Safety Oversight Following The Implementation of SMS PDF

Safety Oversight
Following the
Implementation of Safety
Management Systems
November 2022
Safety Oversight Following the Implementation of SMS
This paper was prepared by the Safety Management International Collaboration Group (SM ICG).
The purpose of the SM ICG is to promote a common understanding of Safety Management System
(SMS) / State Safety Programme (SSP) principles and requirements, facilitating their application
across the international aviation community. In this document, the term “organization” refers to a
product or service provider, operator, business, and company, as well as aviation industry
organizations; and the term “authority” refers to the regulator authority, Civil Aviation Authority
(CAA), National Aviation Authority (NAA), and any other relevant government agency or entity with
oversight responsibility.
The current core membership of the SM ICG includes the Aviation Safety and Security Agency
(AESA) of Spain, the National Civil Aviation Agency (ANAC) of Brazil, the Civil Aviation Authority of
the Netherlands (CAA NL), the Civil Aviation Authority of New Zealand (CAA NZ), the Civil Aviation
Authority of Singapore (CAAS), Civil Aviation Department of Hong Kong (CAD HK), the Civil
Aviation Safety Authority (CASA) of Australia, the Direction Générale de l'Aviation Civile (DGAC) in
France, the Ente Nazionale per l'Aviazione Civile (ENAC) in Italy, the European Aviation Safety
Agency (EASA), the Federal Office of Civil Aviation (FOCA) of Switzerland, the Dominican
Republic Civil Aviation Institute (IDAC), the Finnish Transport and Communications Agency
(Traficom), the Irish Aviation Authority (IAA), Japan Civil Aviation Bureau (JCAB), the United States
Federal Aviation Administration (FAA) Aviation Safety Organization, Transport Canada Civil
Aviation (TCCA), United Arab Emirates General Civil Aviation Authority (UAE GCAA), and the Civil
Aviation Authority of United Kingdom (UK CAA). Additionally, the International Civil Aviation
Organization (ICAO) is an observer to this group.
Members of the SM ICG:
• Collaborate on common SMS/SSP topics of interest

• Share lessons learned
• Encourage the progression of a harmonized SMS/SSP
• Share products with the aviation community
• Collaborate with international organizations such as ICAO and civil aviation authorities that
have implemented or are implementing SMS and SSP
For further information regarding the SM ICG please contact:

Bernard Bourdon Andrew Larsen Eugene Huang
EASA TCCA FAA, Aviation Safety
+49 221 89990 2022 +1-343-551-1446 (202) 267-7577
bernard.bourdon@easa.europa.eu andrew.larsen@tc.gc.ca eugene.huang@faa.gov
Neverton Alves de Novais Adrian Duncan Nick Leow

ANAC CAA NZ CAAS
+55 61 3314 4606 +64 0 4 560 9608 +65 6541 3046
Neverton.Novais@anac.gov.br adrian.duncan@caa.govt.nz Nick_LEOW@caas.gov.sg
SM ICG products can be found on SKYbrary at http://bit.ly/SM ICG.
SM ICG material is free. If an organization adapts material, it may not be made available for commercial resale.
Table of Contents
1. Use of Terminology ...................................................................................................................... 1
2. Introduction ................................................................................................................................... 1
2.1. Background.......................................................................................................................... 1
2.2. Objective .............................................................................................................................. 1
2.3. Oversight Process ............................................................................................................... 2
3. Working Together to Improve Surveillance.................................................................................. 4
3.1. Working in Collaboration ..................................................................................................... 4
3.2. Fostering a Positive Safety Culture..................................................................................... 4
4. Risk Profiling ................................................................................................................................. 4
4.1. State, Sector, and Organizational Risks ............................................................................. 5
5. Surveillance Planning ................................................................................................................... 7
5.1. Evaluation Preparation ........................................................................................................ 7
5.2. Planning Activities: Final Evaluation Preparation ............................................................... 8
6. Conduct Surveillance ................................................................................................................... 9
6.1. Performing the Evaluation ................................................................................................... 9
6.2. Evaluation of SMS ............................................................................................................... 9
6.3. SM ICG SMS Evaluation Tool ........................................................................................... 10
6.4. Compliance and Performance Evaluation of an SMS ...................................................... 10
6.5. Methods for Gathering Surveillance Information .............................................................. 11
6.6. Dealing with Multiple Certificate Holders .......................................................................... 12
6.7. Post Surveillance Activities ............................................................................................... 13
7. Continuous Improvement, Documentation, and Feedback ....................................................... 13
7.1. System Changes ............................................................................................................... 13
7.2. Output of Surveillance ....................................................................................................... 14
7.3. Feedback ........................................................................................................................... 16
SM ICG material is free. If an organization adapts material, it may not be made available for commercial resale.
1. Use of Terminology
Throughout this document SM ICG terminology is used. Some terms have different meanings in
different regions of the world (e.g., “oversight” and “surveillance”). For additional definitions, see
the SM ICG Safety Management Terminology document. This document may be customized
locally with terms amended to reflect local usage.
Reference Links
• Safety Management Terminology
2. Introduction
2.1. Background
Large volumes of information are readily available globally on the theory of Safety Management
Systems (SMSs) and to a somewhat lesser extent on the topic of SMS development and
evaluation. When considering the oversight and/or surveillance of Service Providers (SPs) who
have an implemented SMS, little tangible information is available. The SM ICG seeks to address
this void by providing guidance to assist competent authorities performing oversight and
surveillance of SPs who have established SMSs where system componentry is not only “present”
and “suitable,” but more specifically “operating” and “effective.”
The SM ICG believes that such a document will be useful in assisting SPs who wish to develop an
understanding of the processes that may be applied by their respective Civil Aviation Authorities
(CAAs) as part of an SMS oversight regime.
Key themes considered relevant to addressing the requirements include:
• Collaborating to improve surveillance outcomes

