safety & 2004 new security airframe guide

BI -MONTHLY 92 - AUGUST - SEPTEMBER - 2004

Post ing Off ice B-1380 LASNE

INS IDE THE COCKP IT : TRAINING

BIZAV IN EASTERN EUROPE

SAFETY &

SECURITY

HELICOPTERS

FOR THE EXECUTIVE

2004 NEW

AIRFRAME GUIDE

LEGAL LIABILITY

INSURANCE WOES

BART: AUGUST - SEPTEMBER - 2004 - 17

By Ray Rohr , IBAC Standards Manager

A Safety Management System

(SMS) i s the cornerstone of the

IS -BAO - an I n ternat iona l

Standard for Bus iness A ircraft

Operat ions , and prov ides

bus iness av iat ion operators

with a stra ightforward

approach to i ntegrate qua l i ty

and safety management .

The SMS model contained in theIS-BAO incorporates elements ofa traditional flight safety pro-

gram with quality management prac-tices in a manner that makes concert-ed flight safety efforts practical foreven a small flight department. Infact, it is so flexible that it can beused effectively by a single personoperating a small, simple aircraft orby a flight department with a cadre ofprofessional pilots flying state-of-the-art large complex aircraft. (For moreinformation about IS-BAO, see BART89.)

SMS Concept. The goal of an SMSis to manage safety-risks as effective-ly as practicable. This means thatsafety management must be proactiveand purposeful, and it must also beappropriate to the operation. Thenature and degree of safety manage-ment activities (i.e. the safety require-ment) is determined by identifyingand assessing the hazards and theassociated safety-risks that are inher-ent in the individual operation. The

safety-risks are profiled to determinethe appropriate level and focus ofsafety management. That informa-tion is then used to develop mitiga-tion that is incorporated into the oper-ator’s management structure, trainingand checking programs, operationsmanual and operating procedureswith the objective to proactivelyreduce the identified safety-risk to anacceptable level. Ongoing monitor-ing, measurement and analysis pro-vide the feedback to continuously beahead of the safety-risks that threatenthe operation. To be effective, all ofthese activities need to be conductedin a systematic manner within aframework that includes all aspects ofthe operation, and which involves allpeople involved.

Hazard and Risk Identificationand Assessment. The first step in theSMS development process is to identifythe hazards and the associated safety-risks inherent in the operation. Thisprocess need not be complex. It can beadjusted to suit the time and resourcesavailable and the complexity of theoperation that is being examined. Theguidance material contained in the IS-BAO provides a one-page checklistwith explanatory material that opera-tors may use to do a risk analysis. Thismodel provides a straightforwardprocess to identify and assess the likeli-hood and severity of the operational,technical and human safety-risk factorsinherent in the operation.

The IBAC publication Guidelines for

SAFETY MANAGEMENT SYSTEMS

FOR BUSINESS AVIATION

SMS is “the systematic andcomprehensive process for the

proactive management ofsafety-risks that integrates the

management of operationsand technical systems with

financial and humanresource management”.

I DENT IFY ING .

Brainstormingsessions withmembers ofyour team arean effectivemeans ofidentifyingpossible causesof hazards(center). Theauthor(above).

18 - BART: AUGUST - SEPTEMBER - 2004

the Conduct of Risk Analyses by BusinessAircraft Operators provides additionalguidance material on conducting a riskanalysis. That document discusses thefollowing steps in the process:

❍ Identify accident scenarios,❍ Identify the associated hazards,❍ Determine the severity and likeli-hood of the associated safety-risks,❍ Decide how to manage the hazardand associated risks, and❍ Document the information so thataction will be taken and tracked, andthe results assessed later.

When discussing risk analysis it isimportant to keep in mind the follow-ing terms:

One effective way of identifying the

possible causes of accidents and therelated hazards is through a “brain-storming” session involving a team ofas many people in the flight depart-ment as possible. This process can bean effective way to create “buy in” andto tap into the knowledge base of theorganization. In either event, it isimportant to identify the highest risksand to categorize similar events andhazards. That information is usefulfor identifying root causes and for

developing appropriate mitigation.When examining similar hazards, it

is necessary to categorize them interms of whether they are operational,technical, environmental or related tohuman factors. The underlying cir-cumstances that might be causing thehazards need to be identified. Oneunderlying circumstance may be asystem safety deficiency (a circum-stance that permits hazards of likenature to exist in an operation), andusually is based in decisions that havebeen made about the way the opera-tion is conducted. Examples of poten-tial system safety deficiencies mightinclude:

❍ regularly operating an aircrafttype into a location with a singlerunway that barely meets the air-

craft’s certification requirements;❍ employing and crewing pilotswith limited experience in the oper-ating conditions; or❍ providing knowledge-basedtraining when skill-based training isessential.This information is then used to

reassess the general categorizationarrived at in the initial hazard andsafety-risk identification process. Thehazards and associated safety-risks

with the highest severity and likeli-hood should receive the most atten-t ion. The classif ication systemdescribed in Table 1 can be helpfulin that process.

