RELATIONSHIP BETWEEN AN SSP AND AN SMS .1

Chapter 6. ICAO Safety Management SARPs 6-13 6.6.15 The safety performance of an SMS should be defined, to the extent possible, through quantitative safety performance indicators and safety performance targets. It is recognized, however, that in many States the safety data collection and analysis capabilities of services providers may not be fully developed. Therefore, while such capabilities are developed, the safety performance of an SMS can be defined through a combination of quantitative and qualitative safety performance indicators and safety performance targets. The objective should nevertheless remain the definition of safety performance of an SMS through quantitative measures only. 6.6.16 The definition of the safety performance of an SMS is a requirement that goes above and beyond regulatory compliance with national and international requirements. Establishing safety performance for an SMS does not replace legal, regulatory or other established requirements, nor does it relieve service providers from their obligations under relevant national regulations, and those arising from the Convention on International Civil Aviation ICAO Doc 7300 and its related provisions contained in the Annexes to the Convention. 6.7 MANAGEMENT ACCOUNTABILITY 6.7.1 The third and last group in the ICAO safety management SARPs in Annexes 1, 6, 8, 11, 13 and 14 is management accountability vis-à-vis the management of safety during the provision of services. The ICAO SARPs dictate that an accepted safety management system shall clearly define the lines of safety accountability throughout the approved training organizations that are exposed to safety risks during delivery of services, aircraft operators, approved maintenance organizations, organizations responsible for type design andor manufacture of aircraft, air traffic service providers and certified aerodromes, including direct accountability for safety on the part of senior management. 6.7.2 The contribution of management to the management of safety is discussed in Chapters 3 and 8, and no further discussion is considered necessary. Mention must be made, however, of a language issue: the use of the term accountability in the ICAO safety management requirements. In the English language, the notion of accountability is different from the notion of responsibility. Responsibility refers to the situation where a person must execute specific actions, while accountability extends this to the obligation or willingness to assume responsibility for the execution of such actions. To express it in safety management terms, safety responsibilities describe the safety purpose of the duties an individual is required to deliver. Safety accountabilities are statements of what the individual is required to deliver, either directly, or through supervision and management of others, including those to whom the individual has delegated responsibility. There is clearly a significant difference between both terms. However, this is a difference that exists only in the English language. Therefore, the term responsibility, with regard to management, in the ICAO safety management requirements, as included in other than the English language version of Annexes 1, 6, 8, 11, 13 and 14, must be understood in the sense of the English term accountability. 6.7.3 Successful safety management requires the active participation of all levels of management and supervision. This should be reflected in the structure of the organization and in published safety accountabilities. The organization should define, document and communicate — with the aid of organizational diagrams or charts — responsibilities, accountabilities and authorities. Senior management accountability and functional responsibilities are further discussed in Chapter 8. 6.8 RELATIONSHIP BETWEEN AN SSP AND AN SMS 6.8.1 A clear understanding of the relationship between an SSP and an SMS is essential for concerted safety management action within States. This relationship can be expressed in the simplest terms as follows: States are responsible for developing and establishing an SSP; service providers are responsible for developing and establishing an SMS. This is a very important point: States are not expected to develop an SMS; rather the SSP fulfils the equivalent role. Nevertheless, States are responsible, as part of the activities of their SSP, to accept and oversee the development, 6-14 Safety Management Manual SMM implementation and operational performance of the service provider’s SMS. In overseeing the safety performance of a service provider’s SMS, the notion of ALoS of an SSP, discussed in 6.4, plays a fundamental role in the relationship between an SSP and an SMS. The relationship between an SSP and an SMS is illustrated in Figure 6-7, and is further discussed in Chapter 11. 6.8.2 Chapter 3 discusses a potential management dilemma that may arise from the perspective that considers the management of safety as an organizational process, and safety management as a core business function. Such potential dilemma, presented as the “dilemma of the two Ps” provides an appropriate background to explain the relationship between an SSP and an SMS. 6.8.3 In Figure 6-7, the SSP is situated on the protection side of the balance mediating between protection and production. The SSP aims at ensuring public safety by controlling safety risks at the State level. An SSP has no production objectives as such. Although efficiency is expected from the State’s aviation organizations, they have no specific deliverables in terms of products or services aimed at making a profit. The basic objective of a State, through its SSP, is to ensure, to the extent possible, public safety during service delivery by service providers. This objective is achieved by defining the ALoS for the SSP, and through the control of safety risks within the State by the two “operational components” of the SSP: safety risk management and safety assurance. Figure 6-7. Relationship between an SSP and an SMS Protection Production S ta te S e rv ic e pr ov ide r Objective: Support production goals and customer satisfaction Objective: Establish acceptable level of safety ALoS for civil aviation — Performance-based oversight — — Safety assurance — Safety promotion — Acceptance — Compliance oversight — Objective: Safety policy and objectives Safety risk