UAS.LUC.030 Safety management system

PERSONNEL REQUIREMENTS — GENERAL

(a)The accountable manager should have the authority to ensure that all activities are carried out in accordance with the requirements of the UAS Regulation.

(b)The safety manager should:

(1)facilitate hazard identification, risk analysis, and risk management;

(2)monitor the implementation of risk mitigation measures;

(3)provide periodic reports on safety performance;

(4)ensure maintenance of the safety management documentation;

(5)ensure that there is safety management training available and that it meets acceptable standards;

(6)provide all the personnel involved with advice on safety matters; and

(7)ensure the initiation and follow-up of internal occurrence investigations.

(c)Management and other personnel of the LUC holder should be qualified for the planned operations in order to meet the relevant requirements of the UAS Regulation.

(d)The LUC holder should ensure that its personnel receive appropriate training to remain in compliance with the relevant requirements of the UAS Regulation.

ACCOUNTABLE MANAGER The accountable manager is a single, identifiable person who has the responsibility for the effective and efficient performance of the LUC holder’s safety management system.

SAFETY POLICY

(a)The safety policy should:

(1)be endorsed by the accountable manager;

(2)reflect organisational commitments regarding safety, and its proactive and systematic management;

(3)be communicated, with visible endorsement, throughout the organisation;

(4)include internal reporting principles, and encourage personnel to report errors related to UAS operations, incidents and hazards; and

(5)recognise the need for all personnel to cooperate with compliance monitoring and safety investigations.

(b)The safety policy should include a commitment to:

(1)improve towards the highest safety standards;

(2)comply with all applicable legislation, meet all applicable standards, and consider best practices;

(3)provide appropriate resources;

(4)apply the human factors principles;

(5)enforce safety as a primary responsibility of all managers; and

(6)apply ‘just culture’ principles and, in particular, not to make available or use the information on occurrences:

(i)to attribute blame or liability to someone for reporting something which would not have been otherwise detected; or

(ii)for any purpose other than the improvement of safety.

(c)The senior management of the UAS operator should:

(1)continually promote the UAS operator’s safety policy to all personnel, and demonstrate their commitment to it;

(2)provide the necessary human and financial resources for the implementation of the safety policy; and

(3)establish safety objectives and associated performance standards.

SAFETY POLICY The safety policy is the means whereby an organisation states its intention to maintain and, where practicable, improve safety levels in all its activities and to minimise its contribution to the risk of an accident or serious incident as far as is reasonably practicable. It reflects the management’s commitment to safety, and should reflect the organisation’s philosophy of safety management, as well as be the foundation on which the organisation’s safety management system is built. It serves as a reminder of ‘how we do business here’. The creation of a positive safety culture begins with the issuance of a clear, unequivocal direction. The commitment to apply ‘just culture’ principles forms the basis for the organisation’s internal rules that describe how ‘just culture’ principles are guaranteed and implemented. For organisations that have their principal place of business in a MS, Regulation (EU) No 376/2014 defines the ‘just culture’ principles to be applied (refer in particular to Article 16(11) thereof).

PERSONNEL REQUIREMENTS The functions of the safety manager may be fulfilled by the accountable manager or another person charged by the UAS operator with the responsibility of ensuring that the UAS operator remains in compliance with the requirements of the UAS Regulation. Where the safety manager already fulfils the functions of the compliance monitoring manager, the accountable manager cannot be the safety manager. Depending on the size of the organisation and the nature and complexity of its activities, the safety manager may be assisted by additional safety personnel for the performance of all the safety management tasks. Regardless of the organisational set-up, it is important that the safety manager remains the unique focal point as regards the development, administration, and maintenance of the organisation’s management system.

PERSONNEL REQUIREMENTS A UAS operator may include a safety committee in the organisational structure of its safety management system and, if needed, one or more safety action groups.

(a)Safety committee A safety committee may be established to support the accountable manager in their safety responsibilities. The safety committee should monitor:

(1)the UAS operator’s performance against safety objectives and performance standards;

(2)whether safety action is taken in a timely manner; and

(3)the effectiveness of the UAS operator’s safety management processes.

(b)Safety action group

(1)Depending on the scope of the task and the specific expertise required, one or more safety action groups should be established to assist the safety manager in their functions.

(2)The safety action group should be comprised of managers, supervisors and personnel from operational areas, depending on the scope of the task and the specific expertise required.

(3)The safety action group should at least perform the following:

(i)monitor operational safety and assess the impact of operational changes on safety;

(ii)define actions to mitigate the identified safety risks; and

(iii)ensure that safety measures are implemented within agreed timescales.

KEY SAFETY PERSONNEL The UAS operator should appoint personnel to manage key fields of activity such as operations, maintenance, training, etc.

DOCUMENTATION The safety management system documentation of the LUC holder should be included in an SMM or in the LUC manual. If that documentation is contained in more than one operator’s manual and is not duplicated, cross references should be provided.