The Safety-Risk Profile. Whenthe hazards and safety-risks havebeen identified and classified, theyare used to develop the operator’ssafety risk profile. A safety-risk pro-file is a documented overview of thesafety-risks that are generally experi-enced by the operation. It is like amap that charts the “contours” ofhighest risk and is the basis onwhich the remainder of the safetymanagement system can be devel-oped. The Safety-Risk Profile helpsto ensure that the resources expend-ed on safety are appropriately target-ed and will result in optimum safetyperformance.

After the risk profile is developed,all medium to high risks are identi-fied, and risk mitigation or compen-sation procedures are developed inappropriate sections of the companyprograms, procedures and manuals,and are recorded on the risk profileform. Since risks change with eachflight activity, crews need always becognizant of the necessity to consid-er mitigation for any operation thatinvolves added risk.

A safety-risk profile is a “living doc-ument” that must be periodicallyupdated, particularly during times ofoperational change. It serves as theunderlying rationale for the opera-tor’s safety management system.

SAFETY & SECURITY S T A N D A R D S

Hazard: The condition or circumstance that can lead to physical injuryor damage.

Risk: The consequence of a hazard, measured in terms of severityand likelihood.

Mitigation: The measures taken to eliminate a hazard, or to reducethe severity and likelihood of one or more risks.

Class if icat ion of Safety-R isks (Table 1 )

SEVERITY

Category A Potential for loss of life or destruction of the aircraft

Category B Potential for serious injury or major damage to the aircraft

Category C Potential for minor injury or damage to the aircraft

Category D Trivial (e.g. inconvenience)

LIKELIHOOD

High Often

Medium Occasionally

Low Seldom

Rare Unlikely

Very rare Highly Unlikely


Mitigation of Hazards and Risks.This is an important part of the riskanalysis. The first step is to focus onthe event scenarios that have beenidentified as having the highest risk.As an extreme example, if many haz-ards relating to a particular type ofoperation or aircraft type at a specificsite have been identified, ceasing thattype of operation with that type of air-craft into the aerodrome may be war-ranted. However, if the severity andlikelihood of the safety-risks associat-ed with the majority of the hazards arelow, and one or two are medium orhigher, then devising special condi-tions for conducting the type of opera-tion might be appropriate. Next, thekey hazards embedded in the eventscenarios should be addressed todetermine if they could be eliminatedor avoided. For example if pilot

fatigue was found to be a hazard inseveral scenarios, special considera-tion to these cases could be integratedinto the operator’s fatigue countermea-sures program.

Subsequently, each event scenario isrevisited and the individual hazardsthat have been identified areaddressed. The goal of this activity isto reduce the likelihood of eventsoccurring. However, it is important

S T E P S I N D E V E L O P I N G M I T I G A T I O N

Mitigate to reduce similar, serious events, if appropriate.

Mitigate to reduce similar, serious hazards, if appropriate.

Mitigate to reduce the serious single hazards.

Mitigate the severity and likelihood of the risks.

Tips for Developing Mitigation

Beware of mitigation that mightintroduce new hazards or risk to theoperation. Examples could includenew activities that introduce distrac-tions during critical phases of theflight, or procedures that interferewith completing concurrent proce-dures.

Not all mitigation is appropriate.For instance, it is not wise to expectconsistent, error-free human perfor-mance as the sole way to prevent anaccident. Challenge the team todetermine whether the mitigationthey are proposing is realistic givenwhat they know about people,equipment and operations. If thereis doubt, have them consider whatcan be done instead or in additionto, what they propose.

Not all mitigation is effective.For instance, proposed mitigationmay assume a degree of proficien-cy that is unrealistic to expectunder all circumstances. In thiscase, supplementary mitigationmay be necessary. Again, theteam should be challenged to testwhether the planned mitigationwill always perform as well as theyintend, or as the criticality of thehazard(s) may require.

Remember to mitigate for severi-ty when necessary. For instance,changes to fl ight watch proce-dures at hazardous, remote loca-tions could improve Search andRescue alerting services, thusreducing the likelihood of loss oflife. Enhanced survival and firstaid equipment coupled with arequirement for crews to betrained and proficient in the relat-ed skills could reduce the likeli-hood of a loss of life to survivors ofan accident.

