem has been corrected or adequately controlled. An example of a template for an
investigation form can be found in Appendix 8. Investigation Form Template for a Small
Organization.
2.2 Safety Risk Assessment and Mitigation

You will also need a process to identify what could happen as a result of each safety
issue (the consequence) and assess how bad the outcome will be and the likelihood of
it happening (the risk). Risk assessment, put simply, is determining whether you can
accept the risk as it is; if not, you must do something to reduce it (control or mitigation).
A risk matrix may be useful, but in a Very Small organization, it may not be necessary.
Examples of risk management procedures can be found in Appendix 9, Risk
Management Procedures for a Small Organization, and Appendix 10, Risk Management
Procedures for a Very Small Organization.
The summary of the risk assessment should be documented in a Hazard Log. This
should include the risk assessment for each hazard and any actions required to control
the risk.
3 Safety Assurance
If you do not know how well you are doing, you will not know how to do better; and we
can all do better.
3.1 Safety Performance Monitoring and Measurement

Decide how you will measure your safety performance. Look for things that do happen,
not things that do not. The number of safety issues reported or resolved is a more
useful measure of safety performance than the number of accidents, unless you have a
lot of accidents! Keep monitoring to see how you are doing and whether your
9|Page
mitigations are working as planned. Then take action if things are not improving. In
addition to using SPIs, you can use your internal audit or review to check your
performance.
The SM ICG document Measuring Safety Performance: Guidelines for Service
Providers provides additional guidance on establishing SPIs.
3.1.1 Safety Performance Indicators: Why Do You Need Them?

Your SPIs are used to monitor how close you are to achieving your safety goals,
targets, and objectives. These will help you see how effective your SMS is. Rather
than just using the numbers for the annual management review, monitor your SPIs
regularly so that you and your organization can see how well the SMS is performing.
This will allow you to take action when you start to see undesirable trends.
Make sure that everybody knows what the SPIs are and what targets have been set;
this will enhance the commitment to safety and make clear what the organization is
trying to achieve through its SMS.
3.1.2 How to Go About Setting Your SPIs

Focus on developing SPIs for what is important to you and to measure the effectiveness
of your SMS and your safety performance. There are some generic SPIs that apply to
all organizations, others that will apply to your type of organization, and perhaps some
that apply only to you. Your regulator may identify specific SPIs that it wants you to
measure.
Generic organizational SPIs include:
 Number of major risk incidents (as defined in your Safety Management Manual),
 Number of mandatory reports,
 Number of voluntary reports,
 Number of overdue safety report closures,
 Number of safety meetings,
 Number of safety briefings, and
 Number of safety audits.
These indicators are all easily monitored and show the organization’s general safety
health. You will need to set targets for each, probably on the basis of number of events
in the previous 12 months or by calendar year; make sure this is stated clearly.
Appendix 11, Safety Performance Indicators for a Small Organization, shows some
examples, but the SPIs and the specific targets may not be right for your organization.
Mandatory reports indicate things that went wrong, so the target should be “less than x”
or “reduce by __%.”
Voluntary reporting offers an opportunity for improvement, as well as being an indicator
of a good safety culture, so the target should be “more than y” or “increase by __%.”
Encourage your staff to report every safety issue they see, so that you can deal with
these issues; if it is not reported it cannot get fixed. A large number of voluntary reports
is a sign of a mature SMS; it is not necessarily a sign of bad things happening.
10 | P a g e
It may be more useful to monitor some SPIs against the number of movements (e.g.,
flights, flying hours, maintenance cycles), as this will allow for changes in your
operation. So, for example, if your target was less than 2 mandatory reports per year
and you bought a second aircraft, you would need to change your target, probably to 4
reports per year. But if your target was 2 reports per 1000 flights, doubling the number
of aircraft would have no effect on the target.
Be careful when reviewing SPIs, unless you have a reasonably large number of events.
A change from one to two incidents per year is a 100% rate increase, but is not nearly
as useful an indicator as a 10% change from 50 to 55.
The following are examples of organization-type SPIs.
 Operator: Number of flights flown with operational Minimum Equipment List
(MEL) restrictions
 Aerodrome: Number of runway incursions, number of bird incidents
 Maintenance: Number of maintenance errors
 Air Traffic Service (ATS): Number of airspace infringements, number of losses
of separation
You will need to think carefully about these. Good indicators will help you improve
safety, while poorly thought out indicators may just waste everybody’s time.
Only you can decide if, and what, indicators are applicable and valuable to your
organization.
Finally, once you have set these targets, be sure to regularly measure your actual
performance against them. That will tell you how well you are doing.
3.1.1 Internal Audit

No matter how small your organization, an internal audit will assess your processes and
procedures and give you a level of confidence that everything is being done properly
and your staff members are following your policy and procedures.
Audits should be carried out by someone who is independent of the process being
audited and any findings from audits recorded, together with the agreed corrective
actions. These findings may be new hazards or weaknesses in your defences so you
should capture them in the Hazard Log.
Even in a Small organization it may be challenging to establish an independent internal
audit. You might consider using an external auditor, but we encourage you to do the
audit internally. Experience shows that this will give you a better insight into your
operations and your business.
Audits should be more than checking items on a compliance checklist; they should look
at the effectiveness of processes, identify corrective and preventive actions, and check
on any follow up and continuous improvement. An important area is the identification,
analysis, and follow up of safety issues. The auditor should review the Hazard Log
before auditing a business area to check that those mitigations are in place and
working.
11 | P a g e
 Tools: There are many examples of audit tools available, including the SM ICG
SMS Evaluation Tool that can be found on SKYbrary. But if you use one of these,
you should tailor it to your organization to gain the most benefit.
 Frequency: Audits and reviews should be carried out at least annually, but
covering the scope in several smaller audits or reviews may be more productive
and effective.
 Addressing Findings: Audit and review findings should be addressed with
preventive and corrective actions. A template for managing this can be found in
Appendix 12. Corrective and Preventive Action Report Template.
3.2 The Management of Change

