Safety Management Systems for Part 21 Type and Production Certificate Holders

04/26/24 AC 21-58 CONTENTS Paragraph Page Chapter 1. Introduction ................................................................................................................ 1-1 1.1 Purpose of This Advisory Circular (AC) ...................................................................... 1-1 1.2 Integration ..................................................................................................................... 1-1 1.3 Applicability ................................................................................................................. 1-1 1.4 Where You Can Find This AC...................................................................................... 1-1 1.5 Implementation Strategies ............................................................................................ 1-1 1.6 Contact Information ...................................................................................................... 1-2 1.7 Terminology .................................................................................................................. 1-2 1.8 AC Feedback Form ....................................................................................................... 1-2 Chapter 2. Safety Management System Components Explained................................................. 2-1 2.1 Overview of This Chapter............................................................................................. 2-1 2.1.1 Regulatory Text Box ......................................................................................... 2-1 2.1.2 Discussion ......................................................................................................... 2-1 2.1.3 Implementation Strategies ................................................................................ 2-1 2.1.4 Scalability Examples ......................................................................................... 2-1 2.2 Subpart A: General ....................................................................................................... 2-2 2.2.1 Discussion. ........................................................................................................ 2-2 2.2.2 Implementation Strategies ................................................................................ 2-2 2.2.3 Scalability Examples......................................................................................... 2-3 2.2.4 Definitions......................................................................................................... 2-4 2.2.5 General Requirements ....................................................................................... 2-5 2.2.6 Part 121, Part 135, or § 91.147 Requirements .................................................. 2-5 2.2.7 Requirements For Production Certificate Holders That Are Holders Or Licensees Of A Type Certificate For The Same Product ................................. 2-6 2.2.8 Requirements For Type Certificate Holders Applying For A Production Certificate For The Same Product..................................................................... 2-8 ii 04/26/24 AC 21-58 CONTENTS (CONTINUED) Paragraph Page 2.2.9 Requirements For Type Certificate Holders That Allow Another Person To Use The Type Certificate To Obtain A Production Certificate For The Same Product ...................................................................................... 2-9 2.2.10 Organizational System Description ................................................................ 2-11 2.2.11 Implementation Plan. ...................................................................................... 2-14 Table 2-1. Implementation Plan Example .................................................................. 2-16 2.3 Subpart B: Safety Policy. ............................................................................................ 2-17 2.3.1 Safety Policy. .................................................................................................. 2-17 2.3.2 Safety Accountability and Authority .............................................................. 2-20 Table 2-2. Safety Risk Acceptance Authority Example ............................................. 2-21 2.3.3 Designation and Responsibilities of Required Safety Management Personnel ........................................................................................................ 2-22 2.3.4 Coordination of Emergency Response Planning. ........................................... 2-24 2.4 Subpart C: Safety Risk Management (SRM). ............................................................. 2-25 2.4.1 Applicability: Requirements to Apply Safety Risk Management (SRM) ...... 2-25 2.4.2 System Analysis .............................................................................................. 2-26 2.4.3 Safety Risk Analysis ....................................................................................... 2-27 2.4.4 Safety Risk Assessment .................................................................................. 2-28 Table 2-3. Sample Risk Matrix ................................................................................... 2-29 2.4.5 Safety Risk Control ......................................................................................... 2-30 2.4.6 Notification of Hazards to Interfacing Persons ............................................... 2-31 Figure 2-1. Hazard Notification Process ..................................................................... 2-33 2.5 Subpart D: Safety Assurance. ..................................................................................... 2-35 2.5.1 Monitoring of Operational Processes.............................................................. 2-35 2.5.2 Analysis of Data .............................................................................................. 2-38 2.5.3 Confidential Employee Report Summary Reporting Requirements ............... 2-39 2.5.4 Safety Performance Assessment ..................................................................... 2-40 2.5.5 Continuous Improvement................................................................................ 2-41 2.6 Subpart E: Safety Promotion. ..................................................................................... 2-43 2.6.1 Competencies and Training ............................................................................ 2-43 2.6.2 Safety Communication.................................................................................... 2-44 iii

