ATS.OR.200 Safety management system

GENERAL — NON-COMPLEX ATS PROVIDERS

(a)The safety policy should include a commitment to improve towards the highest safety standards, comply with all the applicable legal requirements, meet all the applicable standards, consider the best practices and provide the appropriate resources.

(b)In cooperation with other stakeholders, the air traffic services provider should develop, coordinate and maintain an emergency response plan (ERP) that ensures orderly and safe transition from normal to emergency operations and return to normal operations. The ERP should determine the actions to be taken by the air traffic services provider or specified individuals in an emergency and reflect the size, nature and complexity of the activities performed by the air traffic services provider.

(c)Safety risk management may be performed using hazard checklists or similar risk management tools or processes, which are integrated into the activities of the air traffic services provider.

(d)An air traffic services provider should manage safety risks related to changes. Management of changes should be a documented process to identify external and internal changes that may have an adverse effect on safety. It should make use of the air traffic services provider’s existing hazard identification, risk assessment and mitigation processes.

(e)An air traffic services provider should identify persons who fulfil the role of safety managers and who are responsible for coordinating the safety management system (SMS). These persons may be accountable managers or individuals with an operational role in the air traffic services provider.

(f)Within the air traffic services provider, responsibilities should be identified for hazard identification, risk assessment and mitigation.

SAFETY POLICY — COMPLEX ATS PROVIDERS

(a)The safety policy should:

(1)be signed by the accountable manager;

(2)reflect organisational commitments regarding safety and its proactive and systematic management;

(3)be communicated, with visible endorsement, throughout the air traffic services provider;

(4)include safety reporting principles;

(5)include a commitment to:

(i)improve towards the highest safety standards;

(ii)comply with all the applicable legal requirements, meet all the applicable standards and consider the best practices;

(iii)provide appropriate resources; and

(iv)enforce safety as one primary responsibility of all managers and staff;

(6)include the safety reporting procedures;

(7)clearly indicate which types of operational behaviours are unacceptable, and include the conditions under which disciplinary action would not apply; and

(8)be periodically reviewed to ensure it remains relevant and appropriate.

(b)Senior management should:

(1)continually promote the safety policy to all personnel and demonstrate their commitment to it;

(2)provide necessary human and financial resources for its implementation; and

(3)establish safety objectives and performance standards.

SAFETY POLICY — COMPLEX ATS PROVIDERS Operational behaviour, when disciplinary action would not apply, could be where someone is not blamed for reporting something which would not have been otherwise detected.

SAFETY POLICY — COMPLEX ATS PROVIDERS

(a)The safety policy should state that the purpose of safety reporting and internal investigations is to improve safety, not to apportion blame to individuals.

(b)An air traffic services provider may combine the safety policy with the policy required by ATM/ANS.OR.B.005(a)(2).

SAFETY POLICY — NON-COMPLEX ATS PROVIDERS

(a)The safety policy should state that the purpose of safety reporting is to improve safety, not to apportion blame to individuals.

(b)An air traffic services provider may combine the safety policy with the policy required by ATM/ANS.OR.B.005(a)(2).

ACCOUNTABILITIES — COMPLEX ATS PROVIDERS The SMS of the air traffic services provider should ensure that:

(a)everyone involved in the safety aspects of the provision of air traffic services has an individual safety responsibility for their own actions;

(b)managers should be responsible for the safety performance of their respective departments or divisions; and

(c)the top management of the provider carries an overall safety responsibility.

SAFETY ACTION GROUP — COMPLEX ATS PROVIDERS

(a)A safety action group may be established as a standing group or as an ad hoc group to assist or act on behalf of the safety review board as defined in point (b) of AMC2 ATS.OR.200(1)(ii);(iii).

(b)More than one safety action group may be established depending on the scope of the task and the specific expertise required.

(c)The safety action group should report to and take strategic direction from the safety review board and should comprise managers, supervisors and personnel from operational areas.

(d)The safety action group should:

(1)monitor operational safety;

(2)resolve identified risks;

(3)assess the impact on safety of operational changes; and

(4)ensure that safety actions are implemented within agreed timescales.