MIT IGATE .

Teammembersshould recallpast incidentsto identifyrisks that canbe eliminatedor avoided.


also to consider measures that reducethe consequences in the event an acci-dent does occur. An example wouldbe a procedure that consistently leadsto a go-around rather than (even a lowprobability) to a collision with anobstacle. Let the information flowfreely during this phase of developingmitigation. The ideas will subsequent-ly be refined so that they are realisticand appropriate.

Before turning from one event sce-nario to the next, ensure that thelikelihood and severity of a seriousaccident has been reduced to a levelthat is as low as reasonably achiev-able. This normally means thatthere are a number of measures thatcollectively prevent a critical hazardfrom occurring, or if it does, from itleading to an accident, and if it does,from it leading to loss of life.Documenting the Results. Once

the likelihood and severity have beenconsidered, review the mitigation thatwas previously suggested to ensurethat it is appropriate. It is importantthat a disproportionately high amountof resources not be expended toaddress hazards with a low likelihoodof leading to an accident, at theexpense of those more likely to occur.At this point it is very important thatthe risk analysis and the mitigation bedocumented so that the results of thesafety management activities can betracked and evaluated, and the safety-risk profile can be kept current. TheGuidelines for the Conduct of RiskAnalysis by Business Aircraft providesguidance on the documentation task.

The results of the risk analysisshould be in a form so that all personswhose decisions can have an impacton the safety of flight operations (e.g.the company executive, flight crew,maintenance and service crews) arefully aware of the safety-risks inherentin their operation so that the activitiesbeing taken to mitigate the risks areunderstood and supported. Completing the SMS. The next

step in the SMS development processis to establish the linkage to the otherelements of the operation in order tostructure a systematic process for themanagement of safety. The most pow-erful safety tool is the “culture” of theorganization. The culture is the basicvalues of the organization – how we

do things here and how people dothings when nobody is watching.Accidents are sometimes attributed tothe final sequence of events, but thecause is usually much more deeplyrooted. For example, the investiga-tion into the Columbia space shuttleaccident found that the physical causewas the damage to the left wing by apiece of insulating foam. However, italso found that the organizationalcauses of the accident were rooted inSpace Shuttle Program culture includ-ing:❍ reliance on past successes as asubstitute for sound practices,❍ organizational barriers that pre-vented effective communications andstifled difference of opinion,❍ lack of integrated managementacross program elements, and❍ organizational dysfunctions.

Safety Policy. A well-constructedsafety policy is an effective tool forestablishing a cultural framework forthe operator’s SMS. The safety policyis a high level statement of desiredcorporate safety performance. Theaim is twofold:❍ to provide guidance to everyone inthe company who has a direct or indi-rect impact on the operator’s safetyperformance; and❍ to provide specific direction toensure that safety management activi-ty is purposeful and directed.

A safety policy generally describeshigh level accountabilities and respon-sibilities of the owner, CEO or equiva-lent of a company, the flight depart-ment management and flight depart-ment personnel, describes measurablestandards, and is constructed so thatthe short and long-term safety goalsand objectives of the flight departmentcan be linked to the safety policy. Thesafety policy also establishes a frame-work that ensures that everyonebecomes involved in the operator’ssafety management activities and thateveryone understands that their partici-pation and input is not only valued, butis essential.

A sample Safety Policy is con-tained in the guidance material inthe IS-BAO and the generic compa-ny operations manuals that are acomponent of it.

Safety Management Strategy. Asafety management strategy is theflight department’s approach to themanagement of safety. It is the linkagebetween the risks identified on the safe-ty-risk profile and the remainder of thesafety management system. As such, itprovides a summary explanation of,and rationale for, the safety manage-ment activities conducted by the opera-tor. This document is the performancestandard by which the safety perfor-mance can be evaluated. The safetymanagement strategy normally con-tains the following:❍ a description of the nature of flightoperations;❍ the safety risk profile of the opera-tor;❍ a list of the hazards or risks identi-fied and the strategies adopted to miti-gate them;❍ safety performance goals that docu-ment the direction and activities beingtaken to enhance safety performance; ❍ the mechanisms employed to moni-tor the flight department performancein relation to stated goals and to evalu-ate the effectiveness of the operator’ssafety management; and❍ identification of other toolsemployed to manage the safety-risks.


COLUMBIA .

Additionalcauses of the

ColumbiaSpace Shuttleaccident wererooted in the

Space ShuttleProgramculture.


