Advisory Circular

Aerodrome Emergency Planning00000000000000000

AC 139-16(1) JANUARY 2013

SAFETY MANAGEMENT SYSTEMS FOR

AERODROMES

CONTENTS Page 1. REFERENCES

1. References 1  Civil Aviation Act 1988
2. Purpose 2  Part 139 of the Civil Aviation Safety
Regulations 1998 (CASR 1998)
3. Status of this advisory circular 2
 Part 139 Manual of Standards (MOS) -
4. Acronyms 2 Aerodromes
5. Definitions 3  AS/NZS ISO 31000:2009 – Risk
Management Principles and Guidelines
6. Applicability 6
 ICAO Annex 14 - Aerodromes
7. Background 6 Volume I
8. Introduction 6  ICAO Doc 9859 – Safety Management
9. The safety management system (SMS) 7 Manual, 2nd Edition dated 2009.
10. Existing systems 8  ICAO Doc 9774 – Manual on
Certification of Aerodromes, First
11. General requirements 9 Edition 2001
12. Safety policy and objectives and planning 9  CAAP SMS-1(0) – Safety
13. Safety risk management 18 Management Systems for Regular
Public Transport Operations
14. Safety assurance 22
15. Safety Promotion 26
16. Summary 28
Appendix A – Safety management system
review checklist 29

Advisory Circulars (ACs) are intended to provide advice and guidance to illustrate a means, but not necessarily
the only means, of complying with the Regulations, or to explain certain regulatory requirements by providing
informative, interpretative and explanatory material.
Where an AC is referred to in a ‘Note’ below the regulation, the AC remains as guidance material.
ACs should always be read in conjunction with the referenced regulations.
This AC has been approved for release by the Executive Manager, Standards Division.

January 2013
AC 139-16(1): Safety management systems for aerodromes 2

2. PURPOSE
2.1 This amended version will provide updated and contemporary information for certificate
holders of certified aerodromes.

3. STATUS OF THIS ADVISORY CIRCULAR

3.1 This is the first amendment/revision of this AC and replaces AC 139-16(0) dated March
2005. The main objective of the revised AC is to incorporate a four component and 15 element
Safety Management System Framework intended to guide development and implementation of a
Safety Management System (SMS) at certified aerodromes. The 15 element framework is based
on the ICAO Safety Management System Framework (ICAO Doc 9859) with an additional 3
elements included by CASA.

4. ACRONYMS
AC Advisory Circular
AEP Aerodrome Emergency Planning
AM Aerodrome Manual
AOC Airline Operator Committee
AS/NZS Australian/New Zealand Standard
CASA Civil Aviation Safety Authority
CASR Civil Aviation Safety Regulations 1998
CEO Chief Executive Officer
ICAO International Civil Aviation Organization
IRS Internal Reporting System
MOS Manual of Standards
MOWP Method of Working Plan
NOTAM Notice to Airman
OHS Occupational Health and Safety
QMS Quality Management System
SM Safety Manager
SMM Safety Management System Manual
SMS Safety Management System
TLW Time Limited Works
TNA Training Needs Analysis

January 2013
AC 139-16(1): Safety management systems for aerodromes 3

5. DEFINITIONS

Accident: An occurrence associated with the operation of an aircraft which takes place between
the time any person boards the aircraft with intention of flight until such time as all such persons
have disembarked in which:

a) a person is fatally or seriously injured as a result of:

 being in the aircraft; or
 direct contact with any part of the aircraft, including parts which have become detached
from the aircraft; or
 direct exposure to jet blast,

except when the injuries are from natural causes, self-inflicted, or caused by other persons, or
when injuries are to stowaways hiding outside the areas normally available to the passengers and
crew, or

b) the aircraft sustains damage or structural failure which;

 adversely affects the structural strength, performance or flight characteristics of the
aircraft; and
 would normally require major repair or replacement of the affected component,

except for engine failure or damage, when the damage is limited to the engine, its cowlings or
accessories; or for damage limited to propellers, wing tips, antennas, tyres, brakes, fairings, small
dents or puncture holes in the aircraft skin; or

c) the aircraft is missing or is completely inaccessible.

Notes:
1. For statistical uniformity only, an injury resulting in death within thirty days of
the date of the accident is classified as a fatal injury by ICAO.
2. An aircraft is considered to be missing when the official search has been
terminated and wreckage has not been located.

Accountable Manager: A single term referencing the most senior person who holds the
operational authority of the certificate. For the purposes of this AC, each organisation should
substitute their own title for the person who holds such authority.

As Low As Reasonably Practical (ALARP): means a risk is low enough that attempting to make
it lower, or the cost of assessing the improvement gained in an attempted risk reduction, would
actually be more costly than any cost likely to come from the risk itself.

Assessment: In the context of competency based training is the process of observing, recording,
and interpreting individual knowledge and performance against a specified standard.

January 2013
AC 139-16(1): Safety management systems for aerodromes 4

Change Management: A systematic approach to controlling changes to any aspect of processes,

procedures, products or services, both from the perspective of an organisation and individuals. Its
objective is to ensure that safety risks resulting from change are assessed and appropriate risk
mitigation factors implemented to ensure that safety risks resulting from change are reduced to as
low as reasonably practicable.

Competency: A combination of skills, knowledge and behaviour required to perform a task to the
prescribed standard.

Competency standards: Defined and expressed outcomes associated with the performance of a
task.

Competency-based training: Training designed to develop the skills, knowledge and behaviour
required to meet competency standards

Consequence: Outcome or impact of an event.

Notes:
1. There can be more than one consequence from one event.
2. Consequences can range from positive to negative.
3. Consequences can be expressed qualitatively or quantitatively.
4. Consequences are considered in relation to the achievement of objectives.

Hazard: A source of potential harm.

Human Factors (HF): The minimisation of human error and its consequences by optimising the
relationships within systems between people, activities and equipment.

Incident: An occurrence, other than an accident, associated with the operation or maintenance of
an aircraft, which affects or could affect the safety of operation.

Likelihood: Used as a general description of probability or frequency.

Note: Can be expressed qualitatively or quantitatively.

Management: Management comprises planning, organising, resourcing, leading or directing, and

controlling an organisation (a group of one or more people or entities) or effort for the purpose of
accomplishing a goal.

Operational safety-critical personnel: Persons performing or responsible for safety-related work,

including those employees performing roles that have direct contact with the physical operation
and maintenance of the aerodrome or with those who have operational contact with personnel
who operate the aerodrome.

Operator: An aerodrome operator certified under the Civil Aviation Act and Part 139 of CASR
1998.

Reporting Culture: An organisational philosophy and practice that considers the context, in
which, errors occur. It is characterised by the clear definition of acceptable and unacceptable
behaviours, the free-flow of information, the correction of systemic issues and the reserved but
appropriate application of sanctions on individuals where unacceptable behaviour persists

January 2013
AC 139-16(1): Safety management systems for aerodromes 5

Risk: The chance of something happening that will have an impact on objectives.
Notes:
1. A risk is often specified in terms of an event or circumstance and the consequence
that may flow from it.
2. Risk is measured in terms of a combination of the consequences of an event and its
likelihood.
3. Risk may have a positive or negative impact.

Risk Assessment: The overall process of risk identification, risk analysis and risk evaluation.

Risk Identification: The process of determining what, where, when, why and how something
could happen.

Risk Management: The identification, assessment, and prioritisation of risks through coordinated
and economical application of resources to minimise, monitor, and control the probability and/or,
impact of undesired events or to maximise the realisation of opportunities.

Safety Case: A documented body of evidence that provides a demonstrated and valid argument
that a system is adequately safe for a given application and environment over its lifetime.

Safety Culture: An enduring set of beliefs, norms, attitudes, and practices within an organisation
concerned with safety. A positive safety culture is characterised by a shared concern for,
commitment to, and accountability for safety.

Safety Management: May be described as managing the identification and reduction of hazards
and the mitigation of risks associated with those hazards until they reach the ALARP criteria.

Safety Manager (SM): A person responsible for managing all aspects of the operation of the
operator’s SMS.