(e)The safety action group should review the effectiveness of previous safety recommendations and safety promotion.

(f)Members of the safety action group should participate in the local runway safety team as per GM2 ADR.OR.D.027 ‘Safety programmes’.

ORGANISATION AND ACCOUNTABILITIES An air traffic service provider should:

(a)identify the safety manager who, irrespective of other functions, has ultimate responsibility and accountability, on behalf of the organisation, for the implementation and maintenance of the SMS;

(b)clearly define lines of safety accountability throughout the organisation, including a direct accountability for safety on the part of senior management;

(c)identify the accountabilities of all members of management, irrespective of other functions, as well as of employees, with respect to the safety performance of the SMS;

(d)document and communicate safety responsibilities, accountabilities and authorities throughout the organisation; and

(e)define the levels of management with authority to make decisions regarding safety risk tolerability.

ORGANISATION AND ACCOUNTABILITIES — COMPLEX ATS PROVIDERS The SMS of the air traffic services provider should encompass safety by including a safety manager and a safety review board in the organisational structure.

(a)Safety manager

(1)The safety manager should act as the focal point and be responsible for the development, administration and maintenance of an effective SMS. He or she should be independent of line management, and accountable directly to the highest organisational level.

(2)The role of the safety manager should, as a minimum, be to:

(i)ensure that hazard identification, risk analysis and management are undertaken in accordance with the SMS processes;

(ii)monitor the implementation of actions taken to mitigate risks;

(iii)provide periodic reports on safety performance;

(iv)ensure maintenance of safety management documentation;

(v)ensure that there is safety management training available and that it meets acceptable standards;

(vi)provide advice on safety matters; and

(vii)monitor initiation and follow-up of internal occurrence/accident investigations.

(3)The safety manager should have:

(i)adequate practical experience and expertise in air traffic services or a similar area;

(ii)adequate knowledge of safety and quality management;

(iii)adequate knowledge of the working methods and operating procedures; and

(iv)comprehensive knowledge of the applicable requirements in the area of air traffic services.

(b)Safety review board

(1)The safety review board should be a high-level committee that considers matters of strategic safety in support of the accountable manager’s safety accountability.

(2)The board should be chaired by the accountable manager and composed of heads of functional areas.

(3)The safety review board should, as a minimum:

(i)monitor safety performance against safety policy and objectives;

(ii)ensure that any safety action is taken in a timely manner; and

(iii)monitor the effectiveness of the air traffic services provider’s SMS processes.

(4)The safety review board should ensure that appropriate resources are allocated to achieve the planned safety performance.

(5)The safety manager or any other relevant person may attend, as appropriate, safety review board meetings. He or she may communicate to the accountable manager all information, as necessary, to allow decision-making based on safety data.

SAFETY MANAGER — COMPLEX ATS PROVIDERS

(a)Depending on the size of the air traffic services provider and the nature and complexity of their activities, the safety manager may be assisted by additional safety personnel in the performance of all the safety-management-related tasks.

(b)Regardless of the organisational set-up, it is important that the safety manager remains the unique focal point as regards the development, administration and maintenance of the air traffic services provider’s SMS.

SAFETY MANAGER — NON-COMPLEX AIR TRAFFIC SERVICES PROVIDERS In the case of a non-complex air traffic services provider, the function of the safety manager could be combined with another function within the organisation provided that sufficient independence is guaranteed.

COORDINATION OF EMERGENCY RESPONSE PLANNING FOR ATS PROVIDERS — COMPLEX ATS PROVIDERS

(a)An air traffic services provider should develop, coordinate and maintain a plan for its response to an emergency. It should:

(1)reflect the nature and complexity of the activities performed by the air traffic services provider;

(2)ensure an orderly and safe transition from normal to emergency operations;

(3)ensure safe continuation of operations or return to normal operations as soon as practicable; and

(4)ensure coordination with the ERPs of other organisations, where appropriate.

(b)For emergencies occurring at the aerodrome or in its surroundings, the plan should be aligned with the aerodrome ERP and be coordinated with the aerodrome operator.