Technical Management System.The technical management system isthe mechanism for translating the mit-igation identified in the risk analysisprocess and included in the safetymanagement strategy, into the pro-grams procedures and manuals usedby the operator. For example, if theidentified mitigation included training,that specific training is included in theoperator’s training programs.Similarly, mitigation that includedoperating procedures is reflected inthe SOP, company operations manual,etc. Items that should be addressed inthe technical management systeminclude:

❍ systems for identifying all applica-ble laws, regulations and standards,including all approvals, authorizations,exemptions and permitted deviations;❍ documentation identifying flightdepartment personnel responsibilitiesand accountabilities for safety and forthe management of exemptions andpermitted deviations;❍ systems for ensuring that all flightdepartment personnel have the qualifi-cations, skills, competencies, training,equipment and tools necessary toenable them to discharge their respon-sibilities in a safe manner;❍ manuals or other documentsaddressing:❍ flight operations and aircraft main-tenance, including SOPs;

❍ personnel training programs andcompetency certification; and❍ aeronautical information.

The requirement for a system toidentify all applicable laws, regulationsand standards can be satisfied by sub-scribing to the relevant documents,reviewing all revisions and relatedmaterial and taking action when appro-priate. This is normally identified asthe responsibility of the flight depart-ment manager.

The documentation of the flightdepartment personnel duties andresponsibilities is normally containedin the company operations manual.Also, the company operations manualcan contain the system for ensuringthat all flight department personnelhave the necessary qualifications,skills, competencies, training, equip-ment and tools. The IS-BAO and thegeneric company operations manualsthat accompany it contain guidancematerial and examples. At this point,operators who are planning to seekregistration as being in conformancewith the IS-BAO must ensure thattheir programs, procedures and manu-als are in conformance with the stan-dards contained in the IS-BAO.Hazard Identif ication and

Tracking System. A hazard identifica-tion and tracking system has two com-ponents that work together as one sys-tem. The system contains programs

for the proactive identification ofemerging hazards and for trackingand assessing the appropriateness andeffectiveness of safety managementactivities. Accordingly, it links back tothe hazards and safety-risk identifiedin the risk analysis process and theassociated mitigation that was devel-oped, and it also looks ahead to identi-fy potential hazards, safety-risks anddeficiencies in safety management.

The hazard identification programcan include voluntary or confidentialreporting programs, safety committeemeetings, operator data collection sys-tems, brainstorming sessions, safetymanagement system audits and safetyreviews. An essential part of the pro-gram is the analysis of the identifiedhazards and the associated safety-risks. As well as considering theseverity and likelihood it is veryimportant that the hazard be correctlyidentified. There is always the possi-bility that a symptom of the problem,or hazard is being addressed ratherthan the root cause. The IBAC publi-cation Guidelines for the Conduct ofRisk Analyses by Business AircraftOperators provides guidance materialon conducting this type of analysis.Also, the Flight Safety Foundation’sFlight Operations Risk AssessmentSystem (FORAS) contains risk assess-ment tools. In addition, tools such asthe Flight Safety Foundation CFITChecklist and other hazard checklistscan be effective tools for analyzing thehazards and risks associated with indi-vidual operations of types of opera-tions.

The hazard tracking system is themechanism to document, track andevaluate the effectiveness of remedialmeasures that are being undertaken.For example, if long duty days wereidentified as a hazard with the associ-ated safety-risk of pilot fatigue, the mit-igation that was included in the techni-cal management system would includeappropriate fatigue countermeasures.The hazard-tracking program mayrequire pilots to file reports whenworking more than a specified numberof hours in order that the appropriate-ness and effectiveness of the opera-tor’s fatigue countermeasures can betracked and assessed. These reportswill also build a database that may beused in the future to make modifica-tions to the fatigue countermeasures.

As building an extensive databasemay be a challenge for a business avia-

TMS .

Aircraftmaintenanceshould beaddressed inthe TechnicalManagementSystem.


tion, flight department participation inprograms such as The Global AviationInformation Network (GAIN) and theFlight Operations Quality Assurance(FOQA) program may effectiveoptions. Information on both pro-grams is available from the FlightSafety Foundation.

The design of the hazard identifica-tion and tracking system will dependon the size of the flight departmentand the nature of the operation. Itmust be complementary to other man-agement systems. It may be automat-ed or manual, and with time can beemployed to identify operational safetydeficiencies and anomalies in operatorsafety management. Change Management Process. A

change management process flows

from the safety management strategyand is used to proactively identify andmanage the safety risks that canaccompany significant change.Examples of changes that might war-rant active change managementinclude:❍ the introduction of a new aircrafttype;❍ significant change in the nature of

the operation (e.g. dynamic businessgrowth, a new operating environment,etc.);❍ changes in hiring or schedulingpractices;❍ changes to organizational struc-tures; or❍ significant change in the mainte-nance contract; etc.