04/26/24 AC 21-58 CONTENTS (CONTINUED) Paragraph Page 2.7 Subpart F: SMS Documentation and Recordkeeping. ................................................ 2-46 2.7.1 SMS Documentation ....................................................................................... 2-46 2.7.2 SMS Records. ................................................................................................. 2-47 Chapter 3. Implementation: Building a Safety Management System (SMS) .............................. 3-1 3.1 Process Overview.......................................................................................................... 3-1 3.1.1 Develop an Organizational System Description ............................................... 3-1 3.1.2 Gap Analysis. .................................................................................................... 3-1 3.1.3 Develop and Submit an Implementation Plan. ................................................. 3-1 3.1.4 Develop the Policies, Processes and Procedures to Comply with Part 5. ......... 3-1 3.1.5 Implement the SMS. ......................................................................................... 3-1 Appendix A. Guidance For Developing A Safety Policy ..................................................... A-1 Appendix B. Identifying The Accountable Executive ...........................................................B-1 Figure B-1. Accountable Executive Decision Process .................................................B-2 Figure B-2. Verifying The Accountable Executive ......................................................B-3 Appendix C. References And Additional Information ..........................................................C-1 Advisory Circular Feedback FIGURES Number Page Figure 2-1. Hazard Notification Process .................................................................................... 2-33 Figure B-1. Accountable Executive Decision Process ............................................................... B-2 Figure B-2. Verifying the Accountable Executive ..................................................................... B-3 TABLES Number Page Table 2-1. Implementation Plan Example ................................................................................. 2-16 Table 2-2. Safety Risk Acceptance Authority Example ............................................................ 2-21 Table 2-3. Sample Risk Matrix .................................................................................................. 2-29 iv

04/26/24 AC 21-58 CHAPTER 1. INTRODUCTION 1.1 Purpose of This Advisory Circular (AC). This AC provides information to assist certain certificate holders under 14 CFR part 21 in developing, implementing, and maintaining a safety management system (SMS) to meet the regulatory requirements of 14 CFR part 5. This AC is not mandatory and does not constitute a regulation. This AC describes an acceptable means, but not the only means, to develop, implement, and maintain an SMS. This guidance is not legally binding and will not be relied upon by the FAA as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance is voluntary only and nonconformity will not affect rights and obligations under existing statutes and regulations.

1.2 Integration. An SMS is not meant to be a separate system built alongside or on top of your other business systems. An SMS should be integrated into your existing business structure. A properly integrated SMS fosters a fundamental and sustainable change in how you view and analyze data and information, how you make informed decisions, and how you develop new operational and business methods. Development and implementation of an SMS is necessary to comply with part 5 but is not a substitute for compliance with other federal regulations.

Note: It is not the intent or purpose of an SMS to override any existing regulatory standards or alter approval and acceptance processes that already apply to your organization. Your organization must still comply with all other applicable statutes and regulations.

1.3 Applicability. This AC is applicable to part 21 type and production certificate holders, applicants, and licensees that are developing and implementing an SMS to meet the requirements in part 5.

1.4 Where You Can Find This AC. You can find this AC on the Federal Aviation Administration’s (FAA) website at FAA Advisory Circulars or on the FAA Dynamic Regulatory System at FAA DRS .

1.5 Implementation Strategies. Because aviation organizations range widely in size, scope, and complexity, each organization may tailor their SMS policies, methods, and procedures as needed to comply with part 5. This concept is widely referred to as scalability. The organization is free to adjust their means of achieving compliance with all applicable requirements of part 5, but scalability does not allow the organization to set aside sections of part 5. This AC will provide useful considerations and, in some cases, examples of how the organization may integrate new, practical, and effective SMS methods and procedures to complement the complexity of their existing operations and processes while recognizing existing policies, procedures, or methods that may comply with part 5 SMS requirements.

1-1 04/26/24 AC 21-58 1.6 Contact Information. For additional information or suggestions, please contact: Organization and System Policy Branch (AIR-630) Policy and Standards Division Aircraft Certification Service (AIR) Email: 9-AVS-AIR-SMS@faa.gov 1.7 Terminology. Throughout this AC the term “organization” is used and means part 21 type and production certificate holders, applicants, and licensees. For the purpose of this AC and from an SMS perspective they should be considered the same. The term “person” is a legal term defined in 14 CFR part 1 and, in the context of part 5 for this AC, refers to type and production certificate holders, applicants, and licensees.

1.8 AC Feedback Form. For your convenience, an AC feedback form is provided on the last page of this AC. Note any deficiencies found, clarifications needed, or suggested improvements regarding the contents of this AC on the feedback form.

1-2

04/26/24 AC 21-58 CHAPTER 2. SAFETY MANAGEMENT SYSTEM COMPONENTS EXPLAINED 2.1 Overview of This Chapter. Safety management system requirements are organized around the four components of safety management. These components are broken down into subparts of part 5 (e.g., Subpart B, Safety Policy). This chapter contains a description of each SMS requirement contained in part 5. After the title of each requirement the following is provided: 2.1.1 Regulatory Text Box. A copy of the part 5 regulatory text for reference which should facilitate the reader’s ability to relate regulatory requirements with explanations without the need to cross-reference additional documents.

2.1.2 Discussion. A more detailed plain language explanation of the process as it relates to the SMS.

2.1.3 Implementation Strategies. Acceptable means of compliance to the applicable part 5 section, including examples.

2.1.4 Scalability Examples. The FAA recognizes that there is a spectrum of complexity within organizations across the aviation product and service provider industry.

