Cross-LOB SRM Guidance Signed 508
Cross-LOB SRM Guidance Signed 508
Cross-LOB SRM Guidance Signed 508
0)
April 20, 2018
Guidance for Coordinating Cross-LOB Safety Risk Assessments
AVP-300-17-003
Purpose
The purpose of this document is to provide guidance for conducting safety risk assessments on
issues that cross multiple Federal Aviation Administration (FAA) Lines of Business (LOB)/Staff
Offices when the organizations seek involvement from the FAA Safety Management System
(SMS) Executive Council and/or the FAA SMS Committee. These cross-organizational safety
risk assessments are conducted in accordance with the current version of FAA Order 8040.4,
Safety Risk Management Policy.
Scope
This guidance applies to all FAA organizations seeking FAA SMS Executive Council and/or FAA
SMS Committee involvement in conducting cross-LOB safety risk assessments.
Approval: ___________________________________________________________________
FAA SMS Committee Chair
REVISION HISTORY
Depending on the issue under consideration, the safety risk assessment may be conducted by
an individual or small group within a single organization. Other times, a cross-organizational
team of stakeholders, or SRM Team, should be formed to adequately address the scope and
complexity of the issue.
The purpose of this document is to provide guidance for conducting safety risk assessments on
issues that cross multiple Federal Aviation Administration (FAA) Lines of Business (LOB)/Staff
Offices when the organizations seek involvement from the FAA SMS Executive Council and/or
the FAA SMS Committee. These cross-organizational safety risk assessments are conducted in
accordance with the current version of FAA Order 8040.4, Safety Risk Management Policy.
Please note that organizations often establish SRM Teams without engaging the FAA SMS
Executive Council and/or the FAA SMS Committee. In this case, the organizations’ SRM
processes are employed. Organization-specific SRM processes are consistent with, but may not
be exactly the same as, the process described in the current version of FAA Order 8040.4.
• The triggers that indicate the need for a cross-LOB safety risk assessment;
• Cross-LOB safety risk assessment roles and responsibilities;
• Process steps for coordinating cross-LOB safety risk assessments; and
• A mechanism for escalating disagreements throughout the process.
An LOB/Staff Office may identify potential FAA-level safety issues for FAA-level cross-LOB
safety risk assessment and escalate them to the FAA SMS Committee for consideration.
1 Aerospace System is defined in this document using the definition in the current version of FAA Order
8040.4, Safety Risk Management Policy: U.S. airspace, all manned and unmanned vehicles operating in
that airspace, all U.S. aviation operators, airports, airfields, air navigation services, pilots, regulations,
policies, procedures, facilities, equipment, and all aviation-related industry.
Potential FAA-level issues or concerns that may trigger the need to conduct a safety
assessment include, but are not limited to:
• Safety issues assigned by the FAA SMS Committee;
• Safety issues that are present within the National Airspace System (NAS), although its
safety risk have not been accepted, it is expected to have high risk (e.g., it is identified
as a result of an accident/incident or it is assumed to have high risk);
• Safety issues that have high risk and a potentially systemic outcome (e.g., the outcome
crosses LOBs or the outcome impacts an industry segment rather than an individual
certificate holder);
• Any safety issue on which an FAA organization’s management elects to conduct an
FAA-level assessment;
• Data analyses that point to an issue, concern, or potential hazard in the system (e.g.,
analyses driven by Aviation Safety Information Analysis and Sharing (ASIAS));
• Issues identified by industry or system users; and
• New controls deemed necessary by the FAA as a result of internal FAA safety
recommendations or recommendations from other government entities such as the
National Transportation Safety Board (NTSB) or Congress.
The FAA SMS Committee, and if needed, the FAA SMS Executive Council, approves and
prioritizes FAA-level safety issues for safety risk assessment. Safety risk assessments
approved by the FAA SMS Committee and/or the FAA SMS Executive Council are routed to the
FAA SMS Committee-chartered Safety Collaboration Team (SCT) to perform the safety risk
assessments.
The organization that raised the safety issue is referred to as the Initiating Organization. The
Initiating Organization enters issue information into the Hazard Identification, Risk Management
& Tracking (HIRMT) tool prior to formally requesting an SRM Team at the FAA SMS Committee.
