I’ve seen that look before. It’s that deer-in-the-headlights feeling that takes over as the new accountable executive (AE) stares down at the safety management system (SMS) material. There is an ICAO 9859, Revision 4, the FAA AC 120-92B and the FAA Part 5, for the U.S. Part 121 carriers--all the latest editions. The initial enthusiasm is long gone. Dread has taken over as the reality of implementing the SMS sets in. Where to start?

The AE and the freshy minted director of safety shuffle through the guidance material. It is not much help. This is what ICAO has in 9859, Revision 4.

9.7.1.5 Because each organization is unique, there is no “one size fits all” method for SMS implementation. It is expected that each organization will implement an SMS that works for its unique situation. Each organization should define for itself how it intends to go about fulfilling the fundamental requirements.

No help there. An older 9859, Revision 3, has a massive Gantt chart that basically works its way through the Four Pillars. No help there either.

The latest FAA AC, 120-92B, has what is generally referred to as the “Phased” or “Step” process. The operator begins with a plan, then introduces reactive processes, then proactive tools and finally continuous improvement--SMS nirvana.

But that doesn’t really provide implementation guidance. The purpose of this article is to offer a plan that helps an operator understand what to do and why. Concrete examples of the sequential actions are provided. This process can be used for initial startup or an SMS that is already in place but in need of a boost to make it more effective. Keep in mind that this is for a medium to large operation. It would not be appropriate for smaller operators. However, there are some suggestions for them as well. That information is near the end of the article.

Safety, the Prologue

Before going down the path of implementation, it might be useful to describe some of the terms and concepts associated with the word “safety” and the safety profession. That way, everyone is working from the same sheet of music. The definition of “safety” is usually something like “freedom from risk or harm.” That statement is far too broad and does not come close to an organizational definition

Safety is one of the operation’s checks and balances. To understand what Safety does, it helps to understand what the other checks and balances do and work back from there.  

Quality control (QC) checks the work. If a technician puts 90 lb. of torque on a nut, an inspector will retorque the nut to 90 lb.; checking the work. Quality assurance (QA) checks processes. If Revision A of a manual is supposed to have 100 pages, a QA auditor will check to make sure it’s all there. 

On the flight side there is standards. Standards strives to improve individual performance. They check the work. If a flight crew is flying an unstable approach with a Standards pilot in the jump seat, that pilot might suggest the crew fly some approaches and retake the CRM course to improve individual performance. If a Safety person witnessed the same unstable approach he or she would question the underlying processes that facilitated or allowed such a situation. Safety’s assumption is that other pilots who are products of the same system could need additional help too. The individual performance shortcoming is the trigger, not the target. That trigger alerts Safety that there is a non-standard situation in play. Safety would then coordinate with Flight Ops to look at hiring, training, testing, SOPs, manuals, audits, the ATC aspect and more to see if those processes can be modified to prevent a recurrence. This is Safety’s mandate: Use the arsenal of investigation tools to identify and mitigate the causal factors. It is also why Safety does not need to know the identity of a person reporting a hazard or error. It is not who did it but what went wrong that is important.

The safety mandate is a critically important concept because it is what Safety does. The director of safety is the administrator of the SMS. He or she will take the investigation results to the process owner for mitigation. There will be more on all this as we go along.

What follows is a discussion of start-up activities that begin the implementation process. These are listed in the order they should be introduced.

Safety Survey

The first thing to do when starting, or improving, an SMS is to conduct a safety survey. The initial safety survey serves two valuable purposes. The first is that it reveals the employees’ current perceptions of safety in the operation. One cautionary note about the initial survey: There are two different initial surveys. One is for operators that have no safety program whatsoever. There is no value in asking about, say, reporting systems that do not exist. The other one is for operators that have some safety functions already in place.

The second benefit is that it establishes the baseline data points for all the different elements of the safety program. The company is about to embark on a program to improve safety culture. It is critical that the base or initial perceptions are established on various safety-related topics. These will include safety and occurrence reporting, safety culture, just culture, fatigue risk management system, procedural intentional noncompliance (PiNC), communications or any other subject of interest to the company. Subsequent surveys will forever compare themselves to those baseline values. The company can continue asking the same questions year-over-year and track any changes. Hopefully, they are in positive territory.