Safety Management System (SMS): The organisational structure, procedures, processes and
resources needed to implement safety management throughout all activities and processes
conducted by the organisation.

Stakeholders: Those people and organisations who may affect, be affected by, or perceive
themselves to be affected by a decision, activity or risk.

Training: The process of bringing a person to an agreed standard of proficiency by practice and
instruction.

Training Needs Analysis (TNA): The identification of training needs at employee, departmental,
or organisational level, in order for the organisation to perform effectively.

January 2013
AC 139-16(1): Safety management systems for aerodromes 6

6. APPLICABILITY
6.1 This AC applies to operators of certified aerodromes. Operators of registered
aerodromes are also encouraged to introduce a SMS at their aerodrome. Further guidance on the
implementation of a SMS is provided in CAAP SMS-1(0).
6.2 Sub regulation 139.250 (2) of CASR 1998 requires the operator of a certified aerodrome
to have an aerodrome SMS that complies with the Part 139 Manual of Standards (MOS) –
Aerodromes.
6.3 This AC addresses aviation safety related processes and activities of the operator, rather
than occupational health and safety, environmental protection, or security systems. The operator
is responsible for the safety of services and/or products contracted to or purchased from other
organisations.

7. BACKGROUND
7.1 This AC describes the safety outcomes and the key elements of an SMS. The AC content
has been formatted to align within the framework of the ICAO SMS recommendations as
described in Annex 14 Volume I Appendix 7, “Framework for Safety Management Systems”.
7.2 For the purpose of this AC, the SMS manual will be known as the Safety Management
Manual (SMM). ICAO Document (Doc 9859) has been prepared to provide guidelines associated
with the SMM.
7.3 Depending on the complexity of the aerodrome, the operator may have developed a
“stand alone” Safety Management System Manual containing the SMS material that would
otherwise be contained within the Aerodrome Manual. The inclusion of the SMS within the AM
would be consistent with the format as described in ICAO Doc 9774 – Manual on Certification of
Aerodromes.

8. INTRODUCTION
8.1 History has shown that the effectiveness of the SMS is directly proportional to the
degree of investment and participation of senior management, the effort put into hazard
identification, the quality of outcomes of internal and external reporting and, and the
appropriateness of risk management controls.
8.2 Section 10.1 of the Part 139 MOS – Aerodromes briefly defines that a safety culture and
ongoing senior management commitment are two underpinning elements of an effective SMS.
These elements support, the processes of ongoing hazard identification, reporting, training,
auditing, risk management, change management, document control and safety assurance.
8.3 The objective of risk management is to eliminate risk where practical or reduce the risk
(likelihood/consequence) to acceptable levels (ALARP), and to manage the remaining risk to
avoid or mitigate any possible undesirable outcome of the particular activity. Risk reduction is
therefore an integral component to the development and application of an effective SMS.
8.4 An SMS should be considered as an integral part of aerodrome management. Since the
introduction of Part 139 of CASR 1998 in 2003, SMS has been considered a major component of
aerodrome certification and should be managed by the aerodrome operator to ensure continuous
benefit to both safety and business aspects of aerodrome operations.

January 2013
AC 139-16(1): Safety management systems for aerodromes 7

8.5 Most, if not all, aerodrome operators that will use this AC will already have an SMS in
place. This AC has introduced additional SMS elements to be considered and therefore
organisations should take the opportunity to review their existing SMS in line with continual
improvement and with the view of improving the outcomes of an effective SMS. Depending on
the complexity of the aerodrome and the management of third parties, organisations may need to
consider a “gap analysis” assessment procedure to review the system as a result of changes.
8.6 Gap analysis procedures will permit a formal review to determine which components
and elements of the SMS are currently in place, and which components or elements should be
added or modified to meet SMS improvements as well as regulatory requirements.

9. THE SAFETY MANAGEMENT SYSTEM (SMS)

9.1 Within the context of this AC, ‘Operator’ means an aerodrome operator certified under
the Civil Aviation Act and Part 139 of CASR 1998.
9.2 An SMS should consist of well documented, easy to comprehend procedures that are
continuously managed to support the aerodrome operator’s obligations with respect to the AM
and CASR 139 certification.
9.3 The SMS should be developed and maintained by the aerodrome operator and/or Safety
Manager and be designed to manage the safety requirements based on the complexity of the
aerodrome.
9.4 An SMS supports the aerodrome operator in:
 tracking of minor events to determine trends and to trigger action plans; and well
accumulated evidence can be used to support safety cases and direct resources.
 identifying areas of non-compliance with regulations and appropriate manner to rectify
the non-compliance.
 detecting hazards through accumulation of evidence. An example is where recording
events of aircraft parking congestion can identify a hazard and support the aerodrome
operator to increase the size of the apron area.
 prioritising risk to allow development of an action plan in the event of adverse audit
findings
 continual assessment and updating of appropriate parts of the aerodrome emergency
response plan.
 identifying responsible personnel to be accountable for managing identified hazards.
 assessing the ongoing risks associated with works area safety management and
determining appropriate responses for contingencies.
9.5 CASA policy is for an SMS to consist of a four component, fifteen element framework
based on the addition of three elements to the twelve found in the ICAO Annex 14 Volume I
Appendix 7, framework. The four components and fifteen elements considered as part of a
modern SMS framework are:
 Safety policy and objectives and planning:
º Management commitment and responsibility;
º Safety accountabilities;
º Appointment of key safety personnel;
º SMS implementation plan;
º Third party interface;

January 2013
AC 139-16(1): Safety management systems for aerodromes 8

º Coordination of emergency response planning;

º Documentation;
 Safety risk management:
º Hazard identification process;
º Safety risk assessment and mitigation process;
 Safety assurance:
º Safety performance monitoring and measurement;
º Internal safety investigation;
º The management of change; and
º Continuous improvement of the SMS;
 Safety promotion:
º Training and education; and
º Safety communication.
Note: CASA anticipates that ICAO Annex 14 Volume I Appendix 7 will shortly be replaced with
Annex 19 following the transfer of the provisions on safety management responsibilities
and processes from existing Annexes for consolidation in new Annex 19 — Safety
Management.

9.6 This AC outlines that each SMS should be consistent in identifying each of the four
components and fifteen elements however, the degree to which each elements is addressed will
be dependent on the level of complexity of the aerodrome. The SMS provides a framework
within which the AM and other Manuals can be incorporated thereby embedding safety as an
integral part of all aerodrome procedures and management processes. As an example, all hazard
identification and management procedures required in the AM could be incorporated within the
hazard identification and safety risk assessment and mitigation elements of the SMS. Organising
the AM and SMS in this way ensures consideration of these safety related activities in an
integrated manner and ensures parallel and redundant processes are avoided.

10. EXISTING SYSTEMS

Integrating existing systems into an SMS

10.1 An SMS is associated with sound and safe management practice and therefore may
benefit from the use of established systems. Business systems involving document control,
personnel management, reporting systems, assurance, change management, senior management
accountability and continuous improvement can be used to enhance the operation of an SMS.
10.2 Within an organisation, there may be various business systems or processes already in
existence with common processes to an SMS that include:
 Document control processes;
 Change management processes;
 Enterprise or Project Risk Management Systems;
 Contractor management processes;
 Quality Management System (QMS);
 Environmental Management System;

January 2013
AC 139-16(1): Safety management systems for aerodromes 9

 Occupational Health and Safety Management System; and

 Security Management System.
Depending on the maturity, size and expertise of the operator, there may be the potential for the
aerodrome SMS to utilise existing procedures and structures.
10.3 Because SMS and QMS share many common resources, there may be a tendency to
assume that an operator that has established and operates a QMS does not need, or already has, an
SMS. This assumption is incorrect. There are many similarities between SMS and QMS, but
there are also some important differences. Quality management focuses on assuring
product/service quality, and the means to achieve it, whereas safety management focuses on the
identification of hazards and the mitigation of risks associated with those hazards until they reach
predetermined risk levels – known as ALARP (As Low as Reasonably Practicable). To achieve
this, SMS utilises and integrates quality management techniques, risk management and human
factor principles into the processes and procedures of the operator to ensure safety objectives are
realised.
10.4 The SMS and the QMS are separate systems with different functions. They do however
share many features, elements and capabilities. For example, the reporting systems,
communications, training are similar and could be shared. Depending on the size of the operator,
some roles might also be shared between systems; including the Quality and Safety Manager
roles. Integration has its benefits, such as consistency and resource maximisation. Effective
integration can even expose relationships between hazards which are not obvious when the
systems are operated in isolation.
However, integration if not managed carefully can create problems and even induce risks into the
operation. The operator should therefore assure itself that there are no obvious misalignments or
gaps between the integrated SMS and the QMS capabilities.
10.5 The SMS should be considered the overarching system, which can contain sub-systems.
The SMS therefore must provide an organisational overview and confirmation that the aerodrome
operational safety issues are the most important operational issues.