If the FAA SMS Committee (or FAA SMS Executive Council, if necessary) determines the need
for an FAA-level cross-LOB safety risk assessment, the Initiating Organization and the FAA
SMS Committee work together to identify the Office of Primary Responsibility (OPR). Table 1,
Roles and Responsibilities of Key Cross-LOB Safety Assessment FAA Stakeholders, contains
more information regarding the roles and responsibilities of the OPR, and Step 3 in the process
details the identification and selection of an OPR.
The FAA SRM process (current version of FAA Order 8040.4) is designed to ensure that
hazards are identified and the safety risk associated with those hazards is managed to
acceptable levels throughout the aerospace system. Therefore, the SRM process would be
used for FAA-level safety issues to identify hazards and mitigate to an acceptable level the
safety risk of cross-organizational issues that are found to exist as a result of incidents or
negative trends in the system. Issues that are not selected for assessment with FAA SMS
Committee involvement are still tracked in HIRMT and managed by the Initiating Organization,
2. Planned Changes
Chartered by the FAA SMS Committee, the SCT considers significant planned changes
affecting NAS operations for potential safety risk assessments. Examples of planned changes
include:
• Recommended or proposed aerospace system improvements, including new
technologies; and
• Impending or urgent changes to the aerospace system causing existing safety risk
controls to no longer be adequate.
To prevent these changes from introducing hazards and/or causing potential unacceptable
safety risk to the NAS, the FAA SMS Committee engages the SCT to conduct safety risk
assessments on the significant, cross-organizational planned changes, for which a decision is
yet to be made on funding or implementation. 2 The benefit of doing safety work such as this
early in the planning stages is that decision makers are made aware of potential hazards/safety
risk before they dedicate additional resources to moving further into planning and implementing
a change and any requisite mitigation strategies. The result should be more information for
decision making and more efficient use of resources.
The SCT manages safety risk assessments of these planned changes on behalf of the FAA
SMS Executive Council and the FAA SMS Committee.
Table 1: Roles and Responsibilities of Key Cross-LOB Safety Risk Assessment FAA Stakeholders
2In the Acquisition Management Process, this occurs prior to the Concept and Requirements Readiness
Decision.
3 The current version of the Guidance for Managing Aerospace System Level Safety Issues in HIRMT
contains further information regarding HIRMT roles and responsibilities.
4 The appropriate management official within the OPR selects the OPR Manager. In general, the OPR
Manager should be the decision maker within the OPR that has the biggest stake in the issue/change,
and he/she would be in the best position to address the issue or is most affected by the proposed
change. Existing organizational roles and responsibilities will likely help to determine the appropriate OPR
Manager.
5The SRM Team may include stakeholders external to the FAA. Step 7: Determine and Secure SRM
Team Members, provides more information regarding external stakeholders.
The remainder of this document describes the process for coordinating cross-LOB safety risk
assessments for FAA-level safety issues and planned changes, which involve the FAA SMS
Committee and/or FAA SMS Executive Council.
6 The term Technical Writer does not imply that an OPR must use a job series 1083 employee to
complete these tasks. Instead, it refers to a person given the role of note taker and documenter.
7 The person authorized to accept risk on behalf of the organization varies based on the level of risk being
accepted. Refer to the Safety Risk Acceptance Criteria for Issues or Changes That Cross LOBs/Staff
Offices table in the current version of FAA Order 8040.4, Safety Risk Management Policy for more
information.
