The U.S. Federal Aviation Authority (FAA) has issued the Final Rule mandating the implementation of Safety Management Systems (SMS) for all certificate holders under Part 121 of the Code of Federal Regulations (CFR). Part 121 operators are generally U.S. domestic passenger airlines and cargo operations (referred to in this article as air carriers or operators). The new SMS rule is found at 14 CFR §5 (Part 5). While Part 5 now only applies to one sector of the aviation industry, the FAA noted that it was developed as a “uniform standard that could be extended” to other certificate holders, such as Part 135 operators and Part 145 maintenance and repair stations, as well as Original Equipment Manufacturers (OEMs).1
A rule requiring air carriers to adopt SMS has been in the works since the passage of the Airline Safety and Federal Aviation Administration Extension Act of 2010 (the Act).2 Under the Act, Congress directed the FAA to institute regulations requiring the establishment of SMS programs in Part 121 operations. The new Part 5 was originally slated to be finalized in October 2012, but the Final Rule was delayed for several years while the FAA considered the comments submitted by air carriers, airframe manufacturers, industry groups and others.
The FAA’s Part 5 is in line with the policies of the International Civil Aviation Organization (ICAO), which had established an SMS standard for ICAO member-state air carriers involved in international transportation under Annex 6 to the Chicago Convention.3
Safety From the Top Down
As the name suggests, SMS is a systematic, process-oriented approach to increasing safety. According to the FAA’s analysis, while technology, training and certification have greatly reduced the number of aircraft accidents worldwide, accidents arising from aspects of the operating environment, that is, from the culture of the operator, have largely remained unaffected. System accidents – generally defined as accidents caused by multiple failures in a complex system4 – persisted as strengthened oversight, training and technology improved air transportation. As means of rerouting the safety focus from reactive measures (investigating safety lapses after an accident) to proactive measures (putting practices in place to analyze operational environments to prevent accidents from occurring), air carriers began instituting programs like FOQA, ASAP and LOSA.5
SMS expands upon these programs by not only focusing on proactive risk identification and risk controls, but also by taking the responsibility for safety out of a designated “safety” department and requiring responsibility for safety in all aviation-related activities conducted by the certificate holder. The FAA defines SMS as “the formal, top-down organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.”6
With the adoption of the Final Rule on January 8, 2015, air carriers have until September 9, 2015 to submit an SMS implementation plan which must be approved by March 9, 2016.7 The final SMS plan must be approved and in place by January 8, 2018.8
SMS Building Blocks
Part 5 does not instruct certificate holders on how to implement the SMS, but rather sets forth the requirements for SMS. The FAA stated that it would be left to each certificate holder to develop its own program. Operators questioned whether small carriers would be unduly burdened by the regulations, as they do not have the same human or financial resources to implement as extensive a program as a larger operator. Under the FAA’s Final Rule, SMS is “scalable” to each certificate holder and the plan should be in line with the scope and complexity of each certificate holder’s operations.9
Every SMS, however, must consist of four components: safety policy; safety risk management; safety assurance; and safety promotion.10
Safety Policy
Safety Policy establishes the company’s (and senior management’s) commitment to improve safety on a continual basis, as well as the procedures for doing so.11 The policy must identify the company’s safety objectives, provide for a reporting system and set forth an emergency response plan. Every SMS must designate an “accountable executive” who has “final authority” over the SMS.12 This top-level executive designation is one of the biggest changes under SMS. In most existing safety programs, management of safety comes from within the specific department charged with safety (e.g., flight safety group office).
Safety Risk Management
Safety Risk Management (SRM) is a process within the SMS that requires the certificate holder to review existing systems and new systems to identify “hazards” or ineffective existing risk controls.13 In short, SRM is the process of analyzing operations for unacceptable levels of risk, or, under the language of Part 5, reviewing “systems” for “hazards.” During the comment period, concerns were raised regarding how far of a reach SMS regulations would have (i.e, would all types of operations be required to comply with the SMS procedures and what types of conditions would constitute a “hazard”). The FAA has clarified that “the term ‘system’ is used to describe the operational components used to deliver aviation-related services. . . . The term ‘system’ does not include those people, procedures, resources, hardware and software that are not directly related to the delivery of air transportation services (e.g., advertising, building maintenance and payroll).”14 Similarly, Part 5’s definition of “hazard” has been limited to mean “a condition that could foreseeably cause or contribute to an aircraft accident as defined under 49 CFR 830.2 [an occurrence associated with an aircraft between boarding and deplaning causing serious bodily injury or death or substantial damage to the aircraft].”15
Safety Assurance
Safety Assurance (SA) involves the evaluation of the effectiveness of risk controls and provides the processes for identifying new hazards. SA is the component in which data is king – an air carrier under Part 5 must put in place systems to record and document the safety performance of the carrier’s operations.16
Safety Promotion
Under Safety Promotion, a certificate holder must train all individuals involved in the SMS, including those at top management levels and must coordinate necessary communications regarding all the safety policies and actions taken in furtherance of safety.17 The intent is not only to foster a company-wide safety culture, but to make the culture a sustainable one.