11. GENERAL REQUIREMENTS

11.1 The SMS Manual should describe a set of procedures that must be followed and ensure
that each element is addressed according to the aerodrome operator’s specific system. As listed in
paragraph 9.5 of this AC, the following example of SMS documentation has been prepared in
accordance with the ICAO Framework for Safety Management System elements.

12. SAFETY POLICY AND OBJECTIVES AND PLANNING

Management commitment and responsibility

12.1 The accountable manager’s commitment to, and responsibility for, safety should be
formally expressed in a statement of the aerodrome operator’s safety policy. This should reflect
the operator’s philosophy of safety management and become the foundation on which the
operator’s SMS is built.

January 2013
AC 139-16(1): Safety management systems for aerodromes 10

12.2 The aerodrome operator’s safety policy should be clear, concise and confirm top level
management support, be signed by the accountable manager, and include a commitment to:
 implementing a SMS based on the safety policy;
 assurance of senior management accountability;
 provide management guidance for setting, reviewing and achieving safety objectives and
safety targets through the management of safety risks;
 provision of the resources necessary for effective safety management and ensuring staff
are sufficiently trained and aware of their safety responsibilities and accountability for
safety at all levels of the organisation;
 management’s explicit support of a ‘reporting culture’, as part of the overall safety
culture of the organisation, i.e. encouragement of a culture that is against acts of reprisal
against, employees that report safety issues;
 to complying with all applicable legal/legislative requirements, standards and best
practice;
 communication with all employees and parties;
 establishing and maintaining standards for acceptable safety behaviour;
 active encouragement of safety reporting;
 integrating safety management with other critical management systems within the
organisation;
 promotion and demonstration of their commitment to the Safety Policy through active
and visible participation in the SMS; and
 periodic review of the safety policy to ensure it remains relevant and appropriate to the
organisation.
12.3 The accountable manager is best characterised by their authorities and responsibilities
which include:
 Full authority for human resources issues;
 Authority for major financial issues;
 Direct responsibility for the conduct of the organisation’s affairs;
 Final authority over airside operations under the aerodrome certificate; and
 Final responsibility for all safety issues.
12.4 Safety objectives and standards for safety performance are set by the accountable
manager for the entire organisation. They consist of statements of intended safety outcomes. At
more complex aerodromes, individual safety objectives are accompanied by documented plans of
action.
12.5 To assist in their development, safety objectives should be Specific, Measurable,
Achievable, Realistic and Timely (S.M.A.R,T). Examples of such safety objectives may include
but are not limited to:
 A 10% reduction in airside driving incidents over the next 12 months;
 A reduction in apron fuel spill incidents to a maximum of two per quarter;
 All incident assessment and corrective action outcomes to be implemented within
recommended timeframes;
 A 10% reduction (month-to-month) in bird and animal strikes over the next six months
(subject to similar environmental conditions being experienced);

January 2013
AC 139-16(1): Safety management systems for aerodromes 11

 A reduction in personal injuries;

 Completion of SMS induction training by all new employees, stakeholders and
contractors within two months of starting work/operations; and
 Nil significant aviation incidents impact, attributable to the aerodrome operator, or any
runway incursions over the next five (5) years.
12.6 Those responsible for the provision of a safe and compliant facility must hold the
authority to enable their safety responsibilities to be demonstrated. An SMS cannot function if
someone is assigned safety responsibilities but does not have the authority to expend resources to
meet those responsibilities.
12.7 It is important that the management structure and accountabilities are clear and where
required, who will represent accountable management at either the Safety Committee meetings or
other stakeholder meeting opportunities that have been accepted by the aerodrome operator as
relevant to supporting the SMS. Safety Action Groups are an accepted alternative title to
stakeholder groups.
12.8 The aerodrome operator must ensure that management understands the responsibilities
and that the resources are provided to satisfy compliance. Adequate resources consideration
should include an assessment of staff to fulfil all responsibilities effectively.
12.9 An effective safety policy should clearly detail the operator’s attitude toward acceptable
and unacceptable behaviour. The organisation needs a “Reporting Culture” philosophy. A
reporting culture promotes confidence within an organisation enabling the reporting of genuine
errors without fear of consequences to the individual. It is not a “no-blame” approach, rather it is
characterised by the clear definition of acceptable and unacceptable behaviours, the free-flow of
information, the correction of systemic issues and the reserved but appropriate application of
sanctions on individuals where deliberate contravention or persistent unsafe actions without
appropriate reason occur.
12.10 The safety policy should clearly define the boundaries of what is considered to be
unacceptable behaviour. It should also broadly outline the reporting systems in place and staff
responsibilities with respect to these systems. It should recognise the objective of this approach as
being the improvement of systemic problems and the prevention of future incidents – not the
laying of blame and retribution.
12.11 The endorsement, promotion and acceptance of the safety policy is as important as its
development. Without widespread awareness of safety policy, personnel cannot be expected to
behave in a manner consistent with the safety policy. The safety policy should not only be
contained within the SMM but also widely publicised and distributed. As such, it should also be
subject to document control procedures.

Safety accountabilities
12.12 The accountable manager requires an organisational structure that has the responsibility,
authority and accountability assigned to it to ensure that the SMS will function as planned. This
includes an organisation chart that depicts the organisation structure inclusive of the SMS that
establishes a clear line of communication from the SM directly to the accountable manager as
nominated by the aerodrome operator.
12.13 The accountable manager should determine an organisational structure to ensure
reporting and assessment responsibilities are assigned according to the level of risk associated
with an event, incident or accident.

January 2013
AC 139-16(1): Safety management systems for aerodromes 12

12.14 The accountable manager should ensure that the management structure is consistent
with risk responsibility of managers.

Appointment of key safety personnel

12.15 Key safety personnel are those personnel who hold positions of responsibility and/or
authority within the organisation that have a direct effect on the safety of the aerodrome.
12.16 The SMM must nominate and record the SM and ensure that the nomination is supported
by the accountable manager or other senior management depending on the organisational
structure. The accountable manager or his delegate is accountable for the application and
effectiveness of the SMS.
12.17 Depending on the size of the organisation, the SM should possess operational
management experience and an adequate technical background to understand the systems that
support aerodrome operations.
12.18 While the accountable manager is accountable for safety, safety is the responsibility of
all members of the operator’s organisation. Specific safety activities and functional or operational
safety performance outcomes are the responsibility of the relevant managers.
12.19 While the accountable manager is ultimately responsible for the overall safety
performance of the organisation, the SM is accountable for the satisfactory administration and
facilitation of the SMS itself and should monitor all cross-functional or departmental SMS
activities to ensure relevant integration and reporting between sections.
12.20 The Safety Manager, irrespective of other duties, should have responsibilities and
authority for, but not limited to:
 ensuring that processes needed for the SMS are established, implemented and
maintained;
 reporting to the accountable manager on the performance of the SMS and the areas
where improvement is required;
 ensuring the promotion of awareness of safety requirements throughout the operator’s
organisation;
 develop and mature the SMS over time, through engagement with the organisations
senior management at all levels, and operational employees;
 drafting the Safety Management Manual;
 implementing, maintaining, reviewing and revision of the SMS;
 regular evaluation, reviews and fine tuning of the safety program;
 providing safety advice to management and staff;
 providing timely advice and assistance on safety matters to managers, employees and
contractors at all levels;
 communicating with Heads of Departments on safety related issues;
 promoting safety awareness and a positive safety culture;
 liaison with CASA, Australian Transport Safety Bureau (ATSB) and other stakeholders
on safety-related issues;
 exchange of valuable lessons learned with other operators and aerodrome users and
stakeholders;
 researching and sharing safety related information with other key safety personnel in the
organisation;

