Safety Management Systems
A safety management system (SMS) is a systematic, organisation-wide approach to managing safety, with defined structures, accountabilities, policies and procedures, through which an aviation organisation identifies hazards, assesses and controls the risks they carry, and checks that its controls work.
A safety management system (SMS) is the way an aviation organisation manages safety as deliberately as it manages money or schedules. Instead of waiting for an accident to show where the defences were thin, it looks for hazards in its own operation, judges how much risk each one carries, puts controls in place and then checks, with data, that the controls work. The same method applies to an airline, a maintenance organisation, a training organisation, an air navigation service provider or an aerodrome.
Safety management changed the question regulators ask. Compliance monitoring checks that the rules are being followed; an SMS asks whether the operation is safe even when they are. For pilots the SMS is not an abstraction: the reports they file, the flight data their aircraft record and the observers who sometimes ride on the jump seat all feed it, and airline-level exams on both sides of the Atlantic test its vocabulary.
What an SMS is
ICAO defines an SMS as a systematic approach to managing safety, including the necessary organisational structures, accountability, responsibilities, policies and procedures. ICAO Annex 19 (Safety Management), adopted in 2013 as the nineteenth Annex, gathered the safety management provisions that had been spread across other Annexes. Each State runs a State Safety Programme (SSP), an integrated set of regulations and activities aimed at improving safety, and requires service providers, including operators, maintenance and training organisations, air navigation service providers and aerodromes, to run an SMS. ICAO's guidance is the Safety Management Manual, Doc 9859.
An SMS is scaled to the size and complexity of the organisation: a small charter operator needs the same functions as a major airline, not the same bureaucracy.
- EASA. Part-ORO requires every operator to have a management system (ORO.GEN.200) that includes clearly defined lines of responsibility and accountability, a safety policy, hazard identification and risk management, training, documentation and compliance monitoring. EASA's rules speak of the management system, which contains the SMS together with compliance monitoring.
- FAA. 14 CFR Part 5 was issued in January 2015 for Part 121 air carriers. A final rule published on 26 April 2024 extended it to Part 135 operators, commercial air tour operators under 91.147 and certain design and production approval holders under Part 21; Part 135 and 91.147 operators already operating then must have their SMS in place by 28 May 2027.
The four pillars
Annex 19 sets out a framework of four components, often called the four pillars, and twelve elements. The FAA's Part 5 uses the same four components.
| Component | Elements | In practice |
|---|---|---|
| Safety policy and objectives | Management commitment; safety accountability and responsibilities; appointment of key safety personnel; coordination of emergency response planning; SMS documentation | A signed safety policy, named accountabilities, a safety manager, an emergency response plan, the SMS manual |
| Safety risk management | Hazard identification; safety risk assessment and mitigation | Finding hazards, rating their risks, deciding on controls |
| Safety assurance | Safety performance monitoring and measurement; management of change; continuous improvement of the SMS | Indicators and targets, audits, FDM, LOSA, change assessments |
| Safety promotion | Training and education; safety communication | SMS training for all staff, safety bulletins, feedback to reporters |
The safety policy commits management to providing resources, sets out what behaviour is and is not acceptable, and states that the purpose of reporting and internal investigation is to improve safety, not to apportion blame. It is the written basis of the just culture on which the whole system depends.
Exam tip: the four components are safety policy and objectives, safety risk management, safety assurance and safety promotion. Hazard identification belongs to safety risk management; management of change belongs to safety assurance.
The accountable executive
Every SMS has one person at the top who answers for it. ICAO calls this person the accountable executive. Under 14 CFR 5.25 the accountable executive must be the final authority over operations under the certificate, control the financial and human resources those operations need, and retain ultimate responsibility for their safety performance. The accountable executive must ensure that the SMS is properly implemented and performing in all areas, regularly review safety performance and direct the action needed where it falls short, and designate management personnel to run the SMS day to day.
EASA's equivalent is the accountable manager (ORO.GEN.210), who has the corporate authority to ensure that all activities can be financed and carried out to the required standard, and who is responsible for establishing and maintaining an effective management system. Beneath the accountable manager, a safety manager, one of the key safety personnel that Annex 19 requires, is responsible for implementing and maintaining the SMS day to day. Tasks can be delegated; the accountability cannot. The management structure around both roles is described in air operator certification.