A change management processinvolves some form of safety planningto demonstrate that hazards associat-ed with the change will be systemati-cally identified and managed, and thatsafety performance will be evaluated atan appropriate time and in an appropri-ate manner after the change has beenimplemented.

Single aircraft operators that operatein stable low-risk environments maychoose not to maintain a change man-agement process. It is more appropri-ate for larger or complex operations,or those that frequently experiencesignificant change. The processdescribes the types of changes war-ranting examination, and documentshow the hazards and risk mitigationstrategies will be developed, docu-mented and evaluated. Findings aretracked in the hazard tracking system,and when appropriate, used to updatethe company safety-risk profile.Safety Management Audit. A safe-

ty management system audit is anindependent evaluation of an opera-tor’s safety management system. Itmay focus only on the operator’s safe-ty management system, or it may be acomprehensive audit to meet registra-tion or regulatory requirements. In allcases, the prime purpose of the auditis to identify areas in which safety per-formance may be enhanced. Theresults are used to validate the opera-tor’s safety-risk profile, which in turncan be employed to evaluate corporatesafety performance.


LEARN.

To learn moreabout IS-BAOeligibility, visitwww.nbaa.org

orwww.ibac.org.


Operators in a high-risk environmentand those without a record of effectiverisk management (e.g.; new opera-tors), may benefit from more frequentaudits. Audits should also be consid-ered after significant changes in acompany’s operational or managementstructure. Findings from the safetymanagement audit should be actedupon with a priority that is appropriateto the degree of associated risk docu-mented in the company safety-riskprofile, and tracked in the hazardtracking system.Operational Safety Reviews. An

operational safety review is an inde-pendent (external or internal to theflight department) examination ofone or more parts of a company'sflight operation. The purpose of anoperational safety review is to ensurethat the critical aspects of an opera-tion are being effectively managed.Examples of issues that can be exam-ined by a safety review include com-pany dispatch procedures, mainte-nance practices, operations from aparticular site, and various opera-t ional practices and procedures.Findings from an operational safetyreview are tracked in the hazardtracking system, and may be used toupdate the operator's safety-risk pro-file and the safety management strat-egy.

In cases where there appears to beinappropriately high risk or ineffec-tive risk management, an operatorshould consider an operational safetyreview. The f indings should beaddressed with a priority appropriateto the degree of associated risk docu-mented in the company safety-riskprofile. Managing safety and Quality. An

SMS enables a company's safetymanagement to be sound, and itsmanagement of risks to be appropri-ate and effective. An SMS embodiesa number of quality managementprocesses so that a company canreduce the risk it faces to a level aslow as reasonably achievable. Alarge part of its safety performance isbased on company personnel, equip-ment and organizational structuresperforming consistently and reliably -a consistency that normally derivesfrom an effective quality manage-ment program. For example, a well-constructed company operationsmanual is an integral part of the oper-

ator's safety management system. Itpays a very important role in ensur-ing that the operational procedureand processes that were developed tomitigate hazards and safety-risksinherent in the operation are carriedout in a consistent manner so thatsafe operations are consistently pro-duced. Additional Considerations. An

operator's SMS is one of the keycomponents of the InternationalStandard for Business AircraftOperations. Operators who havedeveloped an appropriate and effec-tive SMS are well along the road tobeing in conformance with the IS-BAO and are eligible for IS-BAO reg-istration. Operators interested in theIS-BAO, which is quickly becomingthe "gold standard" for flight depart-ment operations, can obtain moreinformation at the Flight DepartmentOperations page of the NBAA website.

Feedback from operators who havedeveloped safety management sys-tems as part of their IS-BAO imple-mentation indicate that a SMS not onlyprovides an appropriate framework forthe management of safety and quality,

but it is also an appropriate frameworkfor the management of security andother issues. The SMS is a key ele-ment of a code of practice developedby the industry to enhance the effi-ciency and effectiveness of the busi-ness aviation flight department.

For a list of additional books anddocuments offering a wealth of refer-ence material related Risk Analysesand Safety Management Systemsplease visi t BART's website atwww.bartintl.com.

SAFETY MANAGEMENT SYSTEM

SAFETY-RISK PROF ILE FEEDBACK

SAFETY

MANAGEMENT

STRATEGY

SAFETY

MANAGEMENT

ACTIVITY

SAFETY POL ICY

- AUDITS

- HAZARD IDENTIFICATION

- SAFETY REVIEWS

- CHANGE MANAGEMENT

- TECHNICAL MANAGEMENT

SYSTEM

✈

safety & 2004 new security airframe guide

Documents