Document in
Record of HIRMT
Comments and
Other Opinions
Step 4: Transfer HIRMT Template
Responsibilities to OPR OPR
(AVP-300) Acceptance
Documented Safety Risk
in HIRMT Assessment
Issue/Change
Summary Schedule Step 9: Develop Detailed Briefing
Briefing Template Template Schedule and Communicate with Package to
SRM Team (OPR, with help from SRM Team
SRM Team Facillitator as needed)
Step 5: Conduct Initial Planning
FAA SRM
(OPR, with help from SCT as
Process Briefing
needed)
Step 8: Ensure Management
Awareness of Team Composition
Resource (OPR/FAA SMS Committee
Request Memo Chair)
5M Model SRM Team
Template
Template Composition
Step 6: Establish Scope of Document to
Assessment, Draft System Step 7: Determine/Secure Team SCT/FAA SMS
Analysis & Risk Acceptance Plan SRM Team Members (OPR, with help from Committee Chair/
(OPR, with help from SCT as Composition SCT as needed) Appropriate
needed) Document Management
Approval for
No Template Official(s)
Assessment
Scope, Draft
System Analysis &
Risk Acceptance
Plan Template Approval of Yes
Scope, Draft System Analysis,
Risk Acceptance Plan
(OPR)
1. The safety issue is tracked and managed by the FAA SMS Committee;
2. The safety issue is present in the NAS 8, its safety risk has not been accepted, and it is
expected to have high risk (e.g., it is identified as a result of an accident or incident or it
is assumed to have high risk but an assessment has not been completed);
3. The safety issue has high risk and has a potentially systemic outcome (e.g., the outcome
crosses LOBs or the outcome impacts an industry segment rather than an individual
certificate holder); and/or
4. Any safety issue that an FAA organization’s management elects to track in HIRMT. 9
Since the FAA SMS Committee tracks and manages FAA-level safety issues and planned
changes (criterion #1 above), they are considered ASL issues. Therefore, HIRMT will be used to
document and track FAA-level safety issues and planned changes that are considered for
cross-LOB safety risk assessment by the FAA SMS Executive Council and/or the FAA SMS
Committee.
As stated in the Triggers for Cross-LOB Safety Risk Assessments section, the organization that
raised the safety issue is referred to as the Initiating Organization. In this step, the Initiating
Organization, with assistance from AVP-300 if necessary, enters a description for the required
fields of the potential FAA-level safety issue or planned change into HIRMT. 10 The Issue
Summary Document Template can be used to gather the issue information. Once the Initiating
Organization enters the information into HIRMT, it informs the FAA SMS Committee chair and
requests time to brief the issue to the FAA SMS Committee.
8 Changes being processed through the NAS Change Proposal (NCP) may be considered to be present
in the NAS, if they are in the live test and evaluation phase.
9 The organization should consider the risk and visibility of a safety issue when determining if it should be
user training. For more information regarding HIRMT and to obtain access to the tool, please refer to the
HIRMT site on the FAA intranet at https://hirmt.faa.gov or contact the HIRMT Help Desk at 9-natl-hirmt-
helpdesk@faa.gov.
The Initiating Organization uploads the briefing template into the HIRMT tool as supporting
documentation and works with AVP-300 to be added to the agenda of an upcoming FAA SMS
Committee meeting to present the briefing. The FAA SMS Committee determines whether or
not to provide resources to establish an FAA-level SRM Team. If the FAA SMS Committee
decides resources should be provided, it will task the SCT with establishing an SRM Team.
The FAA SMS Committee, with assistance from the Initiating Organization, identifies the
appropriate candidate OPR for FAA-level safety issues and planned changes. First, the FAA
SMS Committee Chair informally reaches out to the appropriate manager in the candidate OPR,
provides an overview of the project and OPR roles and responsibilities, achieves OPR interest
(ideally), and provides notice that a formal request memo will be sent to OPR management. The
FAA SMS Committee Chair may delegate this initial contact to the appropriate manager in the
Initiating Organization, SCT Leadership, or another member of the FAA SMS Committee.
Once initial contact with the candidate OPR has been made, SCT Leadership uses the OPR
Request Memo Template to formally request confirmation of the OPR, the OPR Manager, and
the OPR POC.
The FAA SMS Committee also tasks the SCT to manage the safety risk assessment of the
FAA-level cross-LOB safety issue. SCT Leadership reaches out to the OPR POC to offer
assistance with the SRM process and HIRMT.
In this step, the OPR POC, with assistance from the SCT if needed, documents a brief
description of the issue/change, describes the preliminary scope of the assessment, and
identifies stakeholders and participating organizations. The OPR POC develops a schedule that
includes high-level milestones for planning, conducting, documenting, and obtaining approvals
for the safety risk assessment and uses the Issue/Change Summary Briefing Template to
document this information. The template is used as a summary outreach briefing when
requesting participation on the SRM Team.
The OPR POC, with assistance from the SCT, then identifies the SRM Team Facilitator(s) and
Technical Writer.