Hazards and risks
The distinction between hazard vs. risk is at the heart of safety risk management. Annex 19 defines a hazard as a condition or an object with the potential to cause or contribute to an aircraft incident or accident, and safety risk as the predicted probability and severity of the consequences or outcomes of a hazard. The FAA's handbooks put it the same way: a hazard is a present condition, and risk is its possible future impact. A thunderstorm 50 NM from the route is a hazard carrying little risk; the same storm over the destination at the arrival time carries a high one.
ICAO's safety management guidance describes three ways of finding hazards:
- Reactive methods analyse what has already happened: accidents, incidents and occurrence reports.
- Proactive methods look for hazards before they cause events: voluntary hazard reports, audits, surveys and safety studies.
- Predictive methods analyse data from normal operations to identify emerging risks, as flight data monitoring does.
Once a risk has been assessed, ICAO's guidance offers three generic strategies to control it: avoidance, cancelling an activity whose risk outweighs its benefit; reduction, doing it less often or acting to reduce the magnitude of the risk; and segregation of exposure, isolating people and equipment from the consequences or building in protection. The residual risk is then assessed again.
The risk assessment matrix
A risk assessment matrix combines the two dimensions of risk. The example in Doc 9859 is a five-by-five grid.
| Value | Probability | Letter | Severity |
|---|---|---|---|
| 5 | Frequent: likely to occur many times | A | Catastrophic: equipment destroyed, multiple deaths |
| 4 | Occasional: likely to occur sometimes | B | Hazardous: a large reduction in safety margins, serious injury, major equipment damage |
| 3 | Remote: unlikely, but possible | C | Major: a significant reduction in safety margins, serious incident, injury to persons |
| 2 | Improbable: very unlikely | D | Minor: nuisance, operating limitations, use of emergency procedures, minor incident |
| 1 | Extremely improbable: almost inconceivable | E | Negligible: few consequences |
Each hazard receives an index such as 4B, occasional and hazardous, which falls into one of three regions, usually coloured like traffic lights. In the intolerable region, which includes 5A, the risk is unacceptable as it stands: it must be mitigated at once or the activity stopped. In the tolerable region the risk may be accepted after mitigation, when it is as low as reasonably practicable (ALARP). In the acceptable region, such as 1E, no further action is needed. ICAO presents the matrix as an example that organisations adapt to their own operation.
The FAA's risk management material for pilots uses a four-by-four version: likelihood from probable through occasional and remote to improbable, severity from catastrophic through critical and marginal to negligible, and risk rated high, serious, medium or low. Operators turn it into flight risk assessment tools that score each flight before departure.
Note: the SMS matrix is not the same as the failure condition classification used to certify aircraft systems under CS-25 and Part 25, which also runs from catastrophic to minor but sets numerical probability targets per flight hour (see failure conditions and system safety).
Safety assurance
Safety assurance is how an organisation knows its controls work. It has three elements. Safety performance monitoring and measurement tracks safety performance indicators, such as unstable approach rates or runway incursions per thousand departures, against targets, using audits, investigations and operational data. Management of change requires hazards to be identified and risks assessed before a change is made, whether a new aircraft type, route, base, procedure or reorganisation. Continuous improvement corrects the SMS itself when it underperforms.
Assurance draws on many data sources: mandatory and voluntary occurrence reports, confidential programmes such as the FAA's Aviation Safety Action Program, compliance audits, and the two operational programmes below. Before safety management was codified, EU-OPS 1.037 required an accident prevention and flight safety programme including risk awareness, occurrence reporting, incident and accident evaluation and flight data monitoring. Those functions now sit inside the Part-ORO management system.
Flight data monitoring and FOQA
Flight data monitoring (FDM) is the routine download and analysis of recorded flight data from normal flights. Software compares each flight's parameters against event thresholds and flags exceedances, such as an unstable approach, a high-energy state on final, a hard landing or a GPWS warning, and the programme looks for trends across the fleet rather than blame for individuals.
ICAO Annex 6 requires an operator of aeroplanes with a maximum certificated take-off mass over 27,000 kg to run a flight data analysis programme as part of its SMS. EASA's ORO.AOC.130 applies the same threshold, and requires the programme to be integrated into the management system, non-punitive and protected by adequate safeguards for the source of the data. Under EASA guidance, a significant risk-bearing event found by FDM should normally already be the subject of a mandatory occurrence report by the crew; if not, the crew files one retrospectively.