TYPES OF EMERGENCIES At least the following types of emergencies may be considered:

(a)aircraft emergencies;

(b)natural phenomena (e.g. extreme weather conditions);

(c)acts of terrorism;

(d)loss of the ability to communicate with the aircraft; and

(e)loss of the air traffic services unit.

COORDINATION OF THE EMERGENCY RESPONSE PLANNING FOR ATS PROVIDERS — COMPLEX ATS PROVIDERS For aerodrome-related emergencies, please refer to GM4 ADR.OPS.B.005(a) ‘Aerodrome Emergency Planning’.

SAFETY MANAGEMENT MANUAL (SMM) — COMPLEX ATS PROVIDERS The safety management manual should be the key instrument for communicating the approach to safety for the air traffic services provider. The SMM should document all aspects of safety management, including but not limited to the:

(a)scope of the SMS;

(b)safety policy and objectives;

(c)safety accountability of the accountable manager;

(d)safety responsibilities, accountabilities and authorities of key safety personnel throughout the air traffic services provider;

(e)documentation control procedures;

(f)hazard identification and safety risk management schemes;

(g)safety performance monitoring;

(h)incident investigation and reporting;

(i)emergency response planning;

(j)management of change (including organisational changes with regard to safety responsibilities and changes to functional systems); and

(k)safety promotion.

SAFETY RECORDS — COMPLEX ATS PROVIDERS Safety records that should be maintained and retained include but are not limited to:

(a)certificates;

(b)limited certificates;

(c)declarations;

(d)safety policy;

(e)safety accountabilities/responsibilities;

(f)safety occurrences;

(g)emergency response plan;

(h)SMS documentation;

(i)training and competence;

(j)occurrence reports;

(k)safety risk assessments including safety assessment of changes to the functional system;

(l)determination of either complex or non-complex organisation; and

(m)approved alternative means of compliance.

SAFETY MANAGEMENT MANUAL (SMM) — COMPLEX ATS PROVIDERS The SMM may be contained in (one of) the manual(s) of the air traffic services provider.

SAFETY ASSURANCE — COMPLEX ATS PROVIDERS

(a)Leading indicators

(1)Metrics that measure inputs to the safety system (either within an organisation, a sector or across the total aviation system) to manage and improve safety performance.

(2)Leading indicators measure the specific features of the aviation safety system designed to support continuous improvement and to give an indication of likely future safety performance. They are designed to help identify whether the providers and regulators are taking actions and/or have processes in place that are effective in lowering the risk.

(b)Lagging indicators Metrics that measure the outcome of the service delivery by measuring events that have already occurred and that impact safety performance. There are two subsets of lagging indicators:

(1)Outcome indicators: These include only the occurrences that one aims to prevent, for example fatal or catastrophic accidents. Depending on the system, the severity of the occurrences that are included as outcome indicators can be adjusted to include all accidents and serious incidents.

(2)Precursor indicators: These indicators do not manifest themselves in accidents or serious incidents. They indicate less severe system failures or ‘near misses’, and are used to assess how frequently the system comes close to severe failure. Because they are typically more numerous than outcome indicators, they can be used for trend monitoring.

(c)Safety management system In the case of a complex air traffic services provider, the SMS should include all of these measures. Risk management efforts, however, should be targeted at leading indicators and precursor events. The reason for doing this is to reduce the number of accidents and serious incidents.

(d)Differing levels of safety performance monitoring

(1)Measurements of safety in terms of undesirable events, such as accidents and incidents, are examples of ‘lagging indicators’, which can capture safety performance a posteriori. Such indicators give valuable signals to all involved in air traffic services — providers, regulators, and recipients — of the levels of safety being experienced and of the ability of the organisations concerned to take appropriate mitigation action. However, other types of measurement — ‘leading indicators’ — can give a wider perspective of the safety ‘health’ of the functional system, and focus on systemic issues, such as safety maturity and SMS performance.

(2)A holistic approach to performance monitoring is an essential input to decision-making with regard to safety. It is important to ensure that good safety performance is attributable to good performance of the SMS, not simply to lack of incidents or accidents. It is also essential that the metrics chosen match the requirements of the stakeholders and decision-makers involved in safety improvement.