January 2013
AC 139-16(1): Safety management systems for aerodromes 13

 if delegated by the accountable manager, chairing the safety committee(s);

 incident and accident investigation coordination (unless an obvious conflict of interest is
involved and/or when independence cannot be assured);
 managing immunity-based reporting systems (confidential reports);
 monitoring the progress of safety reports and ensuring that hazards are addressed in a
timely manner;
 maintaining an appropriate reporting system to identify hazards, which includes the
overseeing the reduction of risks to ensure that they are ALARP;
 maintaining safety documentation;
 ensuring SMS induction and recurrent training are conducted in accordance with the
SMM Manual;
 identifying ongoing safety training requirements to support the SMS programme
objectives;
 overseeing the internal and external SMS audit programmes; and
 an understanding of the Aerodrome Emergency Plan and the role of the Aerodrome
Emergency Committee.
12.21 Where possible, the Safety Manager should be assisted by safety representatives from
each department or functional area.
12.22 The accountable manager should ensure that those assigned safety responsibilities hold
the authority to meet their safety responsibilities and therefore have the necessary authority to
expend resources to meet those responsibilities.
12.23 The management team must be trained and competent to fulfil their responsibilities
within the SMS.
12.24 Where the complexity of the aerodrome requires a separate Safety Committee, the SM
should determine those representatives from the aerodrome operator and relevant stakeholders
who should participate as members.
12.25 A Safety Committee would normally be necessary for functional or senior management
involvement on policy, overall system implementation and safety performance review purposes.
Membership and level of participation in the Safety Committee would depend on the size and
structure of the organisation:
 Small Organisation — a small organisation will have limited staff and the appointment
of a dedicated SM may not be an option. For small organisations, the functions of a SM
could be included as part of the duties of another position within the organisation or
undertaken by a contractor. The importance of the safety management function cannot
be emphasised enough and the implications of adding additional roles and responsibility
to the SM should be considered carefully.
 Medium Organisation — a medium sized organisation may have a separate SM,
possibly with a small number of staff. There would be an opportunity for one of the
‘Safety Representatives’ to be appointed as required. The Safety Committee may consist
of external stakeholders.
 Large Organisation — a large organisation may have a dedicated Safety Department,
led by a Head of Safety Management. There would be scope within the department to
appoint a dedicated SM, and additional support personnel as required. The Safety
Committee may be internal representation supported by external operational groups.

January 2013
AC 139-16(1): Safety management systems for aerodromes 14

12.26 The objective of the Safety Committee is to provide a forum to discuss safety issues and
manage the overall effectiveness of the SMS. Terms of reference for the Safety Committee are
documented in the SMM. Responsibilities of the safety committee may include:
 Making recommendations or decisions concerning safety incidents and objectives;
 Identification of the hazards of the business and their effects upon those activities critical
to the safety of flight
 Defining safety performance indicators and setting performance targets;
 The use of active monitoring and audit processes to validate that the necessary controls
identified through the risk mitigation process are in place and are being maintained.
 Review safety directions and outcomes;
 Monitor the performance of the SMS to ensure ongoing effectiveness and active
commitment to safety;
 Ensure all nominated procedures are addressed as per the SMM;
 Ensuring an ongoing, systematic approach to the management of how interfaces between
the organisation and its suppliers, subcontractors and business partners impact on
aviation safety.
 Assess the quality and integrity of SMS audit reports and internal reviews; and
 Review CASA and annual Aerodrome Technical Inspection reports.

SMS Implementation Plan

12.27 If an operator does not already have an SMS, the SMS implementation plan should be
endorsed by the accountable manager and be implemented within a suitable timeframe.
12.28 The SMS implementation plan should detail all aspects of the development and
implementation of the SMS. It is expected that the SMS program will mature over time through a
process of continuous improvement.
12.29 The implementation plan should address all the areas covered in the SMM with
particular attention being given to safety strategy, safety objectives, safety management processes
and activities, resource implications, training, safety promotion and time lines.
12.30 The planning (or establishment) group may be able to build upon existing strengths by
reviewing the organisations current capabilities for safety management (including experience,
knowledge, processes, procedures, resources etc.). An operator’s shortcomings in safety
management experience should be recognised and resources to assist in development and
implementation of the SMS identified. Many aerodrome operators may already have internal
procedures in place for the investigation of incidents, hazard identification, safety monitoring etc.
These should be reviewed and perhaps modified for integration in the SMS as required. It is
important that the operator reuse as many existing procedures as practicable, to improve
integration, acceptance and utilise proven procedures and processes. Familiarity of staff with
processes extant prior to the implementation of the SMS reduces the risk inherent with the change
process.
12.31 Building on the operator’s existing capabilities and experience enables the operator to
fast-track the SMS implementation; lessening the disruption to the delivery of products and/or
services, and allowing the operator to reap the safety and efficiency benefits sooner. During this
review process, the operator SMS planning group is advised to also examine best industry
practices for safety management by consulting with other operators of similar size and
complexity.

January 2013
AC 139-16(1): Safety management systems for aerodromes 15

Implementation Timing
12.32 9.13.1 Many operators employ a phased approach (e.g. over 12 months). A suggested
approach is provided below.

Phase 1 — Planning and Reactive Safety Management

12.33 Planning should provide a blueprint describing how the SMS requirements will be met
and integrated into the operator’s work activities, and an accountability framework for the
implementation of the SMS:
 Identify the Accountable Manager and the safety responsibilities of managers;
 Identify the person (or planning group) within the organisation responsible for
implementing the SMS;
 Describe the system;
 Conduct a gap analysis of the operator’s existing resources compared with SMS
establishing requirements;
 Develop an SMS implementation plan that explains how the organisation will implement
the SMS in accordance with this AC and international Standards and Recommended
Practices, the system description and the results of the gap analysis together with the
timelines of implementation;
 Develop and apply a structured change management process;
 Develop documentation relevant to safety policy and objectives;
 Develop and establish means for safety communication; and
 Develop and apply an SMS continuous improvement program.
12.34 As part of phase one, the operator should also implement those elements of the SMS
implementation plan that refer to the safety risk management reactive processes:
 hazard identification and safety risk management using reactive processes;
 training relevant to:
º SMS implementation plan components; and
º safety risk management (reactive processes);
 documentation relevant to:
º SMS implementation plan components; and
º safety risk management (reactive processes).
Phase 2 — Proactive Safety Management and Assurance
12.35 Proactive safety management should put into practice those elements of the SMS
implementation plan that refer to safety risk management based on proactive and predictive
processes:
 hazard identification and safety risk management using proactive processes;
 training relevant to:
º SMS implementation plan components; and
º safety risk management (proactive and predictive processes);

January 2013
AC 139-16(1): Safety management systems for aerodromes 16

 documentation relevant to:

º SMS implementation plan components; and
º safety risk management (proactive and predictive processes).
12.36 To fully satisfy the requirements of phase 2 the operator should also put into practice
operational safety assurance:
 development of effective SPIs and safety performance targets;
 training relevant to operational safety assurance;
 documentation and instigation of processes relevant to safety assurance, including
internal audit; and
 develop and maintain formal means for safety communication.
Note: 12 months is a suggested timeline. Other timelines may be more suitable.