Change brings risk, whereas managing change reduces the risk.
Whether it is the introduction of a new aircraft type, a new maintenance procedure, or a
move to new premises, your SMS needs to cover the identification of any changes that
may pose a risk to aviation safety. These include the changes that would have a
noticeable impact on your resources, materials, procedures, processes, training,
management control, and above all your people. Your management of change
processes will help you identify potential problems.
3.2.1 Considerations for Managing a Change

Typical changes include:
 Organizational change (a new executive, the departure of experienced

personnel, organizational restructuring);
 Operational change (a new aircraft type, a new contract, new systems, new
operating procedures); and
 Physical change (a new facility, a new base, aerodrome layout changes).
Risk assessment is a key part of the process, so when you decide to make a change,
start by assessing the overall risk of the change itself. It may be that the change is
simply not worth the risk or that the risk of not making the change is just too high. You
have probably done this intuitively, but make sure you involve the right people as they
may bring up risks you had not taken into account. This may mean involving people
from outside your organization (key stakeholders).
Once you decide to go ahead, identify all the factors that must be considered. For
instance, if you plan to introduce a new aircraft type, you will probably need to consider
aircraft certification and registration issues, training requirements and schedules and
maintenance arrangements among other things. Do not forget to ask the question, "Is it
suitable for our operations?". You will need to determine when things will need to
happen, who will be involved, what needs to be done beforehand, what will happen
next, and so on.
Once you have your basic plan in place, you can start to identify and manage the risks.
And remember, introducing any new procedure, operation, or equipment type is likely to
bring new safety risks.
12 | P a g e
You should include a risk assessment of each issue, so that you can take any
necessary steps to minimize the risks and their potential effects. For example: What is
the likelihood that the training will not be completed as scheduled? If the training is late,
what will be the effect on your operations and your business? And how will you
minimize the risk?
Be prepared to manage the effects of changes in other organizations on your operation.
For example: How would it affect your organization if your third party maintenance
provider had a significant leadership change or a move to another location? How would
it affect your organization if your ANSP was to reduce operations at your aerodrome?
Document what you plan to do and what you actually do at each stage. This will help
you and others to see what went well and what did not. This will also help provide a
historic record of why certain actions were taken as the organization continues to
improve and expand its operations.
Appendix 13, Management of Change Template, provides material to help you
document the change in a structured approach.
3.3 Continuous Improvement of the SMS

‘Safe enough’ is not the same as ‘safe’. You can always do better and your SMS is
your main tool, so working to improve it is a good way to become a safer organization.
Two important paths to improvement are the internal audit (covered in Section 3.1.1)
and the Management Review for effectiveness. If you have a quality management
system (QMS) in place, you are probably doing these already; they may just need some
adjustment to the SMS environment.
3.3.1 Management Review

The Management Review lets you judge how effective your SMS is. Review your SMS
at least once per year and look at your safety performance indicators, the results of
audits, and the risk mitigation actions you have implemented. These should give you an
idea of how well your SMS is performing and what you might change to improve it.
Write down the results so that you and your staff can track your progress.
To ensure the continuing adequacy and effectiveness of the SMS, the Accountable
Executive should conduct periodic reviews of SMS processes and procedures, and
evaluate the organization’s safety performance.
Organizations should monitor their safety performance indicators as part of the
management review process. For Small and Very Small organizations, Management
Reviews should:
 Be conducted periodically (usually annually) or more often if there is a need; and
 Cover at least the following topics:
o Audit/review results;
o Safety objective achievement results;
o Hazard and event status and results;
o Corrective and preventive action(s) status and results;
o Training program effectiveness;
13 | P a g e
o Follow up actions from previous management reviews;

o Changes that could affect the SMS; and
o Recommendations for improvement.
Management review can be conducted via a safety review meeting, and actions
documented in a form, such as the template in Appendix 14, Management Review
Template.
The expected result of management review is to answer the question: How effective is
your SMS?
4 Safety Promotion
Keep the safety message alive and well; tell your people, tell your customers, tell
everyone!
4.1 Training and Education

You and your staff need SMS training. Your safety manager, if you have one, should
certainly be given some SMS training. He or she should then know what is needed for
the rest of the staff and will probably be able to deliver the training.
4.1.1 The Basic Requirements

Very Small Organization Safety Training: The simplest way is to require all staff to read
and understand the SMS Manual and sign for reading the manual as part of the Training
Record.
Small Organization Safety Training: All staff members need to understand their role
and responsibilities in the SMS and this can be done through training and/or reading
and understanding the SMS Manual. All training needs to be recorded.
4.1.2 What is Involved?

Key Issues: It is important to ensure that your staff are trained and competent to carry
out their safety-related functions. Training should suit the size, the management style,
and the needs of the company. Training could be computer or classroom based,
supplemented by reading specific training material. The delivery method is not
important; what is important is that your staff are trained and understand how your SMS
works.
All staff need to be trained on how to report safety issues, why it is important and what
safety issues should be reported.
Your training program should include:
 Importance of the SMS;
 Employee’s responsibilities for safety;
 SMS policy and processes in your organization; and
 Safety reporting (why, what and how).
Refresher Training: Your safety training program should include periodic refresher
training; this could involve regular briefings rather than formal training sessions, or a
14 | P a g e
workshop format where the staff can discuss hazards or safety issues and risk
mitigations. It is useful to include lessons arising from incidents and investigations, both
internal and external.
Training Plan and Record: You should have a training plan, which includes as a
minimum a list of staff requiring SMS training and a record of when the specific safety
training (including refresher training) took place.
Training Materials: Some regulators have online training packages (some can be
tailored) that could fulfil the training needs on general concepts, though you may still
need to develop specific training for your organization. Your training material should be
reviewed from time to time to ensure that the training continues to meet the needs of
your staff and the organization.
Safety education is an ongoing process; try to make safety-related information
(magazines, books, pamphlets, posters, videos, DVDs, online resources) readily
available.
Your training program should be reviewed for effectiveness during the Management
Review process. See the Training and Safety Promotion Review section in Appendix
14, Management Review Template.
4.2 Safety Communication

