Safety Culture and Occurrence Reporting

Safety culture is what an organisation actually does about safety when nobody is checking. It shows in whether a first officer mentions the shortcut the captain took, whether an engineer reports the tool that went missing inside an engine cowling, and whether management treats that report as a gift or as evidence against the person who made it. Procedures, training and equipment set the standard; culture decides whether people keep to it, and whether the organisation hears about it when they do not.

Culture matters most for what it lets an organisation learn. Accidents are rare, but the errors, hazards and near misses that precede them are not, and they are visible only to the people involved. Occurrence reporting, mandatory and voluntary, is how that knowledge reaches the people who can act on it, and it works only where reporters trust the system. This article covers the concepts examined in human performance and air law papers, and the reporting schemes pilots use in Europe, the United Kingdom and the United States.

What safety culture is

Human performance texts define safety culture as the enduring value and priority placed on worker and public safety by every member of every group at every level of an organisation. It is the product of individual and group values, attitudes, perceptions, competencies and patterns of behaviour. An open safety culture is one in which all levels of the organisation take an active part in improving safety; a closed one is reluctant to release information on threats, errors or undesired aircraft states to other agencies.

Culture explains why violations persist. A violation is a deliberate departure from a known procedure, so it is not cured by better technique; it is countered by discipline and culture, in an organisation that neither tolerates the shortcut nor punishes the person who reports it. In Reason's model of accident causation, a weak culture is one of the latent conditions that let the holes in successive defences line up (see human error and accident causation).

Informed, reporting and learning cultures

The psychologist James Reason described a safety culture as five linked elements.

The elements depend on each other. An informed culture needs a reporting culture to feed it; people report only if the culture is just; and reports achieve little unless the organisation learns from them and tells the reporters what changed.

Just culture

Just culture is defined in Regulation (EU) No 376/2014 as a culture in which front-line operators or other persons are not punished for actions, omissions or decisions taken by them that are commensurate with their experience and training, but in which gross negligence, wilful violations and destructive acts are not tolerated. It is therefore not a no-blame culture: unintentional errors are not punished, but reckless or deliberately unjustifiable risk-taking remains subject to discipline.

The engineer and lawyer David Marx drew the line in three categories that many operators now use:

• Human error, inadvertently doing other than what should have been done: slips, lapses and mistakes. The response is to console and to fix the system that made the error likely.
• At-risk behaviour, a choice whose risk is not recognised or is mistakenly believed to be justified, such as skipping a step because "it always works". The response is coaching, and removing the incentives that made the shortcut attractive.
• Reckless behaviour, conscious disregard of a substantial and unjustifiable risk. Sanctions apply.

The EU regulation protects reporters in law. Employees and contracted staff may not be subjected to any prejudice by their employer on the basis of the information they report, except for wilful misconduct or manifest, severe and serious disregard of an obvious risk. The same separation runs through accident investigation: an Annex 13 investigation exists to prevent accidents, not to apportion blame.

At-risk behaviour and normalised deviance

Normalisation of deviance is the term the sociologist Diane Vaughan coined in 1996, in her study of the decision to launch the Space Shuttle Challenger in January 1986. Erosion of the booster joint seals had been seen on earlier flights; each flight that returned safely made the next anomaly easier to accept, until the deviation had become the norm. The process is gradual and social: people inside the organisation grow so used to the deviant practice that they no longer see it as deviant.

Aviation's versions are familiar. A crew that has continued many unstable approaches without incident comes to see the stabilisation gate as advisory; the NTSB, in its report on Asiana Airlines Flight 214, noted industry data showing that about 97 per cent of unstable approaches are continued to landing. Checklists shortened on quick turnarounds, a defect "known about" and tolerated, a minimum fuel figure treated as a target: each is at-risk behaviour that feels safe because the outcome has always been good. Defences include flight data monitoring, which shows what is really happening on the line, occurrence reporting that treats the drift as a hazard rather than a confession, and leaders who hold the standard (see stabilised approach).