Gap Analysis and Project Plan

12.37 A gap analysis is conduct in three steps:
 clearly identify the required SMS elements, capabilities, resources and organisational
structures;
 analysis the elements, capabilities, resources and structures already existing within the
organisation; and
 identify the gaps between the requirements and what already exists with the organisation
necessary for the SMS to function.
12.38 The gap analysis is vital step in the process because many of the elements, capabilities,
resources and organisational structures necessary to development the SMS will - in most cases -
already exist within the organisation.
12.39 Once the gap analysis is complete and fully documented, any elements, capabilities,
resources or organisational structures which have been identified as missing or deficient will need
to be created or modified – as the case may be. These, together with elements, capabilities,
resources and organisational structures which already existing, form the basis of the SMS
Implementation Plan. Operators may format their SMS implementation plan to suit their
individual needs. Suggested structures and content can be found at Appendix 2 (Guidance on the
development of an SMS GAP analysis for service providers) to Chapter 7 of ICAO Document
9859 provides GAP Analysis guidance.
12.40 A table may be used to account for each component and their respective sub-elements.
The table can provide:
 ‘Yes’ and ‘No’ response, in terms of the compliance of the existing system, to the SMS
requirements;
 remarks for partial compliance or deviations;
 actions required and timelines to achieve the criteria; and
 existing organisation documentation where the requirement is addressed.
12.41 It is important that the implementation plan provide indications of funds and human
resources required to enact the changes. It is not enough that the gaps have been identified and a
plan established to implement the missing components; the organisation should demonstrate
through its implementation plan that it has the resources and desire to build its system in
accordance with the plan.

January 2013
AC 139-16(1): Safety management systems for aerodromes 17

12.42 The gap analysis and the implementation plan must be reviewed and approved by the
operator’s accountable manager. Once approved, management should be assured that:
 a documented procedure is established and maintained for managing the
implementation; and
 development of the SMS is progressing satisfactorily and in accordance with the
implementation plan.

Third Party Interfaces — Contracted Activities

12.43 Whether a large corporate contractor or small business, the contracting authority (e.g. an
operator) holds overall responsibility for the safety of services provided by the contractor. The
contract or service level agreement should specify the safety standards to be met. The contracting
authority then has the responsibility for ensuring that the contractor complies with the safety
standards prescribed in the contract.
12.44 An SMS should ensure that the level of safety of an operation is not eroded by the
inputs, services and supplies provided by external organisations.
12.45 The operator should consider the third parties previous safety record and any audit
findings. In addition, the operator should ensure that the third party understands the operator’s
SMS and their responsibilities relating to it. These factors should be given equal weight with
other considerations like price, quality and timely delivery.
12.46 As a general guideline, a third party contract should include the following as a minimum
standard:
 Any agreement for the provision of services should be supported by a written contract
prior to services commencing;
 All third party providers should hold the appropriate qualifications/credentials or
approvals for the work being outsourced;
 All third parties should understand the aerodrome operator’s SMS, and their own
responsibilities within the SMS program. The operator must have a demonstrated
process to assure themselves that the third party is aware of, and meeting these
requirements;
 All contracted organisations should be able to demonstrate their ability to provide
trained and competent staff.
 All written service level agreements should contain a schedule of oversight to monitor
the third party’s performance on a regular basis;
 All agreements should contain details on how any noted safety hazards and deficiencies
will be addressed and the time frame for these actions (risk management process as
outlined in this AC);
 Where a service being provided is conducted under a licence or certificate approved by
CASA, the written agreement should contain a statement requiring the third party to
advise the contracting organisation of any regulatory action undertaken by CASA that
may impact on the third parties ability to provide the required services;
 A documented procedure is established and maintained for managing third party
interfaces;
 The aerodrome operator may consider the need to cancel the contract in the event of
continued non-compliance;
 The contract or service level agreement specifies the safety standards to be met; and

January 2013
AC 139-16(1): Safety management systems for aerodromes 18

 The operator has the final responsibility and safety oversight capability and is
accountable for ensuring that the contractor complies with safety standards prescribed in
the contract.

Coordination of the Emergency Response Plan

12.47 Coordination of emergency response planning should be referenced and clearly defined
in the aerodrome manual. Guidance is provided in AC 139-7(0) Aerodrome Emergency Planning.

Documentation
12.48 The decision to prepare a separate Safety Management Manual (SMM) should be
determined by the complexity of the aerodrome facility and aerodrome stakeholder participation.
The specific design, integration and implementation of the SMS will be influenced by, and be
dependent on, the requirements of the individual operator while considering existing processes,
policies and safety practices. If an operator chooses to incorporate the SMS components within
an existing AM these components must be sufficiently identifiable to allow assessment of the
effectiveness of the SMS. The dynamics of an SMS will be dependent on the complexity of the
aerodrome as mentioned above.
12.49 Where a separate document has been produced as a SMM, ensure that the officer
responsible for document control, including amendments and distribution is clearly defined.
12.50 Documentation management should include appropriate preparation of agendas and
references to minutes of meetings. The SMS information should include a procedure for
preparation, distribution and document control of these items.
12.51 SMS documentation should provide detail that states and references a document review
period and a distribution list of other document holders.

13. SAFETY RISK MANAGEMENT

13.1 The process of risk management involves establishing an appropriate infrastructure and
culture to apply a simple systematic method to assess risk levels associated with potential hazards
and events. Elements to be considered include context, identification, evaluation, mitigation
controls, monitoring and communicating risks associated with any activity, function or process
that will enable organisations to maintain safety compliance and maximise financial gains.
13.2 The objective of risk management is to eliminate risk where practical or reduce the risk
(likelihood/consequence) to acceptable levels (ALARP), and to manage the remaining risk so as
to avoid or mitigate any possible undesirable outcome of the particular activity. Risk reduction is
therefore an integral component to the development and application of an effective SMS.

Hazard identification
13.3 Risk management is supported by a hazard identification process that is compiled within
a register. The risk register is the documented outcome of reported aerodrome hazards derived
from assessing events and other environments of safety concerns. The resulting risk level is
evaluated from the combination of likelihood and consequence.
13.4 Hazard identification should be a product of internal and external reports, serviceability
inspections and outcomes from meetings. Depending on the complexity of the aerodrome,
opportunities to report safety concerns can be generated from, but not limited to:
 Ramp Safety Committee;
 Ramp Operation Committee;

January 2013
AC 139-16(1): Safety management systems for aerodromes 19

 Aerodrome Emergency Planning (AEP) Committees;

 Operational staff inspections;
 CASA Reports;
 Aerodrome Technical Inspections Reports;
 Airline Operator Committees
 Safety Action Groups
 Air Traffic Control meetings, (if applicable);
 Public Awareness Groups;
 Accident reports;
 Electronic Safety Incident Reports;
 Pilot reports;
 Fixed based operator reports; and
 Project contractor progress meetings.
13.5 The aerodrome operator should develop and promote to all stakeholders, a formal
process to report hazards and safety issues. In conjunction with the reporting and serviceability
sections of the AM, introduce and manage a process for reporting unserviceability and non-
compliance with the Part 139 MOS. The reporting system can be electronic, a paper trail or both.
13.6 Hazard identification should be considered for all aerodrome activities that have the
potential to create an incident. Pre-project assessment such as Job Hazard Analysis is a good
example of assessing risk prior to the commencement of major works.
13.7 Hazard reporting can be a function of a number of communication systems. An Internal
Reporting System (IRS) is an alternative tool for recording reports and distributing the
information to operator representatives who are responsible to ensure outcomes are addressed. An
IRS should encompass the following elements:
 Procedures for reporting hazards or safety concerns;
 Methods for collating, storage and distribution of data;
 Procedures for determining the risk level;
 Documentation of corrective action; and
 Continuous monitoring of the system and Safety Performance Indicators.
13.8 The IRS should be user friendly and accessible to all personnel who are responsible for
safety management at the aerodrome. The aerodrome operator may limit some stakeholders to the
hazard identification and reporting element only.

Safety risk assessment and mitigation

13.9 The risk framework should be a formal process agreed by all members of senior
management. The framework will need to demonstrate a reporting and assessment relationship
between all levels of management and reporting opportunities within the organisation.
13.10 The framework should provide opportunities for continual review of the SMS.
Depending on the complexity of the aerodrome, the framework should establish procedures for
monitoring and review.