Therefore, we have included scalability examples of how your organization can meet the pertinent SMS requirements based upon where your organization may fall on the spectrum of complexity. These examples are intended to serve as general descriptions to guide you in assessing the best approach for your unique organization. The scalability examples demonstrate ways you might choose to implement these requirements based upon where your organization may fall on the spectrum of complexity. The scalability examples are not the only ways the requirements could be met. Ultimately, an SMS should be tailored to meet the needs of your organization.

2-1 04/26/24 AC 21-58 2.2 Subpart A: General .

§ 5.1 Applicability.

This part applies to all of the following: (a) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 121 of this chapter.

(b) Any person that holds or applies for a certificate issued under part 119 of this chapter authorizing the person to conduct operations under part 135 of this chapter.

(c) Any person that holds or applies for a Letter of Authorization issued under § 91.147 of this chapter.

(d) Any person that holds both a type certificate and a production certificate issued under part 21 of this chapter for the same product.

(e) Any person that holds a production certificate issued under part 21 of this chapter for a product for which the person is a licensee of the type certificate for the same product.

(f) Any person that applies for a production certificate under part 21 of this chapter for a product for which the person is the holder or licensee of the type certificate for the same product.

(g) Any person that holds a type certificate issued under part 21 of this chapter for a product, except for persons that hold only type certificates issued under § 21.29 of this chapter, that allows another person to use the type certificate to manufacture the same product under a production certificate.

2.2.1 Discussion. Sections 5.1(d) through (g) define the organizations that are required to comply with part 5.

2.2.2 Implementation Strategies.

2.2.2.1 You must comply with part 5 if your organization meets any of the following: 1. Is a holder of a type certificate and a production certificate for the same product [§ 5.1(d)].

2. Is a holder of a production certificate for a product and is a licensee of the type certificate for the same product [§ 5.1(e)].

3. Applies for a production certificate for a product and holds the type certificate for the same product [§ 5.1(f)].

4. Applies for a production certificate for a product and is a licensee of the type certificate for the same product [§ 5.1(f)] 2-2 04/26/24 AC 21-58 5. Is a holder of a type certificate for a product (other than type certificates issued under § 21.29) that the organization is licensing to allow another person to obtain a production certificate to manufacture the same product [§ 5.1(g)]. The term “production certificate” in § 5.1(g) includes a production certificate issued by the FAA under part 21 or a production certificate or equivalent authorization issued by a foreign civil aviation authority.

Note: Part 5 applicability is intended for entities involved in the design and manufacturing of products (aircraft, aircraft engine, or propeller).

2.2.2.2 Meeting one or more of the following does not trigger the requirement for an organization to comply with part 5: 1. Is a holder of a production certificate that does not approve production of a complete product. For example, a production certificate issued for “articles or parts only.” 2. Is a holder of a type certificate for a product that is not produced. For example, a type certificate where there is no associated production certificate, including a foreign production certificate or equivalent authorization.

3. Is a holder of a supplemental type certificate.

4. Is a holder of a production certificate issued for a supplemental type certificate.

5. Is a holder of a supplemental type certificate that is licensed to another person to obtain a production certificate.

6. Is a holder of a parts manufacturer approval.

7. Is a holder of a technical standard order authorization.

8. Is a holder of a type certificate issued under § 21.29 that produces a product in the United States under an extension of a foreign production approval.

9. Is a holder of a type certificate issued under § 21.29 that is licensed to another person to obtain a production certificate.

2.2.3 Scalability Examples. Not applicable.

2-3 04/26/24 AC 21-58 2.2.4 Definitions.

§ 5.3 Definitions.

• Hazard means a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident, as defined in 49 CFR 830.2 .

• Risk means the composite of predicted severity and likelihood of the potential effect of a hazard.

• Risk control means a means to reduce or eliminate the effects of hazards.

• Safety assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.

• Safety Management System (SMS) means the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls.

It includes systematic procedures, practices, and policies for the management of safety risk.

• Safety objective means a measurable goal or desirable outcome related to safety.

• Safety performance means realized or actual safety accomplishment relative to the organization's safety objectives.

• Safety policy means the person’s documented commitment to safety, which defines its safety objectives and the accountabilities and responsibilities of its employees in regard to safety.

• Safety promotion means a combination of training and communication of safety information to support the implementation and operation of an SMS in an organization.

• Safety Risk Management means a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling risk.

2.2.4.1 Discussion. Section 5.3 provides definitions used throughout part 5.

2.2.4.2 Implementation Strategies. Not applicable.

2.2.4.3 Scalability Examples. Not applicable.

2-4 04/26/24 AC 21-58 2.2.5 General Requirements.

§ 5.5 General Requirements.

(a) SMS components. An SMS under this part must be appropriate to the size, scope, and complexity of the person’s organization and include, at a minimum, all of the following components: (1) Safety policy that meets the requirements of subpart B of this part.

(2) Safety risk management that meets the requirements of subpart C of this part.

(3) Safety assurance that meets the requirements of subpart D of this part.

(4) Safety promotion that meets the requirements of subpart E of this part.