management Organization’s safety management system SMS State safety programme SSP Organization’s safety management system SMS Chapter 6. ICAO Safety Management SARPs 6-15 6.8.4 The service provider’s SMS is only partly situated on the protection side of the balance. Unlike the State, a service provider has specific deliverables in terms of products or services aimed at making a profit. The objective of a service provider’s SMS is, in terms of protection, the control of safety risks that are a consequence of activities and processes related to the delivery of the products or services that the organization specializes in. The service provider achieves the control of safety risks during service delivery mainly through the two “operational components” of the SMS: safety risk management and safety assurance, with safety policy and objectives and safety promotion playing a supporting, yet important, role. 6.8.5 The State, as part of its SSP, initially accepts a service provider’s SMS. This acceptance is mostly prescriptive: the State, most likely through its civil aviation oversight authority, will verify that the components and elements proposed by the service provider’s SMS comply with the existing regulations and directives promulgated by the State. It is important to note that acceptance is mostly an administrative process: the State approves a blueprint of a management system and a plan of action for its development and implementation. In simple language, acceptance means mostly “ticking the appropriate boxes”. But acceptance, while ensuring regulatory compliance, does not guarantee proper SMS performance. Acceptance and compliance oversight are indicated by the vertical arrow linking the SSP and the SMS in Figure 6-7. The way for the State to ensure proper SMS performance i.e. that the SMS really works is to oversee it during actual performance of the activities aimed at delivery of services. 6.8.6 In order to verify SMS performance, the civil aviation oversight authority of the State has to conduct oversight of its performance on a periodic basis, during the course of activities aimed at delivery of services. This would prove to be difficult if not impossible in practice, hence the reason for the safety performance indicators and safety performance targets of an SMS. While acceptance and compliance oversight as discussed in 6.8.5 are prescriptive- based, oversight of safety performance indicators and targets is performance-based. The notion of safety performance discussed in section 6.6 thus extends, to a service provider’s SMS, the notion of ALoS of an SSP discussed in section 6.4. Safety performance is to an SMS what ALoS is to an SSP. 6.8.7 Safety performance measurement of an SMS includes the definition of safety performance indicators, safety performance targets and action plans. These key, agreed indicators and targets are representative of the generic hazards in the operational context in which the service provider conducts activities related to delivery of services, and provide a performance-based oversight process with a fair picture of the performance of the SMS. By defining a prioritized set of short-term and medium-term safety objectives specific to the particular service provider’s operation, by implementing mitigation strategies against the safety risks of the consequences of the hazards underlying the specific safety objectives, and by establishing metrics and timelines that allow measurement of the effectiveness of the mitigation strategies, the service provider is providing the oversight authority with measurable means to verify SMS safety performance, or lack thereof, beyond regulatory compliance. 6.8.8 Shifting the discussion to the production side of the balance, mediating between protection and production in Figure 6-7, an SSP, as already discussed, has no production objectives as such, but a service provider certainly does. The objective of the production activities of a service provider is to achieve commercial goals and deliver customer satisfaction. The SMS is the means the service provider utilizes to ensure that the safety risks of the consequences of the hazards it must face while pursuing production objectives remain under organizational control. The service provider’s SMS identifies safety risks and the mitigations necessary to keep them under organizational control through safety risk management initially. Once operations start, control of safety risks and monitoring of mitigations are accomplished through the continuous process of safety assurance, supported by safety promotion. Safety risk management, safety assurance and safety promotion thus provide the means for an organization to maintain the balance between production and protection. 6.8.9 While the traditional role of a State, as it pertains to the acceptance of the SMS and its administrative oversight in terms of regulatory compliance, is represented in the protection side, in an SSP there is a role for the oversight function in the production side as well. Deficiencies in hazard identification and safety risk management, as well as in the development of mitigation strategies, are often related to allocation of resources. This is usually the case when allocation of resources is biased towards production activities. Deficiencies in hazard identification and safety risk management, as well as in the development of mitigation strategies will also be made evident by the inability to meet the 6-16 Safety Management Manual SMM agreed safety performance of the services provider’s SMS, because of an imbalanced allocation of resources to production and protection. Therefore, in exercising performance-based oversight as described in 6.8.7, in overseeing SMS operational performance against agreed SMS safety performance specific to the service provider, biases in the allocation of resources, as well as the safety performance of the SMS as a whole, will become obvious: lack of resources will lead either to non-identification of safety hazards or to flawed safety risk management and, consequently, to poor safety performance of the SMS. In such a case, although perhaps regulatory-compliant, the service provider’s SMS will not be effective. In Figure 6-7, performance-based acceptance and oversight are represented by the diagonal arrow linking the SSP and the organization’s production processes. 6.9 COMPLIANCE AND PERFORMANCE 6.9.1