Part 5 limits FAA oversight of SMS to the aviation operations conducted under the air carrier’s Part 119 certificate. Should any air carrier have SMS programs in other sectors of its operations (e.g., occupational health and safety), Part 5 does not apply. Moreover, this is also true (for the time being) for other certificated operations, such as maintenance or training center activities.18
The SMS Document Conundrum
SMS is driven by data. Certificate holders must record outputs from SMS training, SRM and SA processes, as well as communications regarding the SMS in place. All of this information creates questions of additional risk exposure for any SMS participant. There has long been a tension between frank internal assessment to further safety and the use of that information for liability or publicity purposes. During the FAA’s Notice of Proposed Rule Making comment period, comments were submitted by numerous air transportation industry members, questioning whether such data would or could be protected from the Freedom of Information Act (FOIA) or from disclosure in civil litigation. Under all components of the SMS, certificate holders are required to document and retain records (duration of retention is dependent on the type of data).19 Certain components, like SA, involve implementing processes to create data to be analyzed and acted upon.20 The operator is required to make that data available to FAA inspectors but is not necessarily required to turn the data over to the FAA.21 Air carriers have successfully implemented many quality assurance programs and much of that information has been protected from general dissemination, allowing air carriers to identify and respond to risks without the pressure of public disclosure.
The new SMS rule does not contain express protections for information created in response to compliance with the four SMS components. There is limited protection from FOIA disclosure by the FAA under existing U.S. federal law for “[r]eports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the [FAA].”22 Critically, the protections only apply to a small subset of SMS documents — those created in the design and implementation of the air carrier’s SMS (and which are the documents that must be submitted to the FAA under 14 CFR 5.1). As noted above, the day to day SMS record-keeping will be maintained by the certificate holder. Additionally, documents are not protected if they are created or maintained in accordance with other governmental regulations or submitted to another government agency for compliance.23
Moreover, documents created and stored under SMS have no special privilege for protection in civil litigation. (Though, as the FAA noted, certificate holders should seek any privilege or protection “appropriate in the jurisdiction.”) Given the emphasis on safety in aviation, and the strides made by the industry as a whole, there is no doubt that certificate holders consider safety paramount. But in the era of Electronically Stored Information (ESI), and the increased burden it has created on parties to a lawsuit to produce documents during the discovery process, SMS may now present new challenges. SMS will ostensibly increase the amount of data created and stored by a certificate holder. Whether there will be an attempt to misuse the data created as part of SMS in the often onerous and expensive discovery process remains to be seen, but obviously is something that must be considered by certificate holders.
1 80 FR 1308, 1313 (January 8, 2015).
2 Pub. L. No. 111-216, 124 Stat. 2348. The Act itself came about because of the crash of Colgan Air Flight 3407 in February 2009 outside of Buffalo, NY.
3 Convention on International Civil Aviation, December 7, 1944, 61 Stat. 1180, T.I.A.S. no. 1591, 15 U.N.T.S. 295; ICAO Annex 6, Operation of Aircraft, Part I, International Commercial Air Transport – Aeroplanes, (9th ed. 2010); ICAO Annex 19, Safety Management (1st ed. 2013). ICAO has now consolidated all safety programs into a new, separate Annex 19.
4 Charles Perrow, Normal Accidents: Living with High-Risk Technologies, With a New Afterword and a Postscript on the Y2K Problem (Princeton University Press, 1999). The ValuJet Flight 592 loss over the Everglades in Florida in 1996, which resulted in the death of all 110 people on-board, has been described as an example of a “system accident.” The failures of the baggage handlers, the maintenance facility and the operator to identify, label and handle the oxygen canisters coincided to cause the tragic loss.
5 FOQA – Flight Operation Quality Assurance; ASAP – Aviation Safety Action Program; LOSA – Line Operation Safety Assessments. Maintenance facilities and OEMs also began instituting proactive safety programs, but for purposes of this article we mention only those put in place by air carriers.
6 14 CFR §5.5.
7 14 CFR §5.1.
8 14 CFR §5.1.
9 14 CFR §5.3.
10 14 CFR §5.3.
11 14 CFR §5.21.
12 14 CFR §5.25.
13 14 CFR §5.51-.55.
14 80 FR at 1315.
15 14 CFR §5.5.
16 14 CFR §5.71-.75.
17 14 CFR §5.91.
18 80 FR at 1311.
19 14 CFR §5.95.
20 14 CFR §5.71.
21 14 CFR §5.95-.97.
22 FAA Modernization and Reform Act of 2012, 49 USC § 44735 (b)(4).
23 80 FR at 1312. The Modernization and Reform Act only applies to documents in the FAA’s control.