• The importance of risk profiling
• Surveillance planning for the performance evaluation of an established SMS
• Conducting surveillance
• Continuous improvement, documentation, and feedback as part of the SMS life cycle
Competent authorities should appreciate that SPs must focus their attention and resources on both
regulatory compliance while also delivering effective risk management through their SMS. The
ability of the SP to deliver these requirements is fundamental to the issuance of an approval/
certificate. While the process of compliance has historically been well established and understood,
the characteristics and subsequent assurance through surveillance of an operating and effective
SMS continues to be developed.
An SMS provides for a dynamic evaluation of safety performance. Accordingly, an effective SMS
requires that safety information and data be systematically analyzed, collected, and processed to
examine safety risks and measure progress against expected results (outcomes). An effective
SMS must also provide assurance to the competent authority that an organization has ongoing and
acceptable measures and processes in place to identify and manage risks. The various features of
the SMS design and its outputs require consideration and a level of confidence shared between
both the competent authority and the SP. This is to assure that the SMS will continue to be
operating and effective.
2.2. Objective
This document has been designed to primarily assist competent authorities and SPs during the
SMS post implementation phase. In these cases, system elements have already been deemed to
SM ICG material is free. If an organization adapts material, it may not be made available for commercial resale. 1
be at least present and suitable and are characterized by robust SMS componentry including the
existence of risk profiling. This document is not designed to be a reiteration of existing surveillance
models, but rather a focus on assurance and ongoing effectiveness of an SP’s SMS.
This document was developed to assist competent authorities and SPs in forming insights into
ongoing SMS assurance through an understanding of:
• Collaboration and fostering a positive safety culture

• State, sector, and organizational risk
• Safety information and the risk profile relationship
• Assessing organizational risk profiles
• Surveillance and evaluation planning
• Evaluation in terms of performance as opposed to compliance
• Gathering surveillance information
• Continuous improvement, system change, and feedback into the risk profile
There are a number of SM ICG products that already deal with oversight and surveillance. This
document is connected to, and builds upon, those products. Accordingly, this document provides
links to existing SM ICG materials. These materials serve as a core basis from which to take the
next step in developing effective surveillance and evaluation of an SMS post implementation.
2.3. Oversight Process
The oversight process is depicted in Figure 1. In broad terms, this includes a process that forms
the basis of this document including:
• Preparation through gathering/analyzing safety information;

• Developing and performing the oversight activities; and
• Implementing actions.
Figure 1: Oversight Process
3. Working Together to Improve Surveillance

The implementation of SMS, including safety management practices, introduces the dimension of
proactive safety risk management and safety performance monitoring. This is combined with
traditional regulatory compliance in the competent authorities’ safety oversight of the SPs. This
requires a shift in the regulatory approach from one that is compliance-based to one that is
partnership-based between the competent authority and the SP. The partnership approach
enables the assimilation of SMS principles as part of the competent authority and safety oversight
processes. It also allows the competent authority to carry out performance-based oversight (PBO)
and risk-based oversight (RBO) approaches.
3.1. Working in Collaboration
Various parties need to work together to contribute to the successful surveillance of SMS
implementation and its effectiveness. An organization may undergo surveillance by multiple
authorities if it holds multiple certificates/approvals from more than one State. In these cases, the
authorities performing the surveillance may wish to collaborate or could consider the exchange of
information. In the specific instances where SMS is implemented, using tools such as the SM ICG
SMS Evaluation Tool aids the mutual surveillance and acceptance of an SMS by multiple
authorities. International bodies which are not competent authorities may issue “approvals” based
on an SMS.
In conducting surveillance, the authority may encounter an organization that has implemented an
integrated management system. This could combine health and safety and/or security. Most
organizations are likely to have a quality management system and may have additional
certifications such as ISO 9001.
An organization in a State that has established an SSP should consider the State SSP, including
its objectives and indicators, as part of its SMS.
Reference Links
• SM ICG SMS Evaluation Tool
3.2. Fostering a Positive Safety Culture
To facilitate the integration of SMS into regulatory and safety oversight activities, the competent
authority and SPs need to embrace and foster a positive safety culture within their organizations
and between each other. This encourages stronger partnerships and the more open sharing of
safety data/information between the competent authority and SPs. It benefits the overall
implementation of SSP and SMS.
An organization (competent authority or SP) may carry out safety culture assessments to
understand its safety culture and identify areas for improvement.
Reference Links
• Industry Safety Culture Evaluation Tool and Guidance