(b) Continuing requirements. Any person required to develop and implement an SMS under this part must maintain the SMS in accordance with this part.

2.2.5.1 Discussion. Section 5.5 requires an SMS to be scaled to fit the organization, include all four SMS components, and be maintained.

2.2.5.2 Implementation Strategies.

2.2.5.2.1 Your SMS must be scaled to the size, scope, and complexity of your organization and include the four SMS components [§ 5.5(a)]. This means that your SMS can be scaled in a way that works for your organization.

Note that scalability allows flexibility to match the SMS to your organization but does not alleviate the requirement to meet all applicable sections of part 5. Scalability examples are provided throughout this chapter to assist with your SMS implementation.

2.2.5.2.2 You must maintain your SMS [§ 5.5(b)]. Maintaining an SMS means that your SMS processes and procedures, documentation (e.g., organizational system description, policies, procedures), and records (e.g., safety risk management, safety assurance, training) are accurate and kept current.

2.2.5.3 Scalability Examples. Not applicable.

2.2.6 Part 121, Part 135, or § 91.147 Requirements.

§ 5.7 Requirements for domestic, flag, and supplemental operations.

§ 5.9 Requirements for commuter and on-demand operations or passenger carrying flights for compensation or hire.

2-5 04/26/24 AC 21-58 2.2.6.1 Discussion. Sections 5.7 and 5.9 are not applicable to part 21 type and production certificate holders. See AC 120-92 for information pertinent to certificate holders under parts 121, 135, and Letters of Authorization (LOA) holders under § 91.147. Entities operating under one or more of these parts that are also type certificate or production certificate holders or licensees must meet all part 5 requirements applicable to every certificate or LOA held.

2.2.6.2 Implementation Strategies. Not applicable.

2.2.6.3 Scalability Examples. Not applicable.

2.2.7 Requirements For Production Certificate Holders That Are Holders Or Licensees Of A Type Certificate For The Same Product.

§ 5.11 Requirements for production certificate holders that are holders or licensees of a type certificate for the same product.

Any person that holds a production certificate issued under part 21 of this chapter for a product for which the person is the holder or licensee of the type certificate for the same product on or before May 28, 2024, must: (a) Develop and maintain an organizational system description in accordance with § 5.17 of this subpart.

(b) Submit an implementation plan in accordance with § 5.19 of this subpart for FAA approval in a form and manner acceptable to the Administrator no later than November 28, 2024.

(c) Develop an SMS that meets the requirements of this part.

(d) Implement the SMS in accordance with this part no later than May 28, 2027.

(e) Make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part.

(f) Maintain the SMS as long as the person is both a holder of a production certificate and a holder or licensee of a type certificate for the same product.

2.2.7.1 Discussion. Section 5.11 provides the steps required to develop, implement, and maintain an SMS for holders of a production certificate for a product that hold or are a licensee of a type certificate for the same product.

2-6 04/26/24 AC 21-58 2.2.7.2 Implementation Strategies.

2.2.7.2.1 You must develop and maintain an organizational system description in accordance with § 5.17 [§ 5.11(a)]. Refer to paragraph 2.2.10 for information about the organizational system description.

2.2.7.2.2 You must submit an implementation plan in accordance with § 5.19 to the FAA for approval by November 28, 2024 [§ 5.11(b)]. Refer to paragraph 2.2.11 for information about the implementation plan. Submit your implementation plan to: • Program Management Section (AIR-8X7) • Email: 9-AVS-AIR-SMS@faa.gov 2.2.7.2.3 You must develop an SMS that meets part 5 [§ 5.11(c)]. Developing an SMS means that you have created or identified existing policies, processes, and procedures that meet the applicable requirements in part 5.

2.2.7.2.4 You must implement your SMS by May 28, 2027 [§ 5.11(d)].

Implementing an SMS means that your SMS is functioning across all areas described in your organizational system description and meets the requirements in part 5.

2.2.7.2.5 You must make available to the FAA, upon request, all necessary information and data that demonstrates that your SMS meets the requirements in part 5 [§ 5.11(e)]. Make available means that you allow the FAA access to review your SMS information and data but are not required to submit the information and data to the FAA.

Note: The FAA will request that you make SMS information and data available as we conduct oversight of your SMS. This data and information may include SMS policies, processes, procedures, documentation, and records.

2.2.7.2.6 You must maintain your SMS as long as you are both a holder of a production certificate for a product and a holder or licensee of a type certificate for the same product [§ 5.11(f)]. Maintaining an SMS means that your SMS processes and procedures, documentation (e.g., organizational system description, policies, procedures), and records (e.g., safety risk management, safety assurance, training) are accurate and kept current.

2.2.7.3 Scalability Examples. Not applicable.

2-7 04/26/24 AC 21-58 2.2.8 Requirements For Type Certificate Holders Applying For A Production Certificate For The Same Product.

§ 5.13 Requirements for type certificate holders or licensees applying for a production certificate for the same product.