Mandatory occurrence reporting

Occurrence reporting is mandatory for defined events. ICAO Annex 19 requires each State to run a mandatory incident reporting system and a voluntary safety reporting system. In the EU, Regulation (EU) No 376/2014 sets the rules:

• Listed persons, including pilots-in-command, maintenance staff and air traffic controllers, must report occurrences that endanger or would endanger aviation safety. Implementing Regulation (EU) 2015/1018 classifies the occurrences concerned.
• A mandatory report is made within 72 hours of the reporter becoming aware of the occurrence, unless exceptional circumstances prevent it.
• Organisations collect, analyse and follow up reports, and pass them to their competent authority; under ORO.GEN.160 an operator reports accidents, serious incidents and occurrences to its authority within 72 hours of becoming aware of them. Accidents and serious incidents are also notified to the safety investigation authority under Regulation (EU) No 996/2010.
• Voluntary reports of anything else that may be a hazard are encouraged and handled under the same protections.
• Information is used only to maintain or improve safety, and each State designates a body to oversee the application of just culture.

In practice a pilot meets the duty through the operator's internal scheme. Most airlines use an Air Safety Report (ASR), a form usually based on the national mandatory occurrence report so that the safety department can forward reportable events without delay. Crews file ASRs for events such as bird strikes, ACAS resolution advisories, go-arounds or technical failures, depending on the operator's list.

In the United States the NTSB must be notified immediately of accidents and listed serious incidents under 49 CFR Part 830, while the programmes that gather most human factors information, ASRS and ASAP, are voluntary.

Confidential reporting schemes

Confidential incident reporting complements the mandatory schemes. A confidential report is not anonymous: the programme knows who filed it, so it can ask follow-up questions, but it removes the reporter's identity before anything is published or passed on. Both the pioneering schemes rest on the principle that honest information about human performance cannot be gathered while reporters fear punishment.

• The Aviation Safety Reporting System (ASRS) was set up in 1976 and is run by NASA for the FAA, so reports go to a third party rather than to the regulator. Under 14 CFR 91.25 the FAA may not use a report in enforcement, except for accidents and criminal offences. Under AC 00-46F, a report filed within 10 days of an inadvertent violation earns a waiver of any civil penalty or certificate suspension, subject to conditions described in FAA regulations and enforcement.
• The Confidential Human Factors Incident Reporting Programme (CHIRP) was formed in the United Kingdom in 1982, modelled on the ASRS, by the Civil Aviation Authority and the RAF Institute of Aviation Medicine. It now operates as an independent programme. It publishes de-identified reports in its FEEDBACK bulletins, and its published examples include cockpit design traps and a first officer reluctant to challenge a senior captain.

Canada and Australia run similar schemes, and many airlines add an internal confidential safety reporting channel for concerns that crews would not put on an ASR, such as fatigue, rostering pressure or a colleague's behaviour.

ASAP and event review committees

The Aviation Safety Action Program (ASAP), described in AC 120-66C, is a US programme run inside a particular certificate holder under a memorandum of understanding between the FAA, the company and, where there is one, the employees' union. When an employee reports a safety event under ASAP, including his or her own error, an accepted report is dealt with by corrective action such as training rather than FAA legal enforcement or company discipline. The protection does not cover intentional disregard of safety, criminal acts, substance abuse or intentional falsification.

Each report is reviewed by an Event Review Committee (ERC) with one representative of each party: the company, the union and the FAA. The ERC decides whether a report is accepted and what corrective action follows. A sole-source report is one in which the report itself is the only source of evidence of the event, so the FAA would not otherwise have known about it; the programme's timeliness limits do not apply to such reports. ASAP data feed the operator's safety management system alongside FOQA and LOSA.

Near misses

A near miss is an event in which nothing was damaged and nobody was hurt, but which could have become an accident. Annex 13's serious incident, an incident whose circumstances indicate a high probability of an accident, is the formal version; a near collision between aircraft reported to ATS is an Airprox.

Near misses are valuable because they usually share their causes with accidents but cost nothing. They are also far more common, which is the point of every reporting scheme: an organisation that learns only from accidents learns too late, and the weaknesses that near misses reveal can be seen only if the people who experience them report them.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.