• Organizational Culture Self-Assessment Tool for Regulators
• Pamphlet: Safety Culture for Effective Safety Management
4. Risk Profiling
A key component in assuring the continued effectiveness of a State’s SSP is the ability to
understand the relationship of State, sector, and organizational risks. The ability to prioritize
actions within the State can be enhanced using sector and organizational risk profiles.
Additionally, it is key for the State to collect data, identify safety information, and assess an
organization’s risk profile for surveillance frequency and scoping purposes.
4.1. State, Sector, and Organizational Risks
A State’s safety oversight processes include both compliance oversight and risk management.
Risk profiling is a vital part of a State’s risk management processes and allows the State to identify
priorities and the associated risk mitigation measures. These may be implemented via different
safety oversight mechanisms, policy, oversight audits/inspections, safety actions, and safety
promotion.
The identification of risks can come from several sources and may be unique or more prevalent in
certain sectors of industry or individual organizations. To assure the effective management of risk,
it is important to understand the relationship between risk profiles and the impacts they have on
one another.
As part of current risk management processes, States may have developed a State risk picture
and perhaps sector risk profiles but not developed organization risk profiles. They may decide that
organizational risk profiles are unnecessary in some sectors due to activity levels or other reasons.
4.1.1. State Risk Picture
The purpose of safety performance management at the State level is to guide decisions related to
resource allocation and aviation system outcomes. The ultimate purpose is to enhance overarching
aviation industry safety. If safety is expressed in terms of the risk controls associated with the
identified hazards, it follows that measures of safety performance must verify the effectiveness of
risk controls managed at the State level.
Authorities should base their system of safety performance management on a defined safety risk
picture at the State level, utilizing multiple sources of safety data available in the State. For some
States, this would be through the SSP. The safety risk picture should also consider the Regional
Priorities that have cascaded from the ICAO Global Aviation Safety Plan. The State takes into
consideration constraints such as resource availability, legislative imperatives, and technological
capability when defining safety objectives. These eventually provide the overall guidance for safety
performance management.
As a starting point, States may elect to develop safety risk registers for hazards and risks. Safety
risk registers document the results of analyses that identify the main safety issues of concern that
the State wishes to address. It is also helpful to group safety issues on a sector-by-sector basis
(e.g., flight operations, airworthiness, Air Traffic Management/Air Navigation Services [ATM/ANS],
aerodromes, etc.). A risk assessment also facilitates prioritization of State-level responses.
Reference Links
• Guidance for Comprehensive Safety Performance Management in an SSP (provides more

details on developing the state risk picture)
4.1.2. Sector Risk Profile
A Sector Risk Profile (SRP) contains a description of the risks found that may affect a group of
related aviation activities, services, organizations, or products. Members of a sector (e.g.,
aerodromes) may be exposed to similar operating conditions and, as such, may be exposed to
similar hazards. Therefore, the SRP should be considered by all operators and stakeholders
connected to that sector.
SRPs use both quantitative and qualitative methods to source the information required. This
includes data as well as other information such as knowledge, experience, and perceptions of
industry participants and other observers.
There are several ways an SRP can be utilized. For example, an SRP may help inform the
competent authority where to target its actions and resources. In the context of surveillance, the
SRP serves as the baseline for the development of the organization risk profile.
However, as previously mentioned, the organizational risk is determined using the results of the
surveillance activities. In this way, the organizational risk profiles provide feedback to the SRPs,
contributing to the identification of risks that will be treated in the scope of the SSP and the
organizations' SMS.
Reference Links
• Sector Safety Risk Profiling at the State Level (provides more details on the SRP)
4.1.3. Organization Risk Profile
A complete and comprehensive picture of an organization’s risk profile allows aviation authorities
to determine the appropriate surveillance in terms of frequency and scope (including focused
oversight) to target surveillance activities on areas of greater concern. These profiles include
indicators of inherent risks, compliance, performance (including safety and non-safety data), as
well as indicators of safety management effectiveness. Organizational risk profiles may contain the
following:
• Inherent Risks Indicators. Assess the risk of the organization due to the nature of its
activities.
• Compliance Indicators. Assess the organization’s ability to maintain compliance with
regulatory and system requirements.
• Performance (leading and lagging) Indicators. Used to assess how well an organization is
managing risk.
The safety performance dimension of the organization risk profile is based on the measurement of
the achieved performance during the surveillance cycle. Indeed, these activities are essential to
obtain safety information that will be used to provide feedback on the risk profile of the
organization. Moreover, a tangible benefit of obtaining good, quality safety information is the
improvement of sector risk profiles. The assessment of the risk profiles across multiple
organizations could identify adverse trends in specific areas (e.g., emerging from compliance
assessment or safety performance evaluation) that may help identify safety issues as part of the
State’s risk management process and that may be added to the SRP.
Reference Links
• ICAO Safety Management Manual Doc 9859 (Figure 8-4)

• Risk-Based and Performance-Based Oversight Guidance (provides more details on the
development of an organization risk profile)
4.1.4. Safety Information
The ability to identify and assess State, sector, and organizational risks is highly dependent on the
ability to properly capture and analyze safety information and data. There are several data
gathering techniques from a multitude of sources for safety information and data. The data
gathering technique, the sources, and the use of data is dependent on the sector, the organization,
and the risks or hazards being managed. It may include information obtained through:
• Safety oversight activities
• Agreements with industry

• Regional or global agreements
• Occurrence reporting systems
• Accident or incident reports
• ICAO reports
• CAA Quality Management System (QMS) data
• Other CAA reports
• Industry association reports
• Flight Data Monitoring (FDM) data
It is also important to remember that some of this data may be subject to specific confidentiality,
data protection, and appropriate use requirements that must be respected.
Reference Links
• Guidance for Comprehensive Safety Performance Management in an SSP (provides more

details on collection and use of safety information)
5. Surveillance Planning
An organization’s risk profile allows authorities to determine the appropriate surveillance (in terms
of frequency and scope) in order to focus surveillance activities on the areas of greater concern or
need. Pertinent performance outcomes and safety data inputs are used to adjust/calibrate the
surveillance frequency and scope of an individual SP.
5.1. Evaluation Preparation
5.1.1. Frequency and Scope
When considering frequency and scope of surveillance activities of a Product/Service Provider