Step 6: Establish Scope and Draft System Analysis and Risk Acceptance Plan
The OPR POC (with assistance from the SCT, and/or the SRM Team Facilitator, as needed)
documents the scope of the assessment and drafts the system analysis and risk acceptance
plan. The OPR POC (with participation from the SCT, as needed) meets with the SRM Team
Facilitator to plan the SRM Team meetings. Preparation meetings are used to define:
The purpose of the system analysis step is to understand and describe the system to the extent
necessary to identify potential hazards. It is a comprehensive approach to examining an issue
or change in terms of what it affects and what is affected by the issue or change. The OPR POC
can use the 5M Model to capture the information needed to bound and describe the system and
aid in the hazard identification process. When defining the components of the 5M Model (see
5M Model Template), the OPR adheres to the following guidelines:
• Mission: Define the purpose of the NAS change proposal or system/operation being
assessed, in detail. There should be agreement on the language for the issue or change
that the SRM Team is tasked to assess. Ensure that the language is unambiguous,
concise, and clearly reflective of the issue or change.
• huMan: Define the human operators, maintainers, and affected stakeholders. First,
identify organizations that are affected by the issue or change, and then proceed to
identify subject matter experts from each of those organizations. There may be times
when it is not feasible to obtain participation from some or part of the identified
stakeholders. In those cases, other avenues of collecting input or data may be used,
such as telephone interviews, worksheets, surveys, etc.
11 The draft risk acceptance plan must meet the risk acceptance criteria in FAA Order 8040.4.
The safety risk acceptance plan includes the safety risk acceptance criteria (such as a risk
matrix and the severity and likelihood definitions that will be used), designation of authority to
make the required safety risk decisions involved, and assignment of the relevant decision
makers. FAA Order 8040.4 allows flexibility to account for existing LOB/Staff Office processes
and structure. Therefore, the OPR can choose to use criteria other than the severity and
likelihood definitions and risk matrix in 8040.4. The draft risk acceptance plan specifically
describes the criteria the team will use to determine risk acceptability, as well as the levels of
management that are expected to accept the risk.
After the assessment scope, draft system analysis, and draft safety risk acceptance plan are
complete, the OPR POC forwards them to the OPR Manager for review and approval, as
applicable (see Approval of Assessment Scope, Draft System Analysis and Risk Acceptance
Plan Briefing Template). The OPR documents that the assessment scope, draft system
analysis, draft safety risk acceptance plan, and approval are complete by uploading the
completed templates to the safety issue record in HIRMT noting OPR Manager’s approval.
Once the OPR Manager’s acceptance is obtained, the OPR POC and SRM Team Facilitator
coordinate to develop a briefing package to provide to the SRM Team members (see Step 9).
The OPR POC (with assistance from the SCT, if needed) identifies the skills and expertise
required to conduct the safety risk assessment. Though the size and makeup of the cross-LOB
SRM Team will vary according to the type and complexity of the issue/change, the following
types of experts should be considered for involvement on the team (note that this list is not all-
inclusive):
To ensure the quality of participation from team members, it is important that all team members
have a basic understanding of SRM prior to commencing the SRM Team meetings. The OPR
POC verifies that all FAA team members have reviewed the FAA SRM Overview Briefing
(FAA27000023) in the electronic Learning Management System (eLMS) as a prerequisite for
participating on the team. A similar overview should be provided to any external team
participants.
The OPR POC determines expectations of team members regarding level of effort required to
support the team. Expectations include:
• Face-to-face meetings: Estimate how many meetings the SRM Team is expected to
attend in person, the location(s) of the meetings, and the duration of the meetings
required to accomplish the team objectives.
• Teleconferences: Estimate the frequency of expected teleconferences, duration of the
calls, and timeframe they are expected to occur (e.g., every two weeks for 1 hour, June-
October 2018).
• Work outside of meetings: Estimate the type (e.g., collection of data) and amount of
work that the team member will be expected to complete in between the meetings and
teleconferences (e.g., It is anticipated that the team member will spend 10 hours per
week devoted to this activity outside of the face-to-face meetings and teleconferences.).