Safety communication is about letting people know what the safety issues are and what
is being done about them. You could bring this into your crew briefings or staff
meetings; you might put a regular safety bulletin on the notice board. It is a good idea
to have a formal safety meeting from time to time, so that your staff can discuss the
various issues in an open forum; it would also give you the opportunity to tell staff about
the successes (or failures) of the SMS and about any planned changes.
The most important thing is to lead by example. Showing that you are committed to
safety will help to develop a strong safety culture in your organization.
5 Dealing with Contractors and Other Organizations

We hope this material helps you on the path to a successful, effective SMS. Now that
you have some ideas on implementing all 12 ICAO elements for an SMS, it is also
important to consider the interactions with your contractors in respect of your SMS.
Your SMS does not just apply within your organization; it extends down to people who
supply you with products and services and it extends up to organizations that you
supply with products or services.
5.1 People Contracting to You

It is your responsibility to make sure that your SMS is not compromised by services or
products provided by third parties.
Some of these third parties may not have (or require) an SMS, but you should make
sure that they are not going to compromise safety for your organization. Even if the
third party has an SMS, you should be prepared to check that it is effective. In either
15 | P a g e
case, you might carry out an inspection or audit. If there is no SMS, there may be less
to audit and it exposes your organization to more unknowns.
It is useful to work out a scheme for sharing safety data with your third party contractors:
their hazard and occurrence reports may alert you to a potential problem, and vice
versa. This could be done through meetings with your key contracting organizations.
For example, if the contracted maintenance organization discovers a problem with
something it has done for another customer operating the same aircraft type as you, the
company should alert you too. And if you have a problem that might have arisen from
its maintenance activity, the company needs to know.
It is important to include your SMS requirements in any contract or service agreement;
your contractors need to understand your expectations from the outset, which should
include how safety issues are reported.
5.2 Organizations That You Supply with Products or Services

If you supply products or services to an organization that operates an SMS, that
organization may, indeed should, check that you are operating an effective SMS.
You should be prepared for the organization to ask to review your documentation or
carry out an inspection or audit. They might have some suggestions for improvement
which benefit both organizations. It is important that you report issues related to their
operations that you identify.
16 | P a g e
Appendix 1: A Step by Step Guide for Small Aviation

Organizations — Guidance for Implementation
The following is a summary of the main considerations when implementing an SMS within a
small aviation organization.

IMPLEMENTATION GUIDE
Step 1 GAP ANALYSIS 1.1 Review the requirement of an SMS
1.2 Identify what you have
1.3 Identify what you need
Step 2 DESIGN AND DEVELOPMENT 2.1 Implementation Plan
2.2 Document your SMS
Step 3 INTRODUCTION AND 3.1 Get your people involved
ROLLOUT 3.2 Communicate the changes
3.3 Set a realistic timeframe
Step 4 IMPROVEMENT AND 4.1 Gather feedback
MEASUREMENT 4.2 Measure performance
4.3 Continuously improve your SMS
STEP 1: GAP ANALYSIS
1.1 REVIEW THE REQUIREMENTS OF AN SMS
The first step is to know what an ideal SMS looks like, and then consider this in the light of your organization. Look
at your regulatory requirements and any guidance from your regulator or other sources such as the SM ICG Small
organization material. Your regulator may provide you with a gap analysis tool for you to use. The SM ICG SMS
Evaluation Tool found on SKYbrary may be used as gap analysis tool. The following resources and actions should
help.

a) Research existing guidance material from your regulator

Put aside three to four hours to research and read any guidance material thoroughly. If this seems too much, ask
yourself whether three to four hours is too long to invest in a new management system for your organization.
Read through the gap analysis tool (if available) as this will help you understand what you need to address in your
SMS.

b) Work together: industry and regulator

Work with similar or partner organizations and industry groups to compare and contrast your understanding of
what is required. Do not aim for a cut‐and‐paste solution though; it might not work well and may actually waste
time and effort. Some regulators provide manual builders and templates for forms that you can customize to fit
your organization. Your regulator may also be able to provide advice on how to build a suitable SMS.

1.2 IDENTIFY WHAT YOU HAVE

While you are reading through any guidance material, consider and document what you have in place already. Jot
down some notes as you go about what you already do, and what you do well. Use the language your organization
understands in your SMS.

Appendix 1 17 | P a g e
1.3 IDENTIFY WHAT YOU NEED

This is where you need to consider carrying out a gap analysis. Here is the part where a lot of organizations feel
initially overwhelmed by all the things they may not have in place (and then promptly fail to start the gap
analysis!). If you follow these steps, you will end up with an easy, manageable list of actions to focus on.

A gap analysis does not have to take too long or be overly complex. Your regulator may have provided one for
you. Here’s an example of a simple table to capture results:

No. Element What we have What we don’t have Actions
1 Safety policy and  Quality Policy  Safety commitment  CEO to develop and
objectives (with safety statement sign commitment
mentioned)  Safety objectives for statement
2014  Workshop

STEP 2: DESIGN AND DEVELOPMENT

In this step, the person responsible for the SMS needs to design and develop a plan to implement the SMS. If it is
just you, consider seeking help or support from a partnering company or industry association.