(P/SP) with an SMS, competent authorities should not be bound by fixed cycles traditionally used
for a sector. Rather, they should rely more on the safety performance and risk profile of the P/SP.
NOTE: The competent authority may be bound by a couple of factors requiring the minimum
frequency-based regulation or the resources available to authorities (inspectors).
Where there is a limited amount of data or performance history to assess the effectiveness or the
maturity of an SMS (e.g., during initial development and implementation of an SMS), a competent
authority should establish a baseline of surveillance activities (frequency and scope).
As more data becomes available through the safety oversight activities, safety performance
monitoring, and other safety intelligence on the SP, a more complete risk profile of the organization
could be formed. This informed risk profile could then be used to vary the frequency of surveillance
activities. Using a suitable framework, the competent authority could then increase (if the risk
profile is higher) or decrease (if the risk profile is lower) the frequency of surveillance activities on
an organization from the baseline frequency.
Similarly, when the risk profile changes, the scope of the surveillance activities should be varied
along with the oversight cycle. Competent authorities need to carefully consider and balance the
depth of any given surveillance event with the breadth that the event is hoping to cover. At times,
greater benefit is realized through a more focused (narrow scope) and “deep-dive.” At other times,
a higher-level, “whole-system” review is more appropriate.
Notwithstanding the above, competent authorities should maintain sufficient agility to account for
the dynamic nature of the operating environment of the SP and the risk picture. Surveillance
planning must be agile enough to react to safety issues that may arise and that may need to be
addressed using targeted surveillance. Some examples that may prompt targeted surveillance are
accident/incident investigations, airworthiness directives/bulletins, or medical assessment results.
5.1.2. Tools
A tool might be used to determine the surveillance for each operator. This tool might be built into
the surveillance planning software or a database containing the list of approved organizations. In
addition to the standard checklists, the SM ICG Evaluation Tool is recommended.
Reference Links
5.2. Planning Activities: Final Evaluation Preparation
The scope of the evaluation has already been defined based on the risk-based oversight
considerations discussed in Section 4.1. However, the evaluation team has a greater degree of
proximity with the organizations. Therefore, it is reasonable to expect that the inspector/evaluator
can contribute to refining the scope of the evaluation and increasing the efficiency of the CAA
supervision of safety of the aviation system. The evaluation may consider the following:
• Evaluation Checklist: Reviewing the details of the evaluation checklist can help in ensuring
that the scope of the evaluation is fully understood, including any new items arising from the
risk profile assessment.
• Previous Evaluations: Reviewing previous evaluation records in the areas within the scope of
the evaluation allows the evaluation team to assess the specific details of previous evaluation
findings and corrective actions. They can use this to identify if any further on-site verification is
necessary.
• Relevant Documented Reports: The organization’s risk profile may identify adverse trends in
some areas; therefore, the inspector may need to review the details in relevant documented
reports in advance of the evaluation.
• Operational Procedures Manuals: Reading the organization’s manuals helps the evaluation
team become familiar with the processes and procedures associated with the areas highlighted
by the risk profiles and associated evaluation scope.
• SMS Evaluations: In the case of an SMS review, previous SMS evaluations help the
evaluation team identify the trends of SMS components and elements and the relative level of
implementation toward effectiveness.
• Safety Performance Monitoring Results: Reviewing the safety performance monitoring
results relevant to the evaluation scope provides greater insight to the inspector; it may also be
useful to compare the organization’s safety performance indicators with indicators of other
organizations within the sector, if available.
• Safety Culture Evaluation: It may also be beneficial for the inspector to become familiar with
an evaluation of the organization's safety culture, if available.
The result of the evaluation preparation is an evaluation plan, which helps the CAA perform the
surveillance activity. The plan guides the inspectors in verifying compliance with the applicable
safety requirements and assessing the safety performance of the organization.
5.2.1. Knowledge and Training
Effective surveillance requires training, knowledge, and abilities for an inspector. The inspector’s
knowledge of ICAO Annex 19, ICAO Doc 9859, the regulatory framework within the CAA SSP, and
an understanding of how risk and performance work together with compliance is also required. The
Training Program Outline for Inspector SMS Competency contains a program of training including
the learning objectives, key learning points, and resources that support the leaning points. Formal
SMS courses can be found on the ICAO website.
Effective surveillance of SMS outputs is reliant upon a shift in practice from the historically
compliance-finding role of the competent authority to a collaborative relationship between the
competent authority and the P/SP. A shift in competencies from compliance to system allows the
competent authority to assess the system as a whole. Each organization has competency
frameworks that define and identify each competency required to work with them and provide
effective surveillance.
Reference Links
• Attitudes and Behaviors for Effective SMS