January 2013
AC 139-16(1): Safety management systems for aerodromes 20

13.11 The SMS should consider a corporate risk management framework that includes
appropriate statements of likelihood and consequences. A matrix designed by incorporating both
likelihood and consequences may be required to determine risk level and effect on business
continuity.
13.12 The risk level is not a quantified outcome determined by a legislative process. The
aerodrome operator determines the levels of acceptable risk, suitable for their particular
circumstances and aerodrome environment. Australian Standards can be used as guidelines to
prepare risk management frameworks. The process of determining levels of acceptable risk
should take into consideration input from other stakeholders such as aircraft operators that use the
aerodrome.

Hazard Identification
13.13 Hazards can combine in unforeseeable ways, so that even apparently trivial hazards can
result in undesirable outcomes which may have catastrophic results.
13.14 Consequently the starting point for the whole safety risk management process should be
the establishment of the context and hazard identification. A systematic and comprehensive
hazard identification process is critical, because hazards not identified at this stage may be
excluded from further risk analysis and treatment.
13.15 Hazards can be identified from a range of sources including, but not limited to:
 brain-storming using experienced operational personnel;
 development of risk scenarios;
 trend analysis;
 feedback from training;
 safety surveys and oversight safety audits;
 monitoring of normal operations;
 state investigation of the contribution of operational activities to accidents and serious
incidents; and
 information exchange systems (similar operators, regulators etc.).
13.16 Over time, the ‘database’ of reported hazards enables the operator to:
 identify ‘hot spots’ that need particular attention; and
 conduct trend analysis which can provide the basis for improvement of hazard
identification.

Risk criteria and the concept of ‘ALARP’

13.17 There is general acceptance that not all risk can be eliminated from aerodrome
operations. There are practical limits to which the aviation industry is able to go and the extent to
which the industry and the community will pay to reduce risk. The aim of risk management,
therefore, is to reduce risks to a level which is As Low As Reasonably Practicable - ALARP.
13.18 The principle of managing risk to a level that is ALARP is as follows:
 There is an upper level of risk that is deemed to be intolerable. If a risk is found to be
intolerable, risk reduction measures are essential, regardless of cost;
 There is a lower level of risk that is deemed to be broadly acceptable. At this risk level
(and below), maintain current systems and monitor and review the risk. Further risk
reduction may be made, but only if the cost is insignificant; and

January 2013
AC 139-16(1): Safety management systems for aerodromes 21

 The ALARP region lies between the upper and lower levels of risk. If risk falls into this
region, it should be reduced to a level which is reasonably practicable.

13.19 In the ALARP region, risk reduction measures should be identified and evaluated in
terms of cost and possible risk benefit. Any risk falling within the ALARP range should be
assessed and reduced unless the cost of reducing the risk is grossly disproportionate to the benefit
gained. The assessment of the cost verses benefits based is often based on qualitative arguments.
The position will be far more convincing and defensible if the assessment is quantitative - based
on sound data.
13.20 The risk can only be said to be ALARP when it can be demonstrated that all justifiable
risk reduction and control measures have been considered and any additional mitigation strategies
cannot be justified.
13.21 The ALARP principle operates in an environment of continuous improvement. Both the
risks and the controls change and evolve over time. Consequently, both require continual
reassessment to which risk and controls are reasonable to sustain and which are not.
13.22 To promote the level of risk associated with potential hazards or reported incident
occurrence, it is important that a risk register is developed and supported by management. The
risk register should be reviewed either annually in conjunction with the SMM review or as
required when an event has occurred or a new hazard has been identified.
13.23 Risk treatments may be an option to reduce levels of risk. The Safety Committee should
assume the responsibility to analyse the assessment information and appropriately implement risk
treatments and controls.
13.24 The SMS should state a level of management responsibility associated with corrective
action and approval to implement controls. Where the corrective action is generated from normal
AM procedures, there may be no requirement to report the concerns further up the chain of
command as per the organisation chart.
13.25 Within this section of the SMM, an important notation should clearly define what level
of management/manager would be responsible for the level of risk after the assessment process
has been completed. Generally, the risk register will highlight the level of residual risk.
13.26 Management involvement may be determined by an escalating list of increasing
consequence severity and be categorised as determined by:
 Low Managed by routine manual procedures;
 Moderate Management responsibility must be specified;
 High Senior management attention; and
 Extreme Immediate action required.
13.27 If an incident occurs, the risk level may change due to the definition of likelihood and
potential frequency of re-occurrence. For example, likelihood could be expressed as a
diminishing list of possible likelihoods:
 Almost certain – Event is common or frequent occurrence;
 Likely – Event is likely to occur and is known to have occurred at the aerodrome;
 Unlikely – Event may occur but has not occurred at our aerodrome but has occurred
within the industry; and
 Rare – Not occurred in our company, but has occurred infrequently within the industry.

January 2013
AC 139-16(1): Safety management systems for aerodromes 22

13.28 Consequence values and definitions will be different for each aerodrome. The operator
should clearly define their boundaries of risk associated with the financial, personnel,
environment, legal and community impact. The scales of consequence will be determined by the
complexity of the aerodrome and the potential effects on business continuity and personal safety.
13.29 The size of the organisation and the variation in stakeholder participation will determine
the importance of the scale of consequence.
13.30 It is important that all reported outcomes assessed by either the SM or the Safety
Committee as requiring further action, are assigned to a responsible officer. The SMS process
should permit effective tracking of the progress and where delays have occurred, the accountable
manager should take responsibility to ensure appropriate outcomes are implemented within a
timely manner.
13.31 SMS practices require that any changes to a system that will affect aerodrome safety and
be subject to a potential non-compliance to a standard shall be supported by a safety case. The
safety case should involve a risk assessment and mitigation processes and documented in a Safety
Case Report.
13.32 Subsection 2.1.3 of the Part 139 MOS invites applications for exemption to the standards
to be supported in writing by “cogent reasons”. A well-documented safety case will be required
to support all exemption applications. CASA’s AC 172-02(0) “Guidelines for Preparing Safety
Cases Covering CASR Part 172 Services” provides evidence of acceptable CASA practices for
the preparation of a safety case.
13.33 The United Kingdom Civil Aviation Authority (CAA) publication CAP 760 is well
documented and provides further evidence and examples on how to prepare a safety case for
aerodrome operators.
13.34 In summary, a safety case report is a supporting document that demonstrates that a
system is safe. It is a document that can be audited and assessed to ensure that the aerodrome
operator has considered all associated safety issues. In the case of an exemption application, a
safety case report should confirm that all non-compliances have been assessed and that the
aerodrome operator is satisfied that aerodrome safety is not compromised.

14. SAFETY ASSURANCE

Safety performance monitoring and measurement

14.1 Safety outcomes resulting from incident assessments, changes to the movement area,
amendment to reporting procedures, emergency planning and other operational events must be
effectively reported to relevant stakeholders. The SMM must clearly define the process to provide
notification of all changes.
14.2 The SM should develop a process with programmed events or meetings to assess the
performance of the SMS. Through appropriate protocol, determine if the system is effective and
provides adequate reporting and assessment techniques to satisfy the corporate framework risk
management requirements.
14.3 In the event that there may have been no incidents reported within a prescribed period of
review as nominated in the SMM and no external audit report observations, the minutes of the
SMS meeting should include a simple statement that is accepted by the Accountable Manager or
their delegate, that the review has been conducted and there were “nil” amendments.

January 2013
AC 139-16(1): Safety management systems for aerodromes 23

14.4 Safety assurance should be supported by the Safety Committee and the SM reviewing
CASA and Aerodrome Technical Inspection reports. Safety assurance should also be assessed by
reviewing information taken from Safety Action Group minutes and other supporting committee
meetings previously identified in 13.4 of this AC.
14.5 At more complex aerodromes, both Ramp Safety meetings, AOC meetings and AEP
meetings are effective sources to monitor assurance.
14.6 Formal management reviews of the SMS should occur on a regular basis. The frequency
of the review process should reflect the size and complexity of the aerodrome and the
organisation. Normally the review process should ensure that:
 The SMS continues to meet core safety objectives;
 Safety performance is monitored against objectives; and
 Identified hazards are addressed in a timely and appropriate manner.
14.7 Following the formal management review, there should be a periodic review process at
the SM and Safety Committee level to include:
 Monitoring and reporting on safety management activities;
 Measuring and reporting on SMS performance;
 Reporting on change management issues; and
 Reporting on training requirements.
14.8 For smaller certified aerodromes the stakeholder participation may be limited and only
considered as a combined representation of the aerodrome operator and the airline
representatives. Fixed based operators have the opportunity to assist with hazard identification
and reporting.
14.9 Larger aerodrome operators will have a number of options to consider and may include
regular meetings or invitation to access IRS for incident and hazard reporting.
14.10 Ramp Safety Committees and Aerodrome Emergency Committee meetings provide
alternative opportunities for stakeholder participation. Other potential stakeholder groups can
include Airline Operator Committees and Airside Operations Toolbox meetings.
14.11 It is important to consider Safety Action Groups associated with pre–delivery project
assessment groups.
14.12 The aerodrome operator might consider participation by a member of local government
authority groups that may have a safety implication for the aerodrome.