2.1 IMPLEMENTATION PLAN

Using the action item list from the gap analysis, go through and introduce all under‐developed or absent elements
in an implementation plan.

Just a few things to consider while you do this:

 Think about each action. Does it require the development of a philosophy (e.g., safety objectives), a
process (e.g., safety reporting system) or a practice (e.g., risk assessment tool)? It can help to differentiate
these to make sure you have the philosophies sorted out first.

 Read through the actions identified, and prioritize them. It is useful to do a quick sensibility check, to ask
yourself, "Do I really need everything I’ve identified to achieve a successful system?" This is a good time to
see if your actions sufficiently address the gaps identified and are suitable for your organization.

 You do not need to have each action up and running straight away. Develop an implementation plan
that will allow you to phase different elements over a period of time. Building an SMS overnight will be far
too challenging and your goal at this stage is just setting up the foundations.

 Go with what works. Do not try to force a process or activity that clearly has no place in your business.
For example, if you are attempting to develop a risk assessment methodology, think about how complex
you want to make this process; make it practical and keep a focus on what you’re trying to achieve (e.g.,
identifying the safety and business risks of a new venture).

2.2 DOCUMENT YOUR SMS

You need to document the processes and activities you currently carry out, and the ones you plan to introduce. A
sensible approach is to add your SMS processes and activities to the documentation you already have such as your
Operations Manual.


STEP 3: INTRODUCTION AND ROLLOUT

3.1 GET YOUR PEOPLE INVOLVED

No matter how small your organization, failing to get your people involved will be a missed opportunity and a
showstopper. So, be sure your people are on board and understand what you are trying to achieve. A clear safety
policy and a commitment from the accountable executive is the best place to start. A good safety culture begins
with the accountable executive 'walking the talk.' A few one‐on‐one discussions go a long way.

3.2 COMMUNICATE THE CHANGES

Let your staff know about the changes, why they are being implemented, the benefits they are designed to bring,
and, of course, their own roles within the SMS.

Who else may benefit from knowing that you have an SMS in place? For example, your customers and your
contractors and if you are a small operator based on an aerodrome, it might be valuable to let the aerodrome
operator know ‐ your reporting system may have safety information that’s worthwhile passing on to them.

It is worth letting your regulator know; this will help build the regulator’s confidence in your organization.

3.3 SET A REALISTIC TIMEFRAME

Be sure to space out the implementation activities over a reasonable timeframe. Even for small organizations, it
will take time to implement your SMS and longer for it to become effective. Do one or two things at a time. Make
sure these are in place and working before moving to the next step in your plan.

Keep checking your progress. For example, if you have implemented a new safety reporting process but have not
received (or submitted) any reports, find out why.

STEP 4: IMPROVEMENT AND MEASUREMENT

An important part of implementation is seeing whether your actions have worked. This step focuses on what you
can do to determine this. Consider doing a review six months after your initial development has started; you can
increase the interval as your SMS matures.

4.1 GATHER FEEDBACK

To understand what is working, and what is not, consider getting both an internal and external perspective.

Internally:
 Review any regulatory guidance material and compare your thoughts now with what they were when you
first read it.
 Use your initial gap analysis to identify what may need updating. Have things changed?
 Talk to your people and see what they think.

Externally:
 Check in with your partner organization or industry association.
 Consider having an independent evaluation done.
 Ask for feedback from your regulatory inspector.

4.2 MEASURE PERFORMANCE

Establish some performance measures that will help you measure your safety performance. This can be simply
measuring the amount of significant safety events you have, the amount of voluntary safety reports you receive or
the amount of safety meetings you have. Use them to see how far you have come and tell your staff about the
progress made.

4.3 CONTINUE TO IMPROVE YOUR SMS

The previous steps should give you an indication of what can be improved. Refining and enhancing your SMS does
not stop. If you think you have done all you can, just remember that continual improvement is fundamental to
your SMS. Your implementation is successful when it is embedded in your day‐to‐day activity (and has been for a
while), it works consistently, and it is actually effective. This won’t happen overnight, but with time you’ll see the
system maturing and your confidence growing.
Appendix 2: Example of a Very Small Organization SMS

Manual
The following is an example of the smallest SMS manual that could be used in a one or
two person organization. It would still need to be customized and you would need to
provide the appropriate cross reference to other manuals, procedures, and forms that
are being used, but this is how simple it could be. It is worth discussing with your
regulator to see if it would be acceptable and if it is appropriate to your organization.
Company X Safety Management Manual
1. Safety Policy
Safety is important to us as it helps us stay in business.
Our safety objective is simply for no aircraft accidents to occur as a result of our operations.
Therefore it is important that we meet all applicable regulations and where appropriate exceed them
when a safety risk is identified.
I believe in a reporting system that allows people to report safety issues without fear of unfair reprisals.
Everybody makes mistakes, and honest mistakes will be treated fairly. A healthy reporting system
gives us the information to address safety issues as they arise, not when it is too late. We expect
everyone who works or is connected to our operations to report any safety related events or issues
they identify to me or one of our staff. In this respect we will apply just culture principles to any event
that is reported to us directly in a timely manner.
This will help our organization to continuously improve our safety performance which is a shared
responsibility.
Signed
(insert name)
(insert date)
2. Safety Management Processes
The Accountable Manager will fulfill the role of the Safety Manager and contract in expertise as
required.
Copies of the separate Emergency Response Plan (Insert document reference) are held by (insert
name) and in the (insert location i.e., Operations Office).
3. Hazard Identification and Risk Management Procedures
All safety events, issues, or hazards should be reported to (insert name) by e-mail (insert e-mail
address), telephone (insert telephone number) or verbally; they will all be documented and assessed
as below.
All events and reported issues will be assessed by (insert name) to determine what the issue is, what
could happen as a result, and what actions need to be taken (if any) and by whom to manage the risk.
The Hazard Log (see below) will be updated and reviewed on a monthly basis and the updated
version will be posted on the (state location i.e., workshop safety notice board). All staff should read
the Hazard Log and provide feedback if they have any issues with the content or feel something is
missing.
What is the What could happen as a What action are we Action by