• SMS Courses on ICAO website
• SMS Inspector Competency Guidance (provides more information on competencies for SMS
inspectors)
• Training Program Outline for Inspector SMS Competency
6. Conduct Surveillance
The ICAO Safety Management Manual, Doc. 9859 4th Edition, states “surveillance comprises the
State activities through which the State proactively verifies through inspections and audits that
aviation license, certificate, authorization or approval holders continue to meet the established
requirements and function at the level of competency and safety required by the State.”
In a performance-based regulatory environment where an SSP and SMS are in place and are
proactively managing safety, surveillance activities include the verification of both prescribed
requirements and safety performance aspects of the organization.
While initially seeking evidence that the SMS elements are present and suitable, ongoing
assurance turns its focus toward outputs which demonstrate that the SMS is operating and
effective. In practice, ongoing assurance tilts the inspector’s attention from system compliance
toward system performance. The conduct of surveillance where an SMS has started to mature
requires the surveillance team to appreciate how to conduct their efforts methodically, utilizing
various methodologies to build evidence which proves the SMS is operating and effective.
Nonetheless, compliance findings by the CAA still need to be gathered. Performance-based rules
and compliance rules are complementary. Therefore, planning surveillance activities must consider
the traditional audits and inspections in order to evaluate the validity of certificates, licenses, or
authorizations, as well as merge methods to evaluate the effectiveness and the performance of the
SMS. Surveillance generally has three steps:
1. Planning surveillance (as discussed in Section 5)
2. Performing the evaluation
3. Concluding the evaluation
6.1. Performing the Evaluation
The process of conducting surveillance involves fact-finding for compliance with safety
requirements and the performance evaluation of SMS components and elements. Compliance with
safety requirements is demonstrated by the organization to the CAA, who in turn uses the
demonstration data to assure compliance with the requirements.
6.2. Evaluation of SMS
SMS cannot be assessed through a simple, check-the-box compliance check or audit.
When an organization is required to have an SMS, the competent authority evaluates how the
organization complies with the requirements pertaining to an SMS; additionally, they assess how
effective the SMS is in meeting its ultimate objective of improving aviation safety.
This performance-based evaluation of an SMS is a different approach for many. It requires a
specialized tool to assess the performance level of the SMS. The overall effectiveness is a function
of compliance and performance, which can both be evaluated using a tool like the SM ICG SMS
Evaluation Tool (explained below). While the size and scope of the surveillance may depend upon
the complexity of the organization, the surveillance team needs to use a standardized evaluation
tool to methodically step through the SMS elements. An evaluation tool has many benefits because
it provides:
• Facilitation of an orderly approach which assists all parties

• Efficiency through the adoption of a structure which avoids duplication
• Prompts to the surveillance team for key focal areas in terms of what to look for and what to
ask
• A trail of who did what and the results of their efforts
• Evidence for regulatory records
6.3. SM ICG SMS Evaluation Tool
ICAO Annex 19 promotes a common approach to Safety Management across aviation domains—
both for States and for organizations. The SM ICG SMS Evaluation Tool evaluates the overall
effectiveness of the SMS as a function of both compliance and performance. It does this through a
series of indicators based on ICAO Annex 19 and ICAO Safety Management Manual (Doc 9859)
and uses the ICAO SMS Framework. Each indicator should be reviewed to determine whether it is
present, suitable, operating, and effective, using the definitions and guidance provided in the tool.
Reference Links

6.4. Compliance and Performance Evaluation of an SMS
During the initial stages of developing an SMS, compliance is required to ensure the SMS
framework is in place and suitable for addressing the safety demands an organization may face.
Before issuing an approval or certificate, the authority ensures all processes are present and
suitable. However, once an SMS is implemented, the organization should start using the SMS as
part of its operations. The focus of authority’s assurance is expanded to ensure the SMS is
operating and performing satisfactorily (i.e., generating the desired outcomes).
Sufficient time should be allowed for the organization’s SMS to start generating these outcomes
before post-implementation/ongoing surveillance is scheduled. This subsequent evaluation strives
to determine whether the processes remain present and suitable, and are now operating and
possibly effective. Effective SMS processes may take some time—potentially a few
review/surveillance cycles—to be achieved. In order to check that SMS processes remain
operating and effective, the SMS should be re-evaluated on a regular basis to confirm ongoing
performance. The review should evaluate all of the items in the evaluation tool which can be done
through various evidence gathering methods discussed in Section 6.5.
In summary, initial assurance measures target the inputs to the SMS (compliance), while ongoing
assurance focuses on the suitability of the outputs (compliance and performance). Some examples
which demonstrate this shift are included in Table 1, which includes specific examples of indicators
from the SM ICG SMS Evaluation Tool.
Table 1: Surveillance Focus Shift from Component Presence to Performance
SMS Component SMS Evaluation Tool Initial Assurance Focus Performance Focus
Indicator (example) (example) (example)
Safety Policy and There is a means in place Policy is visible and Evidence confirms that
Objectives for the communication of distributed as required employees read,
the safety policy understand, and abide
with its requirements
Safety Risk There is a confidential There are forms/ Evidence of occurrence