Internal Safety Investigation

14.13 For every accident or serious incident, there will likely be hundreds of minor events or
near-misses, many of which would have had the potential to become an accident but for the lack
of conspiring circumstance at the time or by active mitigation techniques by the system or human.
It is important that all reported events/hazards be reviewed and a decision taken on which ones
should be investigated, and how thoroughly.
14.14 The Organisational Safety Policy/SMS Protocols should state that the purpose of internal
investigations is to find systemic causes and implement corrective actions, NOT to apportion
blame to individuals. Where a ‘Reporting Culture’ policy is in place, the policy and protocols for
internal investigations should clearly reference such policy.

January 2013
AC 139-16(1): Safety management systems for aerodromes 24

Investigation Management
14.15 Where the ATSB conducts an investigation into an organisation event, the Safety
Manager, or their delegate, should be the operator’s point of contact/coordinator for the
investigation. This way the Safety Manager will be kept informed as the investigation progresses.
14.16 Resources are normally limited, so effort expended should be allocated to investigations
with the greatest perceived benefit in terms of potential for identifying systemic hazards and risks
to the safety of flight.
14.17 The accountability for the management of internal safety investigations should be
documented in the organisations SMS specifically to determine:
 the scope of the investigation;
 the composition of the investigation team including specialist assistance if required;
 that the investigation outcomes are recorded for follow-up trend analysis; and
 that there is a timeframe for completion.
14.18 The accountable person in charge of the investigation should have the authority to:
 interview any manager or staff member; and
 access any company information source.

Scope of Safety Investigations

14.19 The extent of the investigation will depend on the actual and potential consequences of
the event or hazard. This can be determined through an initial risk assessment. Reports that
demonstrate a high risk potential should be investigated in greater depth than those with low risk
potential.
14.20 The investigative process should be comprehensive and should attempt to address the
factors that contributed to the event, rather than simply focusing on the event itself or the active
failures that took place immediately prior to the event. Active failures take place immediately
prior to an event and have a direct impact on the safety of the system because of the immediacy
of their adverse effects. However, they are usually not the root causes of the event. Applying
corrective actions to these issues may not address the real cause of the problem. A more detailed
analysis is required to establish the organisational factors that contributed to the event.
14.21 It is essential that the contribution of HF is properly investigated when incidents and
accidents occur. This is done so that the organisation can learn from incidents and near misses in
order to protect itself against the consequences of failing to accommodate human limitations in
the design and operation of aviation systems.
14.22 The HF component of investigation should be based on a model or framework for
systemic investigations considering human error, both at the individual and organisational levels.
A number of human error models and frameworks (such as Reason’s model) have been
developed over the last two decades to aid in understanding how humans err and how
accidents/incidents occur in the larger context of the systems in which these accidents/incidents
take place.
14.23 Investigators should be trained in basic HF concepts, and procedures should be designed
to examine the detail of human performance factors that may have contributed to the event. These
include the systemic sources of the failure (e.g. component failures, design deficiencies of
equipment and/or infrastructure, inadequate procedures and lack of training).

January 2013
AC 139-16(1): Safety management systems for aerodromes 25

The management of change

14.24 Where changes have occurred, or are about to occur, the SMS process should assess the
safety impact and address each concern appropriately through the system. Changes to the facility
or management structure can be affected by;
 Amendments to legislation;
 Replacement of aerodrome management personnel; and
 Increase or decrease to the movement area capabilities.
14.25 Changes need to be managed. A systematic approach to assess the outcome of change
needs to be well documented and endorsed by management to ensure safety compliance is not
compromised and business continuity is maintained.
14.26 Change management procedures should minimise the effect of changes and after
adequate assessment, reduce the resulting risk impact to an acceptable level.
14.27 Movement area changes may occur during airside works. Documentation supporting
Time Limited Works (TLW) that require a Notice to Airmen (NOTAM) and the preparation of a
Method of Working Plan (MOWP) that is a requirement of the Part 139 MOS should identify
changes. The preparation of supporting documentation should be the result of a robust safety
assessment identifying potential hazards and conflicting safety events that could occur during
works.
14.28 Airside projects not requiring a MOWP should still be considered and potential safety
issues identified. Where potential hazards and increased risk have been confirmed, the SMS
process should ensure mitigation treatments and controls are implemented and managed in
accordance with the appropriate compliance procedures.
14.29 The SMS document control process should follow the assigned outcomes until project
completion and ensure that all stakeholders are advised accordingly.
14.30 Change management processes should be considered and used as supporting criteria by
the aerodrome operator to determine if potential Aerodrome Managers and Reporting Officers
applicants are suitable to assume aerodrome positions of responsibility.

Continuous improvement of the SMS

14.31 It is the responsibility of the accountable manager to ensure that the SMS is reviewed.
The accountable manager should clearly define opportunities to conduct reviews either through
internal and/or external audits and stakeholder meetings. Continual review and auditing is an
important part of the SMS risk management framework.
14.32 The SMM needs to provide statements within each element to monitor success of the
system and highlight processes to ensure continuous improvement and effective control of
potential risk concerns.
14.33 The SMM should clearly define who would assume responsibility to assess the
effectiveness of the manual. These responsibilities should be associated with:
 If the SMS information is contained within the aerodrome manual, how will the SM
communicate with the Aerodrome Manual Controller, if they are not the same
nominated person?
 Who will assess the severity of reported incidents and investigate the root cause?
 Who will assess CASA and Aerodrome Technical Inspection reports that have identified
areas of safety concern and have observed non-compliances?

January 2013
AC 139-16(1): Safety management systems for aerodromes 26

 Who will ensure that all report outcomes requiring corrective action are assigned to a
responsible officer? The “system” should track the progress of assigned corrective action
and where delays have occurred, the accountable manager should assume responsibility
to ensure appropriate outcomes are achieved in a timely manner.

14.34 As a minimum, an annual SMS report should be prepared by the SM and presented to
the Accountable Manager and the Safety Committee (if applicable). The SM should assess the
negative and positive aspects of the SMM procedures and through consultation with appropriate
stakeholders, amend the section to improve safety outcomes and minimise hazardous
opportunities.
14.35 Annual reviews and a commitment to review as circumstances dictate, should be
incorporated in the SMM to assist and promote improvements.

15. SAFETY PROMOTION

15.1 Safety promotion provides a mechanism through which lessons learned from safety
event investigations and other safety-related activities are made available to all affected staff. It
also provides a means of encouraging the development of a positive safety culture and ensuring
that, once established, the safety culture is maintained.
15.2 While it is important that personnel are kept well informed, they should see evidence of
the commitment of management to safety. Management need to actively participate and be seen
to be responsible. The attitudes and actions of management will therefore be a significant factor
in the promotion of safe work practices and the development of a positive safety culture.
15.3 In addition to formal meetings and electronic communication options, safety promotion
activities are the primary alternative means by which safety issues are communicated within the
organisation. These issues may be addressed through staff training programs or less formal
mechanisms.

Training and education

15.4 The key function of safety management training is to create an awareness of the
objectives of an SMS and the importance to develop a safety culture that continually recognises
training requirements to endorse competency of aerodrome officers and stakeholders.
15.5 Depending on the nature of the task, the complexity of safety management training
required will vary from:
 initial and recurrent safety management awareness training for all staff;
 training aimed at management’s safety responsibilities;
 specific training for operational staff (such as in human factors etc.);
 detailed training for all key safety personnel — such as the SM, Accountable Manager,
Safety Representatives, Reporting Officers, and
 Safety Data Analysts (as required).