SAFETY REPORTING AND INTERNAL INVESTIGATIONS The purpose of safety reporting and internal investigations is to use reported information to improve the level of safety performance of the UAS operator. The purpose is not to attribute blame or liability. The specific objectives of safety reporting and internal investigations are to:

(a)enable assessments of the safety implications of each relevant incident and accident, including previous similar occurrences, so that any necessary action can be initiated; and

(b)ensure that knowledge of relevant incidents and accidents is disseminated so that other persons and UAS operators may learn from them. All occurrence reports that are considered to be reportable by the person who submits the report should be retained, as the significance of such reports may only become obvious at a later date.

COMMUNICATION ON SAFETY

(a)The organisation should establish communication about safety matters that:

(1)ensures that all personnel are aware of the safety management activities as appropriate for their safety responsibilities;

(2)conveys safety-critical information, especially information related to assessed risks and analysed hazards;

(3)explains why particular actions are taken; and

(4)explains why safety procedures are introduced or changed.

(b)Regular meetings with personnel, where information, actions, and procedures are discussed, may be used to communicate safety matters.

TRAINING AND SAFETY PROMOTION Training, combined with safety communication and information sharing form part of safety promotion and supplement the organisation’s policies, encouraging a positive safety culture and creating an environment that is favourable to the achievement of the organisation’s safety objectives. Safety promotion can also be the instrument for the development of a just culture. Depending on the particular risk, safety promotion may constitute or complement a risk mitigation action and an effective reporting system.

COMPLIANCE MONITORING

(a)The accountable manager should designate a manager to monitor the compliance of the LUC holder with:

(1)the terms of approval, the privileges, the risk assessment and the resulting mitigation measures;

(2)all operator’s manuals and procedures; and

(3)training standards.

(b)The compliance monitoring manager should:

(1)have knowledge of, and experience in, compliance monitoring;

(2)have direct access to the accountable manager to ensure that findings are addressed, as necessary; and

(3)not be one of the other persons referred to in UAS.LUC.030(2)(d).

(c)The tasks of the compliance monitoring manager may be performed by the safety manager, provided that the latter has knowledge of, and experience in, compliance monitoring.

(d)The compliance monitoring function should include audits and inspections of the LUC holder. The audits and inspections should be carried out by personnel who are not responsible for the function, procedure or products being audited.

(e)An organisation should establish an audit plan to show when and how often the activities as required by the UAS Regulation will be audited.

(f)The independent audit should ensure that all aspects of compliance, including all the subcontracted activities, are checked within a period defined in the scheduled plan, and agreed by the competent authority.

(g)Where the organisation has more than one approved location, the compliance monitoring function should describe how these locations are integrated into the system and include a plan to audit each location in a risk-based programme as agreed by the competent authority.

(h)A report should be raised each time an audit is carried out, describing what was checked and the resulting findings against applicable requirements and procedures.

(i)The feedback part of the compliance monitoring function should address who is required to rectify any non-compliance in each particular case, and the procedure to be followed if rectification is not completed within appropriate timescales. The procedure should lead to the accountable manager.

(j)The LUC holder should be responsible for the effectiveness of the compliance monitoring function, in particular for the effective implementation and follow-up of all corrective measures.

COMPLIANCE MONITORING The primary objective of the compliance monitoring function is to enable the UAS operator to ensure a safe operation and to remain in compliance with the UAS Regulation. An external organisation may be contracted to perform compliance monitoring functions. In such cases, that organisation should designate the compliance monitoring manager. The compliance monitoring manager may use one or more auditors to carry out compliance audits and inspections of the LUC holder under their own responsibility.

SAFETY RISK MANAGEMENT The LUC holder should have a safety management system that is able to perform at least the following:

(a)identify hazards through reactive, proactive, and predictive methodologies, using various data sources, including safety reporting and internal investigations;

(b)collect, record, analyse, act on and generate feedback about hazards and the associated risks that affect the safety of the operational activities of the UAS operator;

(c)develop an operational risk assessment as required by Article 11;

(d)carry out internal safety investigations;

(e)monitor and measure safety performance through safety reports, safety reviews, in particular during the introduction and deployment of new technologies, safety audits, including periodically assessing the status of safety risk controls, and safety surveys;

(f)manage the safety risks related to a change, using a documented process to identify any external and internal change that may have an adverse effect on safety; the management of change should make use of the UAS operator’s existing hazard identification, risk assessment, and mitigation processes;

(g)manage the safety risks that stem from products or services delivered through subcontractors, by using its existing hazard identification, risk assessment, and mitigation processes, or by requiring that the subcontractors have an equivalent process for hazard identification and risk management; and

(h)respond to emergencies using an ERP that reflects the size, nature, and complexity of the activities performed by the organisation, considering AMC3 UAS.SPEC.030(3)(e). The ERP should:

(1)contain the action to be taken by the UAS operator or the specified individuals in an emergency;

(2)provide for a safe transition from normal to emergency operations and vice versa;

(3)ensure coordination with the ERPs of other organisations, where appropriate; and

(4)describe emergency training/drills, as appropriate.