Management reporting system to procedures to capture reports that are acted on
capture errors, hazards, mandatory occurrences in a timely manner and
and near misses that is and voluntary reports utilized as part of a risk
simple to use and management process to
accessible to all staff improve safety
Safety Assurance Responsibilities and The responsibilities and Evidence that employees
accountability for accountabilities are review, understand, and
ensuring compliance with documented and deliver on compliance as
safety regulations are available to employees detailed
defined and applicable
requirements are clearly
identified
Safety Promotion There is a process to Evidence of a process to Affirm that safety critical
determine what safety communicate safety information has been
critical information needs critical information received, understood,
to be communicated and and acted on
how it is communicated appropriately by viewing
throughout the organization analysis and
organization to all speaking with employees
personnel, as relevant
Once the surveillance team understands the nature of performance evaluation, the conduct of the
surveillance event may be undertaken within the general constraints of the frequency and scope
(as described in Section 4).
6.5. Methods for Gathering Surveillance Information
Obtaining quality evidence is necessary to provide proof and assure that the organization is
performing as required. There are a number of methods to obtain the information when conducting
surveillance.
6.5.1. Documentation Review
Documentation review is perhaps the most common means of obtaining evidence. The
methodology typically involves obtaining/sampling manual content and other data sources (e.g.,
from the SMS). The clear benefit is that the person undertaking the surveillance can request
information in advance for the purposes of off-site surveillance as part of the process.
6.5.2. Interviews
Interviews are an important part of SMS surveillance and may be conducted in person or via
telephone/video conference. They provide an opportunity to gather relevant and accurate
information from the people within the organization, including third party interfaces in the form of
testimonial evidence. There are a number of different ways to conduct an interview. The most
appropriate type of interview depends on the nature of the event and the type of person being
interviewed (e.g., person directly involved vs. subject matter expert). Types of interviews include:
• Structured Interview. In a structured interview, the interviewer asks a set of pre‐planned

questions about specific areas and the organization in general.
• Free Recall. In this type of interview, the interviewee is asked to recount an event or a process
at their own pace and with the freedom to discuss as they recall it. The interviewer prompts the
interviewee with open-ended questions as necessary and listens for specific details of interest.
• Cognitive Interview. This type of interview is a systematic approach used to increase the
amount of information elicited about a particular event that the interviewee was either involved
in or witnessed. This kind of interview is best reserved for incident investigation and is usually
undertaken by individuals who are trained in cognitive techniques.
6.5.3. Observation
This methodology can be extremely effective when seeking to determine that the performance of
an organization is in accordance with the documentation and procedure. Observation provides
flexibility to capture details regarding the performance of the organization in a live environment to
assess if the performance is as expected.
6.5.4. Physical Examination/Inspection
Physical examination builds upon the previous methodologies and provides the opportunity to
verify that implementation (e.g., product, infrastructure, etc.) is as planned. Physical examination
may be particularly useful when a safety process results in the implementation or maintenance of a
physical control. The physical evidence can assist the surveillance team in assuring that the safety
system is providing an effective final product/control that is fit for its purpose.
6.5.5. Testing
Testing is a powerful tool in surveillance; however, it can be intrusive for the organization being
audited. Where testing is preferred as the means of assuring performance, it may be more
appropriate for the surveillance team to request attendance as guest observers during routine
testing, as opposed to mandating a test situation specifically for the surveillance event.
6.6. Dealing with Multiple Certificate Holders
In the case of an organization holding multiple certificates or approvals, the use of the SMS
Evaluation Tool should follow the rule “1-Organization = 1-Evaluation.” Therefore, if one
organization integrates all activities within a single SMS, the evaluation should consider the SMS
as a whole.
It may be the case that different teams of inspectors oversee the same SMS with regard to
different certificates, and a single evaluation may be impracticable. In such cases, the different
evaluations should be shared with the various teams of inspectors. In addition, a common
message from the competent authority/authorities should be provided to the organization.
6.7. Post Surveillance Activities
While the primary aim of an oversight program and indeed surveillance is to provide the competent
authority with assurance of the SP’s performance, a tertiary benefit comes from the external review
and subsequent continuous improvement (if necessary). Accordingly, many competent authorities
may not consider a surveillance event concluded at the exit meeting. Instead, it may be concluded
after the organization’s corrective action plan is accepted or even only after the improvements are
implemented.
Therefore, at the end of the surveillance event, the evaluation team meets with the organization’s
management personnel to summarize the findings. This includes informing them of the more
effective SMS areas and the SMS areas needing further improvement. This discussion may also
cover the organization’s safety objectives and their degree of achievement; their relationship to the
States objectives through the relevant SSP; and clarification of any possible findings requiring
specific action (including timelines). The evidence-based evaluation report should not only focus on
any missing elements of an SMS (i.e., compliance approach, being present and/or operating) but
also on the performance of the SMS as to whether the safety outcomes are appropriately
established, monitored, and met (i.e., being suitable and/or effective). This report shall indicate the
organization’s overall level of maturity to effectively identify risks, mitigate them, and ultimately
manage safety.
From here, the focus of the competent authority is the monitoring of these safety outcomes and the
implementation of a robust SMS. This should not only address the sound application of
investigative techniques, risk assessment/management procedures, and putting in-place tangible
resilient barriers, but also the ability of the organization to monitor its performance, remain alert to
changes, and effectively manage safety.
7. Continuous Improvement, Documentation, and Feedback