Training Documentation
15.6 Documentation should be developed to support the SMS training plan, which includes:
 a listing of the personnel (staff and third party personnel) who require SMS training;

January 2013
AC 139-16(1): Safety management systems for aerodromes 27

 a means of determining when each staff member is due to undergo a specific safety
training course;
 a method of determining the training provided to each member of staff;
 safety induction course/s for staff who have not previously been exposed to an SMS;
 recurrent safety course/s for all operational safety critical personnel; and
 a means of determining the effectiveness of the safety training provided e.g. feedback,
questionnaire, course evaluations and competency assessments.
15.7 An SMS training register which incorporates individual training records should be
established and maintained. This may be incorporated in a centralised training record system.
15.8 The SM needs to be competent. Potential competency training may include:
 Understanding the role of human performance in accident causation and prevention;
 Integration of Human Factors into the SMS;
 Accident and incident investigation;
 Aerodrome Reporting Officer Competency;
 Understanding of aviation operations;
 Understanding of the Part 139 MOS compliance;
 Familiarisation with the topography and geography of the aerodrome;
 Computer skills and word processing;
 SMS document management training;
 Risk management and risk assessment evaluation;
 Development, maintenance and operation of the SMS;
 Safety Counselling; and
 Occupational Health and Safety (OHS).
15.9 Aerodrome Management and Reporting Officer competency development may include
additional training with respect to:
 Bird and Animal species identification;
 Airside driver awareness;
 Handling of hazardous material;
 Bureau of Meteorology observer;
 Airside equipment proficiency;
 Firearm training;
 Incident and accident reporting; and
 OHS.

Safety communication
15.10 Communication of safety is an important responsibility of the accountable manager. The
SMM should describe the minimum safety promotion applications acceptable to the operator.
15.11 The operator’s safety promotion program should be based on several different
communication methods for reasons of flexibility and cost. As previously discussed, the
complexity of the operator’s organisation will determine appropriate methods available to
promote the SMS. These methods could include:

January 2013
AC 139-16(1): Safety management systems for aerodromes 28

 Presentation by an experienced person potentially supported by visual presentation e.g.

PowerPoint;
 Published articles or internal documentation;
 Videos while offering advantages of dynamic imagery and sound to reinforce particular
safety messages efficiently; and
 Electronic media provides improvement in the promotion of safety, as even small
companies can establish and maintain a website to disseminate safety information.
15.12 The complexity of the operator’s organisation and facility will determine what types of
safety communication are required.

16. SUMMARY
16.1 Safety should be actively managed from the very top of an organisation and filter down
to all personnel to ensure that the organisation as a whole, actively participates in the safety
system. This promotes a strong safety culture throughout the organisation.
16.2 A robust SMS should be seen as an integral function of normal business management,
recognising the high priority attached by the operator to aerodrome safety.
16.3 An organisation’s commitment to safety management is typically demonstrated by the
following::
 Evidence confirming the accountable manager commitment and involvement in an
effective formal SMS;
 Evidence of safety contributions by staff is encouraged and safety outcomes are reported
back through the safety promotion processes;
 Hazard identification is efficiently and swiftly managed and incorporated in the
operators operating systems;
 Evidence of the effectiveness of the reporting system;
 Organisations continually reviewing and improving existing procedures and practices;
 SMS is a formalised and organisation-wide system. The SMS is accepted at the senior
management level and distributed into the individual aerodrome officers and
stakeholder’s environments; and
 Where safety functions including but not limited to, aerodrome works, handling of
hazardous materials and ground handling are outsourced, contractual agreements
identify the need for either an equivalent SMS or involvement in the aerodrome operator
SMS as a stakeholder.

Executive Manager
Standards Division
January 2013

January 2013
AC 139-16(1): Safety management systems for aerodromes 29

APPENDIX A

SAFETY MANAGEMENT SYSTEM REVIEW CHECKLIST

A SMS checklist has been prepared as guidance materials only to assist aerodrome
Safety Managers while conducting a review of the SMS documentation and
preparation of review reports.
This checklist is generic. A checklist questionnaire should be relevant to each specific
aerodrome situation and therefore the Safety Manager may need to add additional
questions to the checklist.
The checklist could also be used as a “gap analysis” pro forma.

Safety Policy and Objectives

 Does the SMS documentation include a policy statement endorsed by the accountable
manager?
 Does the policy include the aim of achieving improved hazard identification and more
effective risk management of associated risks?
 Does the SMS manual contain a list of safety objectives?
 Are the objectives measurable using the aerodromes stated safety assurance methods?
 Has a Safety Manager been appointed?
 Are the Safety Manager’s roles and responsibilities clearly defined?
 Is there a Safety Committee?
 Is there an organisational chart that clearly defines the chain of command and a reporting
structure up to the accountable manager?
 How does the administration section identify the roles and responsibility of senior
management participation with SMS?
 Does the policy endorse and confirm the frequency of senior management participation
at SMS meetings or other events stated in the SMS documentation?
 Does the documentation identify the stakeholder association and roles and
responsibilities of third parties to participate in hazard identification?
 Is there a genuine statement to achieve the highest level of safety compliance accepting
due care and diligence?
 Does the documentation identify the importance to continually review the “systems” and
is there a formal audit process?
 Is the SMS documentation only addressing OHS?

January 2013
AC 139-16(1): Safety management systems for aerodromes 30

Safety Risk Management

 Has a Corporate Risk Management Framework been implemented?
 Is the likelihood and consequence definitions in the aerodrome SMS consistent with the
corporate framework?
 Is there a risk matrix or other valid risk analysis tool used?
 If used, is the risk matrix consistent with other internal matrix and project assessment
guidelines?
 Are the SMS documentation tools for operations consistent with financial assessment
risk management tools?
 Is risk management supported by a risk register?
 Is there a hazard register to record events that have actually occurred?
 Does someone with human factors training assess incidents and events to determine
human factors hazards and associated risks?
 Does the audit process check the hazard register against the Risk Register?
 Has the Risk Register been reviewed and risk levels changed due to the occurrence of an
incident?
 Have all projects been assessed prior to commencement to identify potential risk?
 Is the project assessment system clearly documented to support potential change
management issues?
 Do the system document procedures assess all reporting capabilities?
 Does the Safety Manager communicate with Aerodrome Reporting Officers and assess
serviceability issues?
 Does the SMS clearly define who will be responsible for certain outcomes depending on
risk levels?
 Are all personnel responsible for SMS reporting and assessment competent?
 Do the responsible personnel have a sound knowledge of aerodrome operations?

Safety Assurance
 How is the SMS audited?
 Does the aerodrome operator only rely on CASA and Aerodrome Technical Reports to
determine safety outcomes?
 What committees are involved to monitor safety assurance?
 Are the stakeholder committees well represented by the aerodrome operator?
 Who is responsible to monitor safety outcomes identified by committees?
 What internal reviews are documented?
 Who is responsible to assess internal reporting?
 Has the system worked effectively since the last audit?
 Were incidents appropriately assessed as per the SMS?
 Was there a satisfactory SMS audit report prepared by the SM and accepted by the
accountable manager?

January 2013
AC 139-16(1): Safety management systems for aerodromes 31

 What changes have occurred since the SMS review?

 Is there a formal process to identify changes within the organisation?
 Has the documentation identified a flow chart of stakeholder interaction?
 If any aerodrome services or safety function has been contracted to a third party, does
the aerodrome’s safety assurance program also measure the third party’s safety
performance?

Safety Promotion
 Have the training requirements been assessed?
 Is there a nominated training officer?
 Is training restricted to OHS?
 Does training compliment the requirements of the Part 139 MOS?
 How is the SMS promoted to new staff?
 How is the SMS maintained to ensure changes are implemented?
 Does all staff participate in the SMS reporting and assessment and understand
responsibilities?

January 2013