(3)As shown in the diagram, stakeholders in the wider aviation industry and the general public require relatively small numbers of safety indicators (safety performance indicators or key performance indicators) which can give an instant ‘feel’ for the overall position regarding safety performance. Conversely, those involved in the management of services concerned need a more detailed set of metrics on which to base decisions regarding the management of the services and facilities being reviewed.

[Figure or form omitted from this preview — available in the Avioverse workspace library.]

CONTINUOUS IMPROVEMENT OF THE SMS — COMPLEX ATS PROVIDERS An air traffic services provider should continuously improve the effectiveness of its SMS by:

(a)developing and maintaining a formal process to identify the causes of substandard performance of the SMS;

(b)establishing one or more mechanisms to determine the implications of substandard performance of the SMS;

(c)establishing one or more mechanisms to eliminate or mitigate the causes of substandard performance of the SMS; and

(d)developing and maintaining a process for the proactive evaluation of facilities, equipment, documentation, processes and procedures (through internal audits, surveys, etc.).

CONTINUOUS IMPROVEMENT OF THE SMS — COMPLEX ATS PROVIDERS

(a)Substandard performance of the SMS can manifest itself in two ways. Firstly, where the SMS processes themselves do not fit their purpose (e.g. not adequately enabling the air traffic services provider to identify, manage and mitigate hazards and their associated risks) resulting in the safety performance of the service being impacted in a negative way. Secondly, where the SMS processes fit their purpose, but are not applied correctly or adequately by the personnel whose safety accountabilities and responsibilities are discharged through the application of the SMS. Personnel who have safety accountabilities and responsibilities are considered an essential part of the effectiveness of the SMS and viewed as part of the SMS.

(b)Therefore, by detecting substandard performance of the SMS, the air traffic services provider can take action to improve the SMS processes themselves or to improve the application of the SMS processes by those with safety accountabilities and responsibilities resulting in an improvement to the safety performance.

(c)Continuous improvement of the effectiveness of the safety management processes can be achieved through:

(1)proactive and reactive evaluations of facilities, equipment, documentation, processes and procedures through safety audits and surveys; and

(2)reactive evaluations in order to verify the effectiveness of the system for control and mitigation of risks.

(d)In the same way that continuous improvement is sought through safety performance monitoring and measurement (see GM1 ATM/ANS.OR.B.005(a)(3) and GM1 ATS.OR.200(3)(i)) by the use of leading and lagging indicators, continuous improvement of the SMS provides the air traffic services provider with safety assurance for the service.

(e)As with safety performance monitoring, the continuous improvement of the SMS lends itself to a process that can be summarised as:

(1)Identify where there are potential weaknesses or opportunities for improvement;

(2)Identify what goes right and disseminate as best practice;

(3)Identify what can be done to tackle weaknesses or lead to improvement;

(4)Set performance standards for the actions identified;

(5)Monitor performance against the standards;

(6)Take corrective actions to improve performance; and

(7)Repeat the process by using the continuous improvement model below: [Figure or form omitted from this preview — available in the Avioverse workspace library.]

(f)Taking into account that the SMS is being required to manage safety, it can be assumed that by continuously improving the effectiveness of the SMS, ATS providers should be able to better manage and mitigate, and ultimately control the safety risks associated with the provisions of their services.

TRAINING AND COMMUNICATION — COMPLEX ATS PROVIDERS

(a)Training

(1)All personnel should receive safety training as appropriate for their safety responsibilities.

(2)Adequate records of all safety training provided should be kept.

(b)Communication

(1)The ATS provider should establish communication about safety matters that:

(a)ensures that all personnel are aware of the safety management activities as appropriate for their safety responsibilities;

(b)conveys critical information, especially relating to assessed risks and analysed hazards;

(c)explains why particular actions are taken; and

(d)explains why safety procedures are introduced or changed.

(2)Regular meetings with personnel where information, actions and procedures are discussed, may be used to communicate safety matters.

TRAINING — COMPLEX ATS PROVIDERS The safety training programme may consist of self-instruction (e.g. newsletters, flight safety magazines), classroom training, e-learning or similar training provided by training organisations.