(a) This section applies to any holder or licensee of a type certificate for a product who either: (1) Applies for a production certificate for that same product under part 21 of this chapter on or after May 28, 2024, or (2) Has an application for a production certificate for that same product under part 21 of this chapter pending on May 28, 2024.

(b) Any person that meets paragraph (a) of this section must: (1) Develop and maintain an organizational system description in accordance with § 5.17 of this subpart.

(2) Submit an implementation plan in accordance with § 5.19 of this subpart for FAA approval in a form and manner acceptable to the Administrator during the certification process.

(3) Develop an SMS that meets the requirements of this part.

(4) Implement the SMS in accordance with this part no later than 36 months after submission of the implementation plan.

(5) Make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part.

(6) Maintain the SMS as long as the person is both a holder of a production certificate and a holder or licensee of a type certificate for the same product.

2.2.8.1 Discussion. Section 5.13 provides the steps required to develop, implement, and maintain an SMS if you hold or are a licensee of a type certificate for a product and are applying, or have an application pending, for a production certificate for the same product.

2.2.8.2 Implementation Strategies. Refer to paragraph 2.2.7.2.1 through 2.2.7.2.6 for the steps to develop, implement, and maintain your SMS.

Note: Your implementation plan must be submitted during the production certification process (paragraph 2.2.7.2.2 ) and your SMS implementation must be completed 36 months after submission of your implementation plan (paragraph 2.2.7.2.4 ).

2.2.8.3. Scalability Examples. Not applicable.

2-8 04/26/24 AC 21-58 2.2.9 Requirements For Type Certificate Holders That Allow Another Person To Use The Type Certificate To Obtain A Production Certificate For The Same Product.

§ 5.15 Requirements for type certificate holders that allow another person to use the type certificate to obtain a production certificate for the same product.

(a) This section applies to any person that holds a type certificate issued under part 21 of this chapter for a product, except for persons that hold only type certificates issued under § 21.29 of this chapter, that allows another person to use the type certificate to manufacture the same product under a production certificate.

(b) Any person that meets paragraph (a) of this section and has a licensing agreement in accordance with § 21.55 of this chapter on May 28, 2024, must: (1) Develop and maintain an organizational system description in accordance with § 5.17 of this subpart.

(2) Submit an implementation plan in accordance with § 5.19 of this subpart for FAA approval in a form and manner acceptable to the Administrator no later than November 28, 2024.

(3) Develop an SMS that meets the requirements of this part.

(4) Implement the SMS in accordance with this part no later than May 28, 2027.

(5) Make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part.

(6) Maintain the SMS as long as the person continues to meet paragraph (a) of this section.

(c) Any person that meets paragraph (a) of this section and enters into a licensing agreement in accordance with § 21.55 of this chapter after May 28, 2024, must: (1) Develop and maintain an organizational system description in accordance with § 5.17.

(2) Submit an implementation plan in accordance with § 5.19 of this subpart for FAA approval in a form and manner acceptable to the Administrator when providing written licensing agreements in accordance with § 21.55 of this chapter.

2-9 04/26/24 AC 21-58 § 5.15 Requirements for type certificate holders that allow another person to use the type certificate to obtain a production certificate for the same product (continued).

(3) Develop an SMS that meets the requirements of this part.

(4) Implement the SMS in accordance with this part no later than 36 months after submission of the person’s implementation plan.

(5) Make available to the Administrator, upon request, all necessary information and data that demonstrates that the person has an SMS that meets the requirements set forth in this part.

(6) Maintain the SMS as long as the person continues to meet paragraph (a) of this section.

2.2.9.1 Discussion. Section 5.15 provides the steps required to develop, implement, and maintain an SMS if you hold a type certificate for a product and allow another person to use the type certificate to manufacture the same product under a production certificate. The term “production certificate” in § 5.15 includes a production certificate issued by the FAA under part 21 or a production certificate or equivalent authorization issued by a foreign civil aviation authority.

2.2.9.2 Implementation Strategies. Refer to paragraphs 2.2.7.2.1 through 2.2.7.2.6 for the steps to develop, implement, and maintain your SMS.

Notes: 1. If you have a licensing agreement per § 21.55 in place on May 28, 2024, your implementation plan must be submitted by November 28, 2024 (paragraph 2.2.7.2.2 ) and your SMS implementation must be completed by May 28, 2027 (paragraph 2.2.7.2.4 ).

2. If you enter into a licensing agreement per § 21.55 after May 28, 2024, your implementation plan must be submitted during the licensing agreement process (paragraph 2.2.7.2.2 ) and your SMS implementation must be completed 36 months after submission of your implementation plan (paragraph 2.2.7.2.4 ).

2.2.9.3 Scalability Examples. Not applicable.

2-10 04/26/24 AC 21-58 2.2.10 Organizational System Description.

§ 5.17 Organizational system description.

An organizational system description developed and maintained under this part must include a summary of the following information about the safety of the aviation products or services provided by the person: (a) The person’s aviation-related processes, procedures, and activities.