issue? result? taking? whom and
when
4. Management of Change
Any significant organizational changes will be assessed for safety issues related to the change and
documented in the hazard log. If appropriate, an ad-hoc meeting will be arranged with all available
staff to discuss significant changes where their expertise will be beneficial to identify possible safety
issues. Any actions or decisions from this meeting will be documented.
5. Safety Assurance
Safety Assurance is carried out by (insert name) using the SM ICG SMS Evaluation Tool and this will
include a review of the effectiveness of all risk mitigations in the Hazard Log. The Hazard Log will be
reviewed as part of the annual Management Review with the assistance of an independent SMS
auditor from (insert name).
Our safety performance indicators (SPIs) are detailed in Appendix 1 and will be used to monitor our
safety performance and help us strive for continuous improvements. These SPIs and our targets will
be reviewed as part of our annual Management Review that will use the template in Appendix 2.
The Management Review will culminate in a meeting to allow all our staff to contribute.
6. Safety Training and Promotion
Any new employee, contractor, or contracted organization will be required to read this manual
(including updates) and sign for having read and understood it.
Any safety critical information that needs distributing will be sent by e-mail to all our stakeholders and
posted on the safety notice board. A distribution list is available held on the secure (company name)
website and will be reviewed annually. All staff are expected to review the safety notice board and
read any new safety articles.
Appendix 3: A Sample SMS Manual Format for a Small

Organization
The following is an example of an SMS Manual layout.
 Table of Contents
 List of Effective Pages
 Distribution List
 Safety Policy and Objectives
o Safety Policy signed by the Accountable Executive to indicate
“Management commitment and responsibility”
 Safety Organization
o Safety accountabilities and responsibilities
o The Accountable Executive and key safety personnel
 SMS Documentation
o What, when, who, where and how to document and record the SMS
activities
 Safety Risk Management
o Safety reporting and hazard identification process
o How to assess hazards and risks and how to take corrective actions
 Safety Assurance
o Safety performance monitoring and measurement
o Safety audits and surveys
o How to manage changes using SMS
o How to improve the SMS continuously using the monitoring result
o Management Review
 Safety Promotion
o How to provide safety training and education to all staff
o How to achieve safety communication
 Emergency Response Plan
o How to deal with emergency situations
o Quick reference guide for key staff members
Appendix 4: Sample Hazard Logs
Hazard Log for a Small Organization

Note: Hazard Log information can be directly populated from reporting form.
Issue What is the How bad is How likely is it What action Follow-up (if
(hazard) result the result to occur are we taking applicable)
(consequence) (Who and
when)
Hazard Log for a Very Small Organization

Note: Hazard Log information can be directly populated from reporting form if used.
Issue What is the result What action are we taking Follow-up

(hazard) (consequence) (if applicable)
Appendix 5: Safety Report Form Template for a Small

Organization
Company X Safety Report Form
Part A to be completed by the person identifying the safety issue or hazard.
Date of event Local time
Location:
Section /
Name of Reporter
Organization
Please fully describe the event or identified hazard:

Include your suggestions on how to prevent similar occurrences.
In your opinion, what is the likelihood of such an event or similar happening or happening
again?
Unlikely Probable Likely

1 2 3
What do you consider could be the worst possible consequence if this event did happen or
happened again?
Negligible Serious Incident Fatal Accident

1 3 5
Part B To be completed by the (insert title of responsible person).

The report has been dis-identified and logged.
Report Reference
Signature Date:
Name
If further investigation is needed, perform that now and document on the investigation form. This
information will support the Safety Committees activities.
Part C To be completed by the Safety Committee.

Rate the likelihood of the event occurring or recurring:
Unlikely Probable Likely

1 2 3
Rate the most credible worst-case consequences?
Negligible Serious Incident Fatal Accident

1 3 5
What action or actions have been or are being taken to prevent the issue or hazard from
occurring in the future and/or to mitigate its consequences?
Resources required
Responsibility for
Action
Agreed and Accepted by

(insert title of responsible person) Date
Responsible Manager Date
Accountable Executive Date
Appropriate Feedback given to staff by Safety Officer Date
Signed:
Follow up action required:

What
Who
When
Appendix 6: Safety Report Form Template for a Very Small

Organization
Company X Safety Report Form
Part A to be completed by the person identifying the safety issue.
Location:
Section /
Name of Reporter
Organization
Please fully describe the safety issue:

Include your suggestions on how to prevent similar occurrences.
Part B To be completed by the (insert title of responsible person)
What action or actions have been or are being taken to prevent the issue from occurring in the
future and/or to mitigate its consequences?
Resources required
Responsibility for
Action
Signed: Date
Follow up action required:

What
Who
When
Hazard log updated by: Date:
Appendix 7: The Five Whys Approach for Root Cause

Analysis
Following is an example of applying this approach found in Transport Canada Advisory