SAFETY RISK MANAGEMENT In very broad terms, the objective of safety risk management is to eliminate risk, where practical, or reduce the risk (likelihood/severity) to acceptable levels, and to manage the remaining risk to avoid or mitigate any possible undesirable outcome. Safety risk management is, therefore, integral to the development and application of effective safety management. Safety risk management can be applied at many levels in an organisation. It can be applied at the strategic level and at operational levels. The potential for human error, its influences and sources, should be identified and managed through the safety risk management process. Human factors risk management should allow the organisation to determine where it is vulnerable to human performance limitations.

MANAGEMENT OF CHANGE Unless properly managed, changes in organisational structures, facilities, the scope of work, personnel, documentation, policies and procedures, etc. can result in the inadvertent introduction of new hazards, which expose the organisation to new, or increased risk. Effective organisations seek to improve their processes, with conscious recognition that changes can expose the organisations to potentially latent hazards and risks if the changes are not properly and effectively managed. Regardless of the magnitude of a change, large or small, proactive consideration should always be given to the safety implications. This is primarily the responsibility of the team that proposes and/or implements the change. However, change can only be successful if all the personnel affected by the change are engaged and involved, and they participate in the process. The magnitude of a change, its safety criticality, and its potential impact on human performance should be assessed in any change management process. The process for the management of change typically provides principles and a structured framework for managing all aspects of the change. Disciplined application of change management can maximise the effectiveness of the change, engage staff, and minimise the risks inherent in change. Change is the catalyst for an organisation to perform the hazard identification and risk management processes. Some examples of change include, but are not limited to:

(a)changes to the organisational structure;

(b)a new type of UAS being employed;

(c)additional UASs of the same or similar type being acquired;

(d)significant changes in personnel (affecting key personnel and/or large numbers of personnel, high turn-over);

(e)new or amended regulations;

(f)changes in financial status;

(g)new location(s), equipment, and/or operational procedures; and

(h)new subcontractors. A change may have the potential to introduce new human factors issues, or exacerbate pre-existing issues. For example, changes in computer systems, equipment, technology, personnel (including the management), procedures, the work organisation, or work processes are likely to affect performance. The purpose of integrating human factors into the management of change is to minimise potential risks by specifically considering the impact of the change on the people within a system. Special consideration, including any human factors issues, should be given to the ‘transition period’. In addition, the activities utilised to manage these issues should be integrated into the change management plan. Effective management of change should be supported by the following:

(a)implementation of a process for formal hazard analyses/risk assessment for major operational changes, major organisational changes, changes in key personnel, and changes that may affect the way a UAS operation is carried out;

(b)identification of changes likely to occur in business which would have a noticeable impact on:

(1)resources — material and human;

(2)management guidance — processes, procedures, training; and

(3)management control;

(c)safety case/risk assessments that are focused on aviation safety; and

(d)involvement of key stakeholders in the change management process as appropriate. During the change management process, previous risk assessments and existing hazards are reviewed for possible effects.

SAFETY RISK MANAGEMENT — INTERFACES BETWEEN ORGANISATIONS Safety risk management processes should specifically address the planned implementation of, or participation in, any complex arrangements (such as when multiple organisations are contracted, or when multiple levels of contracting/subcontracting are included). Hazard identification and risk assessment start with the identification of all parties involved in the arrangement, including independent experts and non-approved organisations. This extends to the overall control structure, and assesses in particular the following elements across all subcontract levels and all parties within such arrangements:

(a)coordination and interfaces between the different parties;

(b)applicable procedures;

(c)communication between all the parties involved, including reporting and feedback channels;

(d)task allocation, responsibilities and authorities; and

(e)the qualifications and competency of key personnel. Safety risk management should focus on the following aspects:

(a)clear assignment of accountability and allocation of responsibilities;

(b)only one party is responsible for a specific aspect of the arrangement — there should be no overlapping or conflicting responsibilities, in order to eliminate coordination errors;

(c)the existence of clear reporting lines, both for occurrence reporting and progress reporting; and

(d)the possibility for staff to directly notify the organisation of any hazard by suggesting an obviously unacceptable safety risk as a result of the potential consequences of this hazard. Regular communication between all parties to discuss work progress, risk mitigation actions, changes to the arrangement, as well as any other significant issues, should be ensured.

USE OF SUBCONTRACTORS

(a)When an LUC holder uses products or services delivered through a subcontractor that is not itself approved in accordance with this Subpart, the subcontractor should work under the terms of the LUC.

(b)Regardless of the certification status of the subcontractor, the LUC holder is responsible for ensuring that all subcontracted products or services are subject to the hazard identification, risk management, and compliance monitoring of the LUC holder.