Flight Operational Quality Assurance (FOQA) is the US counterpart. It is voluntary and approved by the FAA under AC 120-82. Data are collected by quick access recorders or from the flight data recorder, analysed by the carrier's FOQA office, and shared with the FAA only in de-identified, aggregate form. A gatekeeper protects the identity of the crews, and 14 CFR 13.401 bars the FAA from using approved FOQA data for enforcement except in criminal or deliberate cases.
Line Operations Safety Audit
A Line Operations Safety Audit (LOSA) looks at what flight data cannot show: how crews actually work. Trained observers, usually line pilots, ride on the jump seat of normal scheduled flights and record the threats the crew met, the errors they made, any undesired aircraft states and how each was managed, using the threat and error management framework. ICAO describes LOSA in Doc 9803 and the FAA in AC 120-90.
LOSA works only if crews behave normally, so its ten operating characteristics include voluntary participation, anonymous, confidential and non-punitive data collection, joint sponsorship by management and the pilots' association, trusted and trained observers, a secure data repository, data verification roundtables, improvement targets drawn from the data, and feedback of the results to the pilots. FDM shows what the aircraft did; LOSA shows how the crew managed the flight. Together with occurrence reports they give the SMS a view of normal operations, not only of the rare flights that go wrong.
Frequently asked questions
What are the four pillars of a safety management system?
ICAO Annex 19 builds every SMS on four components. Safety policy and objectives sets management commitment, accountabilities and documentation. Safety risk management identifies hazards and assesses and mitigates their risks. Safety assurance monitors safety performance, manages change and improves the system. Safety promotion covers training and safety communication. The four components contain twelve elements, and the FAA's 14 CFR Part 5 uses the same four.
What is the difference between a hazard and a risk in aviation?
A hazard is a condition or object with the potential to cause or contribute to an incident or accident, such as a thunderstorm, a contaminated runway or a fatigued crew. Risk is the predicted probability and severity of the consequences of that hazard. A storm far from the route is a hazard carrying little risk; the same storm over the destination at the arrival time carries a high one. Managing risk means reducing the probability, the severity, or both.
What is an accountable executive in an SMS?
The accountable executive is the single person with ultimate responsibility for the organisation's safety performance. Under 14 CFR 5.25 this person has final authority over operations under the certificate, controls its financial and human resources, and must ensure that the SMS is implemented and performing, reviewing safety performance and directing action. EASA's equivalent is the accountable manager, who has the corporate authority to ensure that activities can be financed and carried out to the required standard.
What is the difference between FDM and FOQA?
Both are programmes that routinely download and analyse recorded data from normal flights to find exceedances and trends, such as unstable approaches or hard landings. FDM is the European term (ICAO speaks of flight data analysis), and EASA requires it for aeroplanes above 27,000 kg maximum certificated take-off mass, non-punitive and integrated into the management system. FOQA is the US term for a voluntary, FAA-approved programme under AC 120-82, whose data 14 CFR 13.401 protects from enforcement except for criminal or deliberate acts.
How does an SMS risk assessment matrix work?
The matrix scores each hazard's worst credible outcome on two scales. ICAO's example rates probability from 5, frequent, to 1, extremely improbable, and severity from A, catastrophic, to E, negligible, so a risk is given an index such as 3B. The index falls in an intolerable, tolerable or acceptable region. An intolerable risk calls for immediate mitigation or for the activity to stop; a tolerable one is accepted only after mitigation to a level as low as reasonably practicable.
Test yourself on Safety Management Systems
The v1prep banks cover this topic in Human Performance and Limitations (040), with a worked explanation for every answer. EASA ATPL, PPL, IR and CPL, the FAA written tests and A320/B737 type ratings.
Start practising →Sources and further reading
- ICAO Annex 19, Safety Management (ICAO Store)
- ICAO Doc 9859, Safety Management Manual, 4th edition
- 14 CFR Part 5, Safety Management Systems
- Federal Register, 26 April 2024, Safety Management Systems (final rule)
- EASA Easy Access Rules for Air Operations (Regulation (EU) No 965/2012), Part-ORO (ORO.GEN.200, ORO.GEN.210, ORO.AOC.130)
- FAA Advisory Circular 120-82, Flight Operational Quality Assurance
- ICAO Doc 9803, Line Operations Safety Audit (LOSA)
- FAA Advisory Circular 120-90, Line Operations Safety Audits
Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.