Circular SUR-002:
Situation - An apprentice engineer installed the landing gear pins in the main landing gear so the aircraft
could be jacked up to allow a retraction test of the nose gear. When the gear switch was selected up, the
main and nose gear retracted. The main jacks (which had been lowered but not removed) punched
through the bottom of the wings as the aircraft came to rest on its belly on the hangar floor. The incident
took place at 3:00 AM and the aircraft was to be on line at 6:00 AM.
Problem Statement – At 3:00 AM on March 1 this year, both aircraft wings were punctured on C-FOX
during a retraction test of the nose gear at Prairie Base, even though landing gear safety pins had been
installed.
1. Why did the main gear retract with the pins installed?
A: The apprentice engineer installed the landing gear pins in the wrong hole.
2. Why did the apprentice install the pins in the wrong hole?
Organizational Factors Supervision Environment Human Factors
A: These holes had not A: The apprentice had A: The lighting in the A: The apprentice was
been filled, as never been shown the hangar was not working under pressure.
recommended by the correct location for the adequate for night
aircraft manufacturer’s pins and was working conditions.
service bulletin (SB). completing the work
without supervision.
3. Why was the SB not 3. Why was the 3. Why was the lighting 3. Why was the
complied with? apprentice completing in the hangar apprentice working
unsupervised work inadequate? under pressure?
without adequate
direction?
A: It was in a pile of A: The supervising A: The lights were more A: The aircraft had to
SB's that had not been engineer was on than 20 years old and fly at 6:00 AM, the
assessed. vacation that week. some of the fixtures aircraft maintenance
were broken. manual required the
The apprentice had
retraction test to be
completed similar tasks
done, and the
to this before and felt
apprentice was fatigued.
qualified to complete
this task.
4. Why had the SB’s not 4. Why were there no 4. Why were the fixtures 4. Why was the
been assessed? arrangements to ensure not repaired or apprentice fatigued?
alternate supervision? replaced?
A: The company did not A: Management did not A: Management did not A: The apprentice was
have a documented foresee the schedule upgrade the lighting finishing a 12-hour
procedure for assessing conflict in time to correct when the hangar was graveyard shift, and did
SB's. the omission. purchased 15 years not recognize the
ago, and did not act on cumulative effect of
complaints made about fatigue and pressure on
poor lighting. work performance.
5. Why was there no 5. Why did 5. Why was the lighting 5. Why did the
procedure for assessing management not not upgraded when apprentice not
SB's? foresee the schedule complaints were recognize the effect of
conflict in time to received? these factors on work
compensate? performance?
A: The Director of A: Although staff must A: Senior management A: Human factors
Maintenance was over- get approval for did not feel there was a training had not been
tasked due to a staff vacation time, no one in need to upgrade the provided.
shortage. Scheduling followed up lighting, citing expense
to see if there was a reasons.
conflict.
Corrective Action - Solutions developed and implemented by this enterprise were:

1. Short-term:
a) Issue direction that aircraft remain jacked for gear swings, regardless if pins are in place,
until the service bulletin is complied with;
b) Plug the holes as recommended by the service bulletin;
c) Document the procedure, and assign responsibility, for ensuring all service bulletins are
assessed for each type of aircraft; and
d) Conduct training in human factors.
2. Longer-term:
a) Install new lighting in the hangar;
b) Implement processes to monitor leave requests for scheduling conflicts and to ensure that
alternate supervision arrangements are provided; and
c) Complete staffing of vacant position(s).
Appendix 8: Investigation Form Template for a Small

Organization
Company X Safety Investigation Form
To be completed by the person investigating the safety issue or hazard.
Original Safety Report reference
Location:
Section /
Name of Investigator
Organization
Describe what happened:
Describe why the issue happened and any factors associated with it:
“Root Cause”
Identify recommended corrective or preventative actions:
Document the recommended action plan and any follow-up (by whom and when):
Investigator's Signature Date
Hazard Log updated When
Appendix 9: Risk Management Procedures for a Small

Organization
Company X Risk Management Procedures
All events and reported issues will be assessed for severity and likelihood using the following
definitions and then assessed using the following risk acceptability matrix. The person
responsible for the SMS (insert title) will carry out the initial risk assessment and an independent
validation is carried out by one of the following personnel:
• Accountable Executive
• Quality Manager (or identify alternative post)
• Identify another post if appropriate
Severity and Likelihood Definitions

Severity of Consequences
Definition Meaning Value
Fatal Accident Results in a serious accident or incident with 5

fatalities
Serious Incident Results in a Serious Incident (without fatalities) 3
that would be reportable to the NAA
Negligible Results in minor incident that would not be 1
reportable to the NAA
Likelihood of Occurrence
Qualitative Meaning Value
Definition
Likely Likely to reoccur or to occur several times in a 3
year
Possible Possibly reoccur or to occur at least once a 2
year
Unlikely Very unlikely to reoccur or occur 1
Risk Acceptability Matrix
Likelihood
Unlikely (1) Possible (2) Likely (3)
Severity
Fatal Accident REVIEW (5) UNACCEPTABLE UNACCEPTABLE

(5) (10) (15)
Serious REVIEW (3) REVIEW (6) UNACCEPTABLE
Incident (3) (9)
Negligible (1) ACCEPTABLE (1) ACCEPTABLE (2) REVIEW (3)
Risk Acceptance Actions

Actions will be prioritized by the score from the Risk Acceptability Matrix but the
following table will determine the appropriate action to be taken.
Unacceptable Risk Intolerable, Accountable Executive immediately informed and

action must be taken to reduce the risk to a tolerable level.
Review Risk reduction / mitigation must be considered. Where risk reduction
/ mitigation is not practical or viable acceptance by Accountable
Executive is required.
Acceptable Risk is considered acceptable but would be reviewed if reoccurs.
Management of Change
Any issues identified as part of a change such as organizational, operational, and
physical changes, will be assessed using this same process.
Appendix 10: Risk Management Procedures for a Very