(b) The function and purpose of the aviation products or services.

(c) The operating environment.

(d) The personnel, equipment, and facilities necessary for operation.

2.2.10.1 Discussion. Section 5.17 provides requirements for the development of an organizational system description. The organizational system description summarizes the processes, procedures, activities, personnel, equipment, and facilities that impact the aviation safety of the products and services provided by the organization. This includes, but is not limited to activities, processes, and procedures for design and certification, production, and continued operational safety. An organizational system description defines the boundaries of where SMS is applied in an organization.

2.2.10.2 Implementation Strategies.

2.2.10.2.1 You must develop an organizational system description that includes a summary of information about the safety of the products and services provided [§§ 5.17(a) - (d)]. This summary must include your aviation- related processes, procedures, and activities; the function and purpose of your aviation products or services; the operating environment; and the personnel, equipment, and facilities necessary for operation.

2.2.10.2.2 Your organizational system description must be maintained [§ 5.17].

Maintained means that the organizational system description is updated when changes occur that impact the summary of information described in §§ 5.17(a) - (d).

2.2.10.2.3 The organizational system description for a part 21 type and production certificate holder typically consists of a set of descriptions of subsystems each of which contributes to the safety of the products and services provided. Type and production certificate holders typically have three sub-systems in their organizational system description: • Design and certification sub-system • Production sub-system • Continued operational safety sub-system 2-11 04/26/24 AC 21-58 Note 1: Activities, processes, or departments that do not impact aviation safety may be excluded from your organizational system description. For example, you may exclude processes that support other lines of business such as commercial bearings or automotive components from your organizational system description.

Note 2: Aviation-related processes, procedures, and activities related only to supplemental type certificates, technical standard order authorizations, and parts manufacturer approvals without any relation to those used for type certificate and production certificate activities may be excluded from your organizational system description.

Note 3: There is no requirement to develop new processes or procedures for the creation of the organizational system description.

2.2.10.2.4 Design and Certification Sub-System. This sub-system description summarizes the processes and activities used to design and obtain FAA certification of products. The objective of this sub-system is to produce a safe and compliant design for the product.

• Aviation-related processes, procedures, and activities: Include a summary of the key processes, procedures, and steps for: design, design reviews, requirements validation and verification, major / minor change classifications, minor change agreements, changed product rule requirements, ground and flight test, showing of compliance, and finding of compliance (include your organization designation authorization procedures, if applicable).

• Function and purpose of the aviation products or services provided: Include a summary of the products or services you provide along with their function and purpose.

• Operating environment: Include the key internal and external factors that influence the ability of the design and certification subsystem to design and certify safe and compliant products. This can include customers, suppliers, outsourcing design activities, program schedule constraints, budgetary constraints, and staffing constraints.

• Personnel, equipment, and facilities necessary for operation: Include design departments, test departments, facilities used for test, and departments used for showing and finding of compliance (include your organization designation authorization unit, if applicable), design tools (software, and hardware). The “personnel necessary for operation” should include position titles such as “Head of Design” rather than the individual names of personnel.

2.2.10.2.5 Production Sub-System. This sub-system description summarizes the processes and activities used to produce products. The objective of this system is to produce a conforming product that is in a condition for safe operation.

2-12 04/26/24 AC 21-58 • Aviation-related processes, procedures, and activities: Include a summary of the processes and procedures used for manufacturing, assembly, acceptance test, non-conforming material control and disposition, inspection, material review board, and quality of products.

• Function and purpose of the aviation products or services provided: Include a summary of the products or services you provide along with their function and purpose.

• Operating environment: Include the key internal and external factors that influence the ability of the production subsystem to produce conforming and safe products. This can include supplier deliveries, conducting production activities in various locations, manufacturing schedules, budgetary constraints, and staffing constraints.

• Personnel, equipment, and facilities necessary for operation: Include the following departments: manufacturing, assembly, test, inspection.

The “personnel necessary for operation” should include position titles such as “Head of Manufacturing” rather than the individual names of personnel.

2.2.10.2.6 Continued Operational Safety Sub-System. This sub-system description summarizes the processes and activities used to maintain the continued operational safety of the product. The objective of this system is to assure the safe operation of the product in service.

• Aviation-related processes, procedures, and activities: Include the processes and procedures used for training and manuals, maintenance requirements, customer support, in-service monitoring, risk assessment, and corrective action.

• Function and purpose of the aviation products or services provided: Include a summary of the products or services you provide along with their function and purpose.

• Operating environment: Include the key internal and external factors that influence the ability of the continued operational safety sub- system to assure the safe operation of the products, articles, and services provided. This can include customer feedback, risk assessment and corrective action schedules, budgetary constraints, and staffing constraints.

• Personnel, equipment, and facilities necessary for operation: Include field service departments, safety departments, and tools used for risk assessment and corrective action. The “personnel necessary for operation” should include position titles such as “Head of Safety” rather than the individual names of personnel.