What does the survey actually look like? One format offers 15 or so statements. An example would be “I believe our company has an effective just culture.” The respondent can choose from one of four answers: strongly agree, agree, disagree or strongly disagree (SA, A, D, SD). There is no middle-of-the-road option. If the respondent has no opinion, does not know what just culture is, or does not like the statement, they are directed to leave it blank.

Some statements are repeated every year or every other year for continuity and comparative purposes. Beginning with the second survey, roughly half the statements are brought forward from the first survey and compared for change. The other half of the statements are a detailed examination of a particular subject. Examples include the same topics surveyed above. Only this time, one of those topics is examined in detail. What does the focused series of statements look like? Occurrence reporting can be used as an example of one detailed series.

I know how to file an event report. SA A D SD

I have filed a report in the last 60 days.

I am not afraid to file a report.

I know why safety reports are important.

My flights are typically error-free.

I usually report the errors I make.

I am satisfied with the feedback I get from the Safety Department.

Once completed by the employees, this paints a detailed picture of how employees view occurrence reporting. Armed with this information, changes can be made and processes modified to improve reporting.

The survey should have a few other data collection points. One of these is so-called discriminators. These tell you something about the demographics of the responding employees. You could ask to which workforce the reporter belongs: pilots, mechanics, dispatch, cabin staff, below wing, etc. You can also ask about time with the company. These are all pieces to the puzzle.

One last consideration is to have both open-ended and focused questions that require a detailed answer. Examples would include “Please describe a situation where you engaged in procedural intentional non-compliance (PiNC).” Or “How would you describe the company safety culture?”

The results of the survey should be analyzed and publicized. Transparency is a key element to gaining interest in the survey and encouraging continued participation. Mitigation is another essential aspect. Failure to work the issues or correct problems will foster a “Why bother?” attitude toward survey participation.

There are a number of different survey platforms out there. They simplify survey work and are very easy to use. The different platforms state that a 20% response rate is good and 30% is fantastic. Using a web-based, easy link to the survey, response rates in the 50% range or more are readily achieved. Those kinds of numbers give the Safety Department a high level of confidence that the results are representative of the workforce.

Just Culture

The next step in the SMS start sequence is going public with just culture (JC). JC accepts that humans make mistakes. But it’s neither a get-out-of-jail-free card nor a blame-free ticket to ride. There are certain actions, such as unjustified PiNC, drugs or alcohol on the job, etc., that are forbidden. The company is expected to identify and publicize those actions that are unacceptable and the employees are expected to respect those rules.

Training to middle management and the C-suite is mandatory. All it takes is one supervisor to punish an employee outside the boundaries of the JC decision tree and the SMS program in general, and that reporting system, in particular, is done. And the company must be alert for “shadow” punishment. This is where JC is observed but the employee is slighted in other ways. This is just as bad as misapplying the decision tree. Again, training is the key to a successful working relationship with management. They need to be completely familiar with the decision tree--laminated copies are given to management for quick reference. If you find that a manager is fundamentally opposed to the JC precepts, the company must, for the good of the safety program, encourage that person to find other employment.

One way to familiarize management with JC principles is to run a simulation against previous errors, omissions, commissions or transgressions. This helps frame the way management looks at employee actions and the company’s response. Remember, outcome is not a consideration when reviewing an adverse event--intent is the key. So, even if the damage runs in the thousands of dollars, if there was no unjustifiable PiNC, there is no punishment. PiNC is the only case where punishment follows.

Just culture is a “program.” As such it comes with formal recognition by the company. This means there is a policy statement signed by the CEO or accountable executive, along with spelled-out roles and responsibilities, SOPs, training, testing, audits and more.

The JC program also talks about what it does not cover. Again, it is not a get-out-of-jail-free card. Employees are held accountable for their actions (or inaction).  It does not cover administrative aspects such as late for work issues or other behavioral problems. JC is reserved for operational matters. Lastly, should there be recurring issues with an individual’s performance, despite counseling, training, new job placement and remedial action, JC has allowances for employee dismissal or termination. Typical human resources processes apply in this situation.

The next part of this article series will cover reporting, communication, training--and programs for small operators.