Small Organization
Company X Risk Management Procedures
All events and reported issues will be assessed by (insert name or role) to determine
what the issue is, what could happen as a result and what actions need to be taken (if
any) and by whom to manage the risk. The Hazard Log (see below) will be updated
and reviewed on a monthly basis and the updated version will be posted in the (insert
where it will be posted).
What is the What could happen as a What action are we Action by whom
issue? result? taking? and when
(consequence)
Management of Change
Any significant changes, such as organizational, operational, and physical changes, will
be assessed for safety issues related to the change and documented in the Hazard Log.
Appendix 11: Safety Performance Indicators for a Small

Organization
Company X Safety Performance Indicators

Year 20XX
Target Performance
Performance Indicator
Qtr1 Qtr2 Qtr3 Qtr4
Major Risk Incidents* per 100 flights 0
Mandatory Reports per 100 flights 3 or less
Voluntary Reports per employee
More than 10
per year
Overdue safety report closures per
2 or less
year
Safety meetings per year 4
Safety briefings per year 2
Safety audits per year 2
Organization-specific SPIs
Operator: Flights flown with
operational MEL restrictions per Less than 5%
100 flights
Aerodrome: Runway incursions per
Less than 5
year
Maintenance: Maintenance errors
Less than 5
per year
ATS: Airspace infringements per
Less than 2
100 movements
*as defined in Safety Management Manual para XX
These are only suggested to give small organizations some ideas for safety
performance indicators (SPIs) and the targets will need to be customized to the size and
nature of the operation and the values given are just examples.
The objectives and SPIs should be reviewed as part of the Management Review to
decide whether they need to be amended or updated.
Appendix 12: Corrective and Preventive Action Report

Template
CORRECTIVE ACTION PREVENTIVE ACTION

STEP 1 : IDENTIFICATION
ORGANIZATION/
BUSINESS AREA/
DEPARTMENT
DESCRIPTION OF
THE ISSUE OR
NON-
CONFORMANCE
Auditor / Reviewer Auditor Signature Date
ROOT CAUSE(S)
STEP 2 : ANALYSIS OF CAUSES AND
PROPOSED What Who by when

CORRECTIVE /
ACTION
PREVENTIVE
ACTION TO BE
TAKEN INCLUDING
RESPONSIBLE
PERSON AND
DEADLINE
Accepted by Name Signature Date
ACTUAL DATE OF
ACTION (S) TAKEN:
STEP 3 : VERIFICATION AND
Comments:
EVALUATION
Further Action  YES  NO

Needed
Closure Acceptance Auditor / Reviewer Signature Date
Appendix 13: Management of Change Template
Management of Change MOC REF:

1. What is the change?
Describe the change
2. Who?
Describe who is responsible to implement the change
3 Describe the major components of the change

This will help you identify the main risks of each component that will be populated in section 7
4 Who does the change affect?

Consider who it affects individuals, departments and organizations?
5 What is the impact of the change?

Consider why the change is taking place and the impact on the organization and its processes and procedures
6 What follow up action is needed? (assurance)

Consider how the change will be communicated and whether additional activities such as audits are needed during the change and
after the change has taken place
7 Safety Issues and the risk assessment
What is the issue? What could happen as a result? How Bad How likely Risk What action(s) are we Action by
(hazard) (consequences) will it be? is it to rating taking? whom and
(severity) occur? (mitigations) when
(likelihood)
1
There may be more that one
mitigation for each issue
2

3

What is the issue? What could happen as a result? How Bad How likely Risk What action(s) are we Action by
(hazard) (consequences) will it be? is it to rating taking? whom and
(severity) occur? (mitigations) when
(likelihood)
4

5

The Change is acceptable to implement
Final Acceptance Signature Name
Date:
Appendix 14: Management Review Template

Company X Management Review Meeting Report
Date Time
Present
Absent
AGENDA
1. Review of actions arising from previous meetings

Action Completion Further Action
Status
Item # Date Required
2. Safety Performance Review

Performance
Performance Indicator Target
Qtr1 Qtr2 Qtr3 Qtr4
# of Major Risk Incidents (as defined in

our Safety Management Manual)
# of Mandatory Reports
# of Voluntary Reports
Performance
Performance Indicator Target
Qtr1 Qtr2 Qtr3 Qtr4
# of Overdue Safety Report Closures
# of Safety Meetings
# of Safety Briefings
# of Safety Audits
Organization-specific SPIs
3. Safety Events Review (reported since last Management Review)
Safety Report Corrective/Preventive

Further Action Required
Report # Status Action Effectiveness
4. Hazard Log and Management of Change (MoC) Review

Hazard/ Mitigation
Mitigation Effectiveness Further Action Required
MoC # Status
5. Training and Safety Promotion Review

Training and Promotion
Area Action Required
Effectiveness
Operational
Management
…..
6. Internal and External Audit / Review Findings

Corrective/
Finding Corrective/Preventive Action
Preventive Further Action Required
# Effectiveness
Action Status
7. Changes Required to SMS

Type of Action by Person
Change Required
Change (date) responsible
Safety Policy and
Objectives
SPIs
Documentation
……
8. Other Business
Person
Completion
Issue Follow up Action fulfilling
Date
Action
9. Date of next meeting
Appendix 15: Existing Regulatory Guidance Material

Transport Canada – Advisory Circular 107-002: Safety Management Systems
Development Guide for Small Operators/Organizations
This Advisory Circular (AC) addresses each SMS element for both minimal-complexity,
one-person operations and moderate complexity organizations, with documentation
examples throughout.
UK CAA – Safety Management Systems – Guidance for Small, Non-complex

Organizations (ver. 1.0)
This provides a guide to SMS, highlighting key points for small organizations. It includes
useful examples of SMS documentation and checklists.
CAA NZ – Advisory Circular 00-4: Safety Management Systems

This AC tabulates characteristics of small, medium, and large organizations in the
Introduction and provides “guidance based on size of organization” for each SMS
element.
CAA NZ – SMS Booklet 03 – Implementing Safety Management Systems –