2-13 04/26/24 AC 21-58 2.2.10.3 Scalability Examples. The organizational system description requires a summary of information allowing flexibility to be scaled to the size and complexity of an organization.

2.2.11 Implementation Plan.

§ 5.19 Implementation plan.

(a) An implementation plan filed under this part must be based on the organizational system description as defined in § 5.17 and describe the means of compliance (including, but not limited to, new or existing policies, processes, or procedures) used to meet the requirements of this part.

(b) A person required to submit an implementation plan under this part must make available to the Administrator, upon request, all necessary information and data that demonstrates that the SMS has been or will be implemented in accordance with the implementation plan.

2.2.11.1 Discussion. Section 5.19 provides requirements for the SMS implementation plan.

2.2.11.2 Implementation Strategies .

2.2.11.2.1 The implementation plan must be based on your organizational system description, and also must provide the means of compliance that you will use to meet the applicable requirements of part 5 [§ 5.19(a)]. For each section and subsection, provide a specific reference to a new, planned, or existing policy, process, or procedure when required by part 5. For the part 5 sections that do not specifically require a process or procedure, provide a brief narrative description that describes how you will comply with the section. Your implementation plan should also provide schedule dates summarizing when each planned activity will be completed. Note that the schedule must allow sufficient time for you to implement your SMS by the applicable date in § 5.11(d), § 5.13(b)(4), § 5.15(b)(4), and § 5.15(c)(4).

2.2.11.2.2 Table 2-1 provides an example format, including planned and completed SMS development activities that you may use to present the list of the specific regulations and subparts, including all subparagraphs, the description of the means of compliance, and planned completion dates. A template is available to assist in the development of your implementation plan. The implementation plan template may be requested from the following email address: Program Management Section (AIR-8X7) Email: 9-AVS-AIR-SMS@faa.gov 2-14 04/26/24 AC 21-58 2.2.11.2.3 You must, upon FAA request, make available information and data that demonstrates your SMS has been or will be implemented in accordance with your implementation plan [§ 5.19(b)].

Note: The FAA will request that you make SMS information and data available as we conduct oversight of your SMS. This request will follow completion of your SMS implementation and consist of an SMS verification and an SMS evaluation. The SMS verification confirms that you have developed an organizational system description and the policies, processes, and procedures required by part 5. The SMS evaluation confirms that your SMS operates in compliance with part 5.

2.2.11.3 Scalability Examples. Not applicable.

2-15 04/26/24 AC 21-58 Table 2-1. Implementation Plan Example Section Planned Requirement Reference(s) Completion Complete Sub- Para.

Date Para.

Subpart B - Safety Policy § 5.21 Safety policy.

Any person required to have an SMS under this part must have a safety policy that includes at least the following: The person’s safety Safety Policy, (1) X objectives. Page 1.

Safety Policy The person’s commitment Page 4.

(2) to fulfill the safety X Introductory objectives.

Message A clear statement about the Safety Policy provision of the necessary Page 4.

(3) resources for the X Introductory implementation of the Message SMS.

A safety reporting policy Employee Safety that defines requirements (4) Reporting Mar-2025 for employee reporting of Procedure safety hazards or issues.

(a) A policy that defines unacceptable behavior and Employee (5) Feb-2025 conditions for disciplinary Expectations Policy action.

An emergency response plan that provides for the safe transition from normal Not required for part 21 type and production (6) to emergency operations in certificate holders.

accordance with the requirements of § 5.27.

A code of ethics that is applicable to all employees, including management HR Manual (7) personnel and officers, X Chapter 1, page 4 which clarifies that safety is the organization’s highest priority.

2-16 04/26/24 AC 21-58 2.3 Subpart B: Safety Policy.

2.3.1 Safety Policy.

§ 5.21 Safety policy.

(a) Any person required to have an SMS under this part must have a safety policy that includes at least the following: (1) The person’s safety objectives.

(2) The person’s commitment to fulfill the safety objectives.

(3) A clear statement about the provision of the necessary resources for the implementation of the SMS.

(4) A safety reporting policy that defines requirements for employee reporting of safety hazards or issues.

(5) A policy that defines unacceptable behavior and conditions for disciplinary action.

(6) An emergency response plan that provides for the safe transition from normal to emergency operations in accordance with the requirements of § 5.27.

(7) A code of ethics that is applicable to all employees, including management personnel and officers, which clarifies that safety is the organization’s highest priority.

(b) The safety policy must be signed by the accountable executive described in § 5.25.

(c) The safety policy must be documented and communicated throughout the person’s organization.

(d) The safety policy must be regularly reviewed by the accountable executive to ensure it remains relevant and appropriate to the person.