The overall objective of regulatory oversight is to facilitate continuous improvement in a SP’s safety
performance. Surveillance activities also provide competent authorities with information needed to
maintain the currency and accuracy of SP risk profiles.
Surveillance and other monitoring activities provide information that supports continuous
improvement and further monitoring. These processes provide a feedback loop to the P/SP’s
system, including the current organization risk profile. Continuous improvement and monitoring
serves to increase the competent authorities’ confidence in the validity of the risk profile and the
likelihood of continued satisfactory performance on the part of the P/SP.
Where needed, two methods may be used to ensure continuous improvement and monitoring: (1)
maintaining system changes and (2) assuring continuing effectiveness of the SP’s systems and the
SMS used to manage their safety by documenting the result of surveillance activities.
7.1. System Changes
Effective safety management on the part of the SP, as well as their business activities, inevitably
results in changes to their systems. Some changes are initiated by the SP to modify their business
practices, infrastructure, equipment, or procedures. Other changes are made either to comply with
regulations or to improve operational and/or safety performance. Still others are made in order to
adapt the SP’s systems and operations to changes in their operational environment.
Many changes need decisions by the competent authority to accept or approve them, but all
changes have the potential to change the SP’s organization risk profile. Surveillance and
associated analysis activities provide competent authorities the information needed to assess
potential impacts of these changes, which may affect acceptance or approval decisions.
Additionally, these changes need to be monitored to assure that initial assumptions regarding their
potential impact were accurate or revised accordingly.
Surveillance actions regarding these changes should be planned to address the initial actions
taken by the SP to integrate them into their systems as well as their continued performance over
time. This may affect both the frequency and scope of surveillance actions considering the scope,
complexity, and potential impact on safety of the changes.
7.2. Output of Surveillance
Upon completion, the outputs of surveillance activities are documented by the competent authority
to assist in the continued determination of the risk of a P/SP’s system. When documenting the
results of surveillance activities, the competent authority should identify:
• Areas of good performance

• Areas of ineffective risk controls (including those that are addressed by regulations and those
that may be unique to the P/SP that led to opportunities for improvement)
• Areas of non-compliance
• Areas of new/emerging risks
When documenting the results of surveillance, the following are examples of areas that could be
captured:
• The areas in the system that were assessed

• Sample size (i.e., number/percentage of product or system elements observed)
• Representativeness of sampling (e.g., distribution of locations, organizational units, levels of
management, employee groups)
• Documentation of interviews conducted
• Whether or not the findings of non-compliance were a result of unclear regulatory guidance
7.2.1. Documenting Performance
To support the determination of risk and future frequency and scope, after concluding surveillance
activities, competent authorities should document areas of the P/SP’s system that are performing
well and where no opportunities for improvement or non-compliances were noted. The
documentation of performance helps determine:
• The robustness of the P/SP’s safety risk management

• Areas where regulatory oversight could be reduced due to good performance
• The level to which the P/SP self-identifies hazards/associated risk and how effective their risk
controls are; this includes both those prescribed by regulations and those which are products of
their SMS
• The effectiveness of the SP’s safety assurance process to identify, assess, and treat (or
correct) identified deficiencies
7.2.2. Documenting Opportunities for Improvement
As a result of surveillance, there may be instances where potential opportunities for improvement
were identified in order to strengthen the effectiveness of a P/SP’s SMS, including operational
processes to which the SMS is applied. In these cases, the competent authority should work with
the SP to determine what actions can be taken to increase effectiveness and strengthen any
weaknesses within their SMS. Opportunities for improvement support the ability of the P/SP to
continuously improve their system and could result in activities such as updating documents or
work procedures, increasing change management, or streamlining workflows to increase
effectiveness.
7.2.3. Documenting Non-Compliances
When findings of regulatory non-compliance are identified, the appropriate action should be taken
to identify the cause, restore the degree of risk mitigation intended by the regulation or other risk
control, and correct the issue to prevent reoccurrence. Where regulatory non-compliances are
identified, the level of corrective action needed depends on the complexity of the issue, the
criticality of the issue, and most importantly the behavior of the P/SP towards the issue (i.e., was
there intent, are they willing to correct the issue). The following are initial considerations for
determining the appropriate action:
• The non-compliance was a result of flawed procedures, simple mistakes, lack of

understanding, or diminished skills.
• The P/SP recognizes the degree of risk involved and that their performance must be corrected.
• The P/SP is willing and able to apply the resources (time, people, and/or technology) to correct
the non-compliance.
• There is the presence of intentional or reckless behavior by the P/SP.
• The competent authority believes the non-compliance can be corrected and an appropriate
level of risk control can be applied to prevent future failures.
The P/SP should conduct follow up monitoring analysis and performance evaluation to ensure
effective performance of the control. The P/SP should employ the safety assurance processes of
their SMS, but these results should always be verified by independent surveillance and analysis by
the authority.
In some cases, enforcement actions are appropriate when other, more proactive actions have
failed or where the service provider is unwilling or incapable of improving their performance without
punitive or deterrent actions.
When documenting non-compliances and corrective actions the competent authority should:
• Analyze the finding against past findings, including trend analysis

