Instituting Comprehensive Risk Management

A new SMS regulation for FAA 139 airports is under review.

• By Clare Epstein
• May 01, 2012

The Federal Aviation Administration is proposing a regulation that would require airports certified under FAA 14, Code of Federal Regulations Part 139, to develop and implement Safety Management Systems for their entire airfield environment (including movement and non-movement areas). Included in the proposed regulation are runways, taxiways, run-up areas, ramps, on-airport fuel farms, and apron areas. The landside environment, such as terminal areas, is not covered this regulation.

An SMS is a formalized approach to managing safety by developing an organization-wide safety policy, developing formal methods of identifying hazards, analyzing and mitigating risk, developing methods for ensuring continuous safety improvement, and creating organization-wide safety promotion strategies.

The regulation calls for developing and implementing a means for monitoring safety performance; establishing and maintaining a hazard reporting system that provides a means for reporter confidentiality; and developing and implementing a process for reporting pertinent safety information and data to the accountable executive on a regular basis. A Notice of Proposed Rulemaking for the SMS regulation for Part 139-certified airports was issued in March 2010, with a comment period that extended until July 2011. A final rule is anticipated in the next six to 12 months.

Components of SMS
SMS is based on four components: Safety Policy, Safety Risk Management (SRM), Safety Assurance, and Safety Promotion. As outlined in the NPRM:

• Safety policy provides the framework for the SMS. It outlines the methods and tools for achieving desired safety outcomes. The safety policy also details management's responsibility and accountability for safety.
• Safety risk management proactively identifies hazards, analyzes and assesses potential risks, and designs appropriate risk mitigation strategies.
• Safety assurance includes monitoring the organization's performance in meeting its current safety standards and objectives, as well as contributing to continuous safety improvement. It includes the assessment of processes, safety data collection, and follow-up and monitoring of safety actions.
• Safety promotion entails the creation of environment where safety objectives can be achieved. Safety promotion elements include training programs, communication of critical safety issues, and confidential reporting systems.

These four components are also included in the International Civil Aviation Organization SMS framework and thus should be familiar to organizations that participate in global discussions and operations.

How SMS Mitigates Risk
SMS works to mitigate risk by identifying, assessing, analyzing, and mitigating hazards before those hazards result in harm. A hazard assessment and management process is essential to improving safety and controlling risk in dangerous or potentially dangerous airport operations.

The FAA recommends five steps in the Safety Risk Management (SRM) process. The first step of SRM is describing the operating environment in which the hazards will be identified. The second step identifies hazards in a systematic way based on the system described in the first step. All possible sources of system failure should be considered, including equipment, human factors, operational procedures, maintenance procedures, and external services. Identifying hazards also should include documentation of the hazards.

The third step, hazard analysis, involves determining the likelihood and severity of the potential consequences of the hazard. The risk likelihood and severity are then mapped using a risk matrix to determine the level of risk (low, medium, serious, or high, for example). The exact categories and the number of risk categories may vary based on the airport but are similar to the risk matrix categories in the figure below.

Using a risk matrix to analyze risk is common in many types of organizations, including government, defense, and manufacturing.

The fourth step of SRM, risk assessment, uses the likelihood and severity assessed in step three and compares it with the organization's acceptable levels of safety risk. Certificate holders that have hazards with a high level of risk need to determine mitigation strategies prior to accepting the risk. The SMS should require that the certificate holder either accept the risk or approve the mitigation plan.

The fifth step of the SRM requires implementing appropriate risk mitigation strategies and plans to reduce (or eliminate) the risk of unacceptable hazards. These mitigation strategies and plans are often referred to as corrective action plans and detail the steps, time frame, and responsibility for mitigating the hazard.

As part of the safety assurance process in the SMS, the certificate holder would need to monitor and evaluate the corrective actions to make sure these actions were implemented appropriately to mitigate the hazard. FAA recommends a detailed documentation and hazard reporting system to assist with SMS and SRM. This hazard reporting system should provide a means for individuals to report hazards confidentially.

The safety promotion portion of the SMS aids in mitigating risk by ensuring that there is a safety culture that works to assess and eliminate hazards. As part of safety promotion, the certificate holder must provide applicable formal safety training to each employee and tenant with access to airport areas covered under the regulation. Safety-critical information, including lessons learned, must be formally communicated to all appropriate personnel. All individuals reporting safety hazards must be provided feedback. The proposed regulation requires that the certificate holder document both the SMS training activity and the SMS communications for the past consecutive 24 months and 12 months, respectively.

How to Implement SMS
FAA has been working closely with pilot airports to help them implement SMS. Several pilot studies have been conducted at various airports or are in the process of being conducted. FAA also included implementation guidelines and results from the pilot studies to assist airports in implementing an SMS. These studies and guidelines are available on FAA's SMS Pilot Projects website, http://www.faa.gov/about/initiatives/sms/pilot_projects/.

The proposed rule includes an implementation period for SMS and will require that all certificate holders submit an SMS implementation plan that details how the certificate holder will meet the SMS requirements. This implementation plan must include an implementation schedule.

In general, the SMS implementation process includes conducting gap analysis to determine which components of the SMS the certificate holder already has in place and which components of the SMS will need to be added to airport operations.

Several airports in the pilot study also have looked to safety software management tools to assist them in their SMS implementation. While software is not a specific requirement of the SMS regulation, software can assist certificate holders in the documentation of SMS requirements, including hazard analysis, safety assurance monitoring activities, and tracking of the training components required for safety promotion.

For example the Indianapolis Airport Authority, a certificate holder in the FAA pilot SMS program, used a software tool to assist with its SMS implementation. The authority plans to utilize the software to report and track incidents, hazards, and corrective actions and to provide a way for stakeholders throughout the authority to report hazards and/or incidents.

FAA continues to provide guidance and implementation assistance as SMS goes through the rulemaking process. Look for more activity in this area in the future.

This article originally appeared in the May 2012 issue of Occupational Health & Safety.