Guidance for Small Aviation Organizations
This booklet contains information designed to help small aviation organizations to
implement an effective SMS that is built-for-purpose without being difficult or resource-
intensive.
CASA SMS Resource Toolkit Booklet 7 – SMS for Small, Non-complex

Organizations
This is a simple overview of SMS for smaller aviation organizations, such as those
involved in transport/charter, training and maintenance. It defines ‘small, non-complex’,
highlights the fact that SMS is scalable—that not all elements of an SMS will look the
same in all organizations—and that there are advantages to being small.
This paper was prepared by the Safety Management International Collaboration Group (SM
ICG). The purpose of the SM ICG is to promote a common understanding of Safety
Management System (SMS)/State Safety Program (SSP) principles and requirements,
facilitating their application across the international aviation community.
The current core membership of the SM ICG includes the Aviation Safety and Security Agency
(AESA) of Spain, the National Civil Aviation Agency (ANAC) of Brazil, the Civil Aviation
Authority of the Netherlands (CAA NL), the Civil Aviation Authority of New Zealand (CAANZ),
the Civil Aviation Safety Authority (CASA) of Australia, the Direction Générale de l'Aviation
Civile (DGAC) of France, the Ente Nazionale per l'Aviazione Civile (ENAC) in Italy, the
European Aviation Safety Agency (EASA), the Federal Office of Civil Aviation (FOCA) of
Switzerland, the Finnish Transport Safety Agency (Trafi), Japan Civil Aviation Bureau (JCAB),
the United States Federal Aviation Administration (FAA) Aviation Safety Organization, Transport
Canada Civil Aviation (TCCA) and the Civil Aviation Authority of United Kingdom (UK CAA).
Additionally, the Civil Aviation Department of Hong Kong (CAD HK), the International Civil
Aviation Organization (ICAO), and the United Arab Emirates General Civil Aviation Authority
(UAE GCAA) are observers to this group.
Members of the SM ICG:

 Collaborate on common SMS/SSP topics of interest
 Share lessons learned
 Encourage the progression of a harmonized SMS/SSP
 Share products with the aviation community
 Collaborate with international organizations such as ICAO and civil aviation authorities
that have implemented or are implementing SMS and SSP
For further information regarding the SM ICG please contact:
Regine Hamelijnck Jacqueline Booth Amer M. Younossi

EASA TCCA FAA, Aviation Safety
+49 221 8999 1000 (613) 952-7974 (202) 267-5164
regine.hamelijnck@easa.europa.eu jacqueline.booth@tc.gc.ca Amer.M.Younossi@faa.gov
Igor Penna Stephen Duffield

ANAC CASA
+55 213 5015 268 +61 7 3144 7362
igor.penna@anac.gov.br stephen.duffield@casa.gov.au
To get copies of the templates in the appendices so you can edit them please contact Simon
Roberts
simon.roberts@caa.co.uk
Additional SM ICG products can be found on SKYbrary at:

http://www.skybrary.aero/index.php/Safety_Management_International_Collaboration_Group
(SM_ICG)

SMS For Small Organizations: March 2015

Uploaded by

Copyright:

SMS For Small Organizations: March 2015

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

SMS For Small Organizations: March 2015

Uploaded by

Copyright:

SMS for Small Organizations

SMS for Small

How Complex is the Small Organization?

 Density and complexity of traffic for ANSPs;

1 Safety Policy and Objectives

Safety objective To gain a full picture of the safety hazards in our

1.1 Management Commitment and Responsibility

1.2 Safety Accountabilities

1.3 Appointment of Key Safety Personnel

1.3.1 Person Responsible for the SMS

1.4 Coordination of Emergency Response Planning

1.5 SMS Documentation

1.5.1 Considerations for Documentation

1.5.2 Writing Procedures

2 Safety Risk Management

2.1 Hazard Identification

2.1.1 Reporting System

2.1.2 Reporting Policy

personnel reporting safety-related issues shall not be subject to disciplinary action

instrumentation, layout, the role of unusual circumstances); and

2.2 Safety Risk Assessment and Mitigation

3.1 Safety Performance Monitoring and Measurement

3.1.1 Safety Performance Indicators: Why Do You Need Them?

3.1.2 How to Go About Setting Your SPIs

3.1.1 Internal Audit

3.2 The Management of Change

3.2.1 Considerations for Managing a Change

 Organizational change (a new executive, the departure of experienced

3.3 Continuous Improvement of the SMS

3.3.1 Management Review

o Follow up actions from previous management reviews;

4.1 Training and Education

4.1.1 The Basic Requirements

4.1.2 What is Involved?

4.2 Safety Communication

5 Dealing with Contractors and Other Organizations

5.1 People Contracting to You

5.2 Organizations That You Supply with Products or Services

Appendix 1: A Step by Step Guide for Small Aviation

Appendix 2: Example of a Very Small Organization SMS

Company X Safety Management Manual

Safety is important to us as it helps us stay in business.

2. Safety Management Processes

3. Hazard Identification and Risk Management Procedures

What is the What could happen as a What action are we Action by

6. Safety Training and Promotion

Appendix 3: A Sample SMS Manual Format for a Small

The following is an example of an SMS Manual layout.

Appendix 4: Sample Hazard Logs

Hazard Log for a Small Organization

Hazard Log for a Very Small Organization

Issue What is the result What action are we taking Follow-up

Appendix 5: Safety Report Form Template for a Small

Company X Safety Report Form

Part A to be completed by the person identifying the safety issue or hazard.

Date of event Local time

Please fully describe the event or identified hazard:

Unlikely Probable Likely

Negligible Serious Incident Fatal Accident

Part B To be completed by the (insert title of responsible person).

Part C To be completed by the Safety Committee.

Unlikely Probable Likely