• Document and advise the P/SP of the non-compliance
• Verify the P/SP’s applicable SMS processes
• Document the P/SP’s root cause analysis and corrective action plan
• Document the corrective action validation
7.2.4. Documenting Emerging Risks
Changes in the environment in which the SP operates often requires changes in their systems and
practices. Monitoring and responding to these changes is an important task for the SP’s SMS. At
the same time, competent authorities must assure that the SPs that they oversee remain aware of
these changes, as well as ensuring that their approval, acceptance, and authorizations for the
organization are kept up to date. Current documentation on the elements of the P/SP’s operational
environment forms an important part of the P/SP’s risk profile. Surveillance should include activities
to maintain information on these elements as well as to ensure that the P/SP is appropriately
aware and responsive to these changes.
Gaps in system configuration or practical drift in system performance may also present hazards
that may not be satisfactorily mitigated. As discussed earlier, these may or may not be subject to
regulatory control but in all cases, represent opportunities for improvement. Both the P/SP’s SMS
safety assurance processes and the competent authority’s surveillance should be vigilant for these
conditions and their possible implications. Both should document these emerging risks and the
efforts to address them.
7.3. Feedback
7.3.1. Feedback into the Organization Risk Profile
Each noted change and the output of surveillance activity should flow back into the P/SP’s
established risk profile. These results are used to identify changes and trends in performance in
the operational environment; assess how well the P/SP is managing their risk; and help determine
the best future oversight strategy. Maintenance of the risk profile should be thought of as a
dynamic process, updated as new information is obtained. Surveillance activities, including
analysis of information acquired from the P/SP, provides a source of risk profile maintenance.
Surveillance planning should include activities that provide information to maintain the currency
and accuracy of the risk profile.
7.3.2. Feedback to the Product/Service Provider
At the same time, competent authority personnel and those of the P/SP should establish a
common understanding of the status of the risk profile and actions to address the associated risks
in order to continually improve the associated systems. Interaction with the P/SP should recognize
the maturity of the P/SP’s SMS and their safety culture. P/SPs at earlier stages of their evolution or
otherwise at lower levels of maturity may need more frequent and/or direct input as well as more
detailed follow-up oversight. Conversely, more mature organizations may respond more positively
to performance-based input. Additional information on this concept can be found in the SM ICG
Organizational Culture Self-Assessment Tool for Regulators.
Risk profiles of individual organizations should also be analyzed collectively to maintain the
accuracy of sector risk profiles and the State’s safety objectives and associated safety
performance indicators and targets. This, too, is a dynamic process of continuous adjustment of
the State’s processes and subsequent dissemination back to P/SPs and the competent authorities’
oversight organizations.
7.3.3. Feedback into Regulations and Policy
Analysis of aggregate surveillance (safety assurance) information should also be used to inform
the competent authority about emerging risks that may affect entire sectors of the aviation system.
These analyses may suggest the need for new regulations, amendments to existing regulations,
changes in oversight policies or practices, or safety promotion activities.
Quick Reference Summary
• Attitudes and Behaviors for Effective SMS

• Guidance for Comprehensive Safety Performance Management in an SSP (for more details on
developing the state risk picture)
• ICAO Safety Management Manual Doc 9859 (Figure 8-4)
• Organizational Culture Self-Assessment Tool for Regulators
• Pamphlet: Safety Culture for Effective Safety Management
• Risk-Based and Performance-Based Oversight Guidance (for more details on the organization
risk profile)
• Safety Management Terminology
• Sector Safety Risk Profiling at the State Level (for more details on the SRP)
• SMS Courses on the ICAO website
• SMS Inspector Competency Guidance (for more information on competencies for SMS
inspectors)
• Training Program Outline for Inspector SMS Competency

Safety Oversight Following The Implementation of SMS PDF

Uploaded by

Copyright:

Available Formats

Safety Oversight Following The Implementation of SMS PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Safety Oversight Following The Implementation of SMS PDF

Uploaded by

Copyright:

Available Formats

Safety Oversight

• Collaborate on common SMS/SSP topics of interest

For further information regarding the SM ICG please contact:

Neverton Alves de Novais Adrian Duncan Nick Leow

SM ICG products can be found on SKYbrary at http://bit.ly/SM ICG.

• Safety Management Terminology

• Collaborating to improve surveillance outcomes

• Collaboration and fostering a positive safety culture

2.3. Oversight Process

• Preparation through gathering/analyzing safety information;

Figure 1: Oversight Process

3. Working Together to Improve Surveillance

3.1. Working in Collaboration

• SM ICG SMS Evaluation Tool

3.2. Fostering a Positive Safety Culture

• Industry Safety Culture Evaluation Tool and Guidance

4.1. State, Sector, and Organizational Risks

4.1.1. State Risk Picture

• Guidance for Comprehensive Safety Performance Management in an SSP (provides more

4.1.2. Sector Risk Profile

4.1.3. Organization Risk Profile

• ICAO Safety Management Manual Doc 9859 (Figure 8-4)

4.1.4. Safety Information

• Safety oversight activities

• Agreements with industry

• Guidance for Comprehensive Safety Performance Management in an SSP (provides more

5.1. Evaluation Preparation

5.1.1. Frequency and Scope

When considering frequency and scope of surveillance activities of a Product/Service Provider

• SM ICG SMS Evaluation Tool

5.2. Planning Activities: Final Evaluation Preparation

5.2.1. Knowledge and Training

• Attitudes and Behaviors for Effective SMS

6.1. Performing the Evaluation

6.2. Evaluation of SMS

SMS cannot be assessed through a simple, check-the-box compliance check or audit.

• Facilitation of an orderly approach which assists all parties

6.3. SM ICG SMS Evaluation Tool

• Industry Safety Culture Evaluation Tool and Guidance

6.4. Compliance and Performance Evaluation of an SMS

Table 1: Surveillance Focus Shift from Component Presence to Performance

Safety Risk There is a confidential There are forms/ Evidence of occurrence

6.5. Methods for Gathering Surveillance Information

6.5.1. Documentation Review

• Structured Interview. In a structured interview, the interviewer asks a set of pre‐planned

6.5.4. Physical Examination/Inspection

6.6. Dealing with Multiple Certificate Holders

6.7. Post Surveillance Activities

7. Continuous Improvement, Documentation, and Feedback

7.1. System Changes

7.2. Output of Surveillance

• Areas of good performance

• The areas in the system that were assessed

7.2.1. Documenting Performance

• The robustness of the P/SP’s safety risk management

7.2.2. Documenting Opportunities for Improvement

7.2.3. Documenting Non-Compliances

• The non-compliance was a result of flawed procedures, simple mistakes, lack of

• Analyze the finding against past findings, including trend analysis