In addition to expectations about the level of effort, the OPR POC identifies any other factors
that organizations may consider when selecting team members and specific participant roles,
which may include:
The OPR POC then informally reaches out to the candidates and provides them with an
overview of the project and expectations of team members. If the candidate is interested in
participating on the team, the OPR POC works with the candidate to informally reach out to the
candidate’s manager, provide an overview of the project, and discuss expectations of the team
member and the team member’s management. If the manager agrees that the candidate should
participate on the team, the OPR POC notifies the manager that a formal request memo will be
sent to acquire the team member’s participation.
The OPR POC formally requests team member participation by emailing a completed Resource
Request Memo Template to managers of all recruited team members. 12 The OPR POC then fills
out the SRM Team Composition document that contains names and experience levels of SRM
Team members. The OPR POC then sends the SRM Team Composition document to the SCT,
the FAA SMS Committee Chair, and appropriate managers within the stakeholder
organizations. The OPR POC uploads the completed SRM Team Composition document in
HIRMT for documentation purposes.
For FAA-level safety issues and planned changes, the FAA SMS Committee Chair presents
high-level milestones, an associated schedule, and the SRM Team Composition document to
the FAA SMS Executive Council for awareness.
The OPR POC and the SRM Team Facilitator meet to prepare and develop a briefing package
for the SRM Team kickoff meeting. The briefing package includes:
12 For external stakeholders, the OPR POC uses the External Stakeholder Resource Request Template.
HIRMT is intended to be used as a process tool to guide teams through the SRM steps and to
aid in safety risk assessment documentation as they progress through the SRM process. As the
team progresses through SRM, the OPR POC enters information and uploads relevant
supporting documentation into HIRMT after each SRM step.
Typically, the SRM Team completes all five SRM steps while convened together for a few days
to conduct the safety risk assessment. However, the results are organized and delivered to
management in two separate documents. SRM steps one through four (System Analysis;
Identify Hazards; Analyze Safety Risk; Assess Safety Risk) are delivered in a Safety Risk
Assessment Report and approved by management prior to delivering the results of SRM step
five (Control Safety Risk) in a Proposed Safety Risk Mitigations Addendum. The reason for two
separate documents is so management can focus on first agreeing that the risk was
characterized and assessed appropriately. After agreement on the evaluation of risk,
management can then focus on whether the proposed mitigations are appropriate.
In this step, the SRM Team, with assistance from the SRM Team Facilitator and Technical
Writer, produces the draft Safety Risk Assessment Report (see FAA Safety Risk Assessment
Report Template). The results of the safety risk assessment should be presented to the team to
verify that the SRM Team members’ discussions have been correctly recorded.
Once the draft Safety Risk Assessment Report is complete, the SRM Team reviews it and
reaches concurrence (desired) on the results. SRM Team members provide comments on the
draft Safety Risk Assessment Report to the OPR POC using the Comment Matrix Template.
The OPR POC leads a sub-team to resolve team comments. Comments and resolutions are
provided back to the commenters.
The SRM Team should strive to reach consensus, but there may be instances in which not all
SRM Team members agree on the results of the safety risk assessment. In those cases, the
team documents the results of the assessment, records the comments and other opinions, and
delivers the results to the decision maker. Records of comments and other opinions are
appended to the Safety Risk Assessment Report, if necessary, using the Record of Comments
and Other Opinions Template.
The SRM Team Facilitator mediates and assists SRM Team members in working through
differences of opinion. He or she should be able to remain neutral during these discussions, and
recognize, acknowledge, and use differences of opinion to help the SRM Team consider
different points of view.
Following peer review, the SCT designates an FAA senior technical expert(s) to review the draft
Safety Risk Assessment Report for completeness and accuracy and to assure that the
appropriate process was followed. 13 A statement is added to the Safety Risk Assessment
Report to attest that a peer review was conducted. For example, “[insert name of technical
reviewer(s)] reviewed the Safety Risk Assessment Report and concurs that the appropriate
process was followed and the report appears to be complete and accurate.”
After the peer review is conducted, the OPR POC approves the Safety Risk Assessment
Report. 14 Safety Risk Assessment Report approval indicates that the report was developed
properly, that hazards were systematically identified, and that safety risk was appropriately
assessed. Safety Risk Assessment Report approval does not constitute acceptance of the
safety risk associated with the issue/change or approval to implement the mitigations/change.
Approval signatures are not part of the Safety Risk Assessment Report. Instead, the signatures
are recorded separately on a memo with the Safety Risk Assessment Report attached. To
finalize the Safety Risk Assessment Report, the OPR Manager signs the memo accompanying
it, indicating agreement that the findings are valid and accurate and the process was followed
(see Safety Risk Assessment Report Signature Memo Template). The OPR POC uploads the
Safety Risk Assessment Report and applicable signature pages into HIRMT for documentation
purposes.
Once the SRM Team finalizes the Proposed Safety Risk Mitigations Addendum, the OPR
forwards the addendum to the appropriate management official(s) to confirm that valid safety
mitigations were proposed, and that an effective implementation and monitoring plan was
prepared (see Step 13).
13 The FAA SMS Committee acknowledges that affected stakeholders may require an independent peer
based on their organizational requirements. For example, in the ATO, the ATO Chief Safety Engineer
would also approve the Safety Risk Assessment Report.
The OPR POC is responsible for coordinating mitigation approvals and safety risk acceptance.
The OPR POC briefs the appropriate management official(s) for the Risk Accepter and Risk
Mitigation Implementer(s) to request approval of the proposed safety mitigations and safety risk
approvals (see Request for Approval of Proposed Mitigations Briefing Template).
The OPR POC then obtains the appropriate signatures for each mitigation and acceptance of
safety risk by the appropriate organizations on a memo that accompanies the final Safety Risk
Assessment Report and Proposed Safety Risk Mitigations Addendum (see Proposed Safety
Risk Mitigations Addendum Signature Memo Template). By signing the memo, the Risk
Accepter certifies acknowledgment of and acceptance of the safety risk associated with the
issue/change that is expected to remain once the safety risk mitigations and/or change(s) are
implemented. The Risk Accepter’s signature also indicates a commitment to follow the
documented monitoring plan to verify the predicted residual safety risk. Signature by the Risk
Mitigation Implementer(s) indicates commitment to implement the safety risk mitigations/controls
in accordance with the associated Proposed Safety Risk Mitigations Addendum.
Once approvals and signatures are obtained, the OPR POC uploads the templates and
applicable signatures into HIRMT for documentation purposes. Note: if there is disagreement on
the mitigations or the responsibility for implementing them, the issue can be escalated according
to the process outlined in the following section, Process for Escalation of SRM-Related Issues.
A safety issue may affect multiple LOBs and/or Staff Offices. Under such circumstances,
all affected FAA organizations must be part of the process. Effective SRM requires early
and ongoing involvement by appropriate members of all affected FAA organizations. In the
event that a disagreement arises among FAA organizations regarding SRM that cannot be
resolved, the issue should be raised for resolution to the FAA SMS Committee.
Based on this requirement in the policy, the following process was developed to escalate an
issue related to SRM to the appropriate levels of FAA and/or LOB/Staff Office management.
This process can be used for issues with SRM sponsored by the FAA SMS Committee or SRM
conducted by organizations independent of the FAA SMS Committee, as long as the issue
meets the criteria in Step 1.
• Disagreement on mitigations
• Failure to implement mitigations
• Disagreement on the process or methodology used
• Disagreement on safety risk assessment
• Disagreement as to whether to apply resources
• Disagreement over ownership of hazard and/or controls
The OPR POC works with his/her representative on the FAA SMS Committee and the FAA
SMS Committee Chair to make sure that the right subject matter experts are brought in for the
discussions with management if more information is needed on a particular issue. The FAA
SMS Committee discusses the submission with the appropriate experts within the LOBs/Staff
Offices to assist in resolving the issue. The FAA SMS Committee decides whether the
disagreement can be resolved at the FAA SMS Committee level or if it needs to be escalated to
the FAA SMS Executive Council. The FAA SMS Committee makes every attempt to resolve the
issue. If the OPR is not present at the meeting, the FAA SMS Committee Chair notifies the OPR
POC of the resolution or decision to escalate further.
The FAA SMS Committee Chair ensures that the LOBs/Staff Offices involved provide
appropriate subject matter experts needed for discussions at the FAA SMS Executive Council
meeting. The FAA SMS Committee Chair communicates the results of the FAA SMS Executive
Council meeting with the FAA SMS Committee members and OPR, who in turn share the
information with their organizations.