2.3.1.1 Discussion. Section 5.21 provides the requirements for the safety policy.

2.3.1.2 Implementation Strategies.

2.3.1.2.1 The safety policy must include safety objectives [§ 5.21(a)(1)]. When developing safety objectives, it is important to ensure they are measurable and not just inspirational statements such as “We will strive to be the best” or “We will maintain a zero-accident rate” etc. Safety objectives are measured using safety performance indicators and need to be tracked by the safety assurance component of your SMS to ensure your objectives are being met. A reference to the safety objectives may also be provided in the safety policy.

2-17 04/26/24 AC 21-58 Examples of safety objectives include: • Milestones for implementation of safety-related programs or initiatives.

• Time to complete investigations of employee hazard or incident reports.

• Tracking of potential aviation-related safety issues including root cause and corrective action completion.

2.3.1.2.2 The safety policy must include a commitment to fulfill the safety objectives [§ 5.21(a)(2)]. This can be achieved by providing a statement in the safety policy that the safety objectives will be monitored, measured, and tracked to ensure they are met.

2.3.1.2.3 The safety policy must include a clear statement about the provision of the necessary resources for the implementation of the SMS [§ 5.21(a)(3)].

This can be achieved by providing a statement in the safety policy committing to provide the resources necessary to implement the SMS.

2.3.1.2.4 The safety policy must include requirements for employee reporting of safety hazards or issues [§ 5.21(a)(4)]. This can be achieved by stating that the organization has established a confidential employee reporting system for all employees to report hazards, accidents, incidents, and safety issues without fear of reprisal. A reference to the reporting procedures may also be provided in the safety policy.

2.3.1.2.5 The safety policy must include a policy that defines unacceptable behavior and conditions for disciplinary action [§ 5.21(a)(5)]. This can be achieved by providing a statement in the safety policy regarding unacceptable behavior and disciplinary actions. A reference to the unacceptable behavior and disciplinary action policy may also be provided in the safety policy.

2.3.1.2.6 The safety policy is not required to provide requirements for emergency response plans [§ 5.21(a)(6)]. The FAA has determined that emergency response plans are not necessary for part 21 type and production certificate holders (refer to paragraph 2.3.4 ).

2-18 04/26/24 AC 21-58 2.3.1.2.7 The safety policy must include a code of ethics which clarifies that safety is the organization’s highest priority [§ 5.21(a)(7)]. This can be achieved by providing a statement in the safety policy that the top priority of the organization is the safety of the products and services provided.

2.3.1.2.8 The safety policy must be signed by the organization’s accountable executive [§ 5.21(b)].

2.3.1.2.9 The safety policy must be documented and communicated throughout the organization [§ 5.21(c)]. Documented means that the safety policy is recorded and retrievable. Communicated through the organization means that all employees have been made aware of, and provided access to, the safety policy.

2.3.1.2.10 The accountable executive must regularly review the safety policy to ensure it remains relevant to the organization [§ 5.21(d)]. Regularly reviewed means that the accountable executive reviews the safety policy on a periodic basis, for example annually. Note that a key part of the accountable executive review is to ensure that the safety objectives continue to be relevant to the organization.

2.3.1.2.11 A sample safety policy meeting the requirements in § 5.21 can be found in Appendix A, Guidance For Developing A Safety Policy Guidance .

2.3.1.3 Scalability Examples. For organizations with lower overall levels of complexity, the owner or most senior manager (i.e., the accountable executive) may personally develop the safety policy. The safety policy can be a simple, single-page written document signed by the accountable executive and may be posted in the organization’s work areas or included in organizational briefings or in training. Organizations with higher levels of complexity may require the accountable executive or other senior managers and technical staff to perform this process. While the regulations only require the accountable executive to sign the safety policy, members of senior management may also sign the safety policy, in addition to the accountable executive. These organizations may disseminate their policy using a variety of resources such as organizational websites, intranets, email, or existing indoctrination and recurrent training.

2-19 04/26/24 AC 21-58 2.3.2 Safety Accountability and Authority.

§ 5.23 Safety accountability and authority.

(a) Any person required to have an SMS under this part must define in its safety policy the accountability for safety of the following individuals: (1) Accountable executive, as described in § 5.25.

(2) All members of management in regard to developing, implementing, and maintaining SMS processes within their area of responsibility, including, but not limited to: (i) Hazard identification and safety risk assessment.

(ii) Assuring the effectiveness of safety risk controls.

(iii) Promoting safety as required in subpart E of this part.

(iv) Advising the accountable executive on the performance of the SMS and on any need for improvement.

(3) Employees relative to the person’s safety performance.

(b) The person must identify the levels of management with the authority to make decisions regarding safety risk acceptance.

2.3.2.1 Discussion. Section 5.23 provides requirements for employee accountability for safety and identification of the levels of management with authority to make safety risk acceptance decisions.

2.3.2.2 Implementation Strategies.

2.3.2.2.1 The safety policy must define the accountability for safety of the accountable executive [5.23(a)(1)]. The accountable executive has the ultimate responsibility for safety management within the organization. The specific duties of the accountable executive are discussed in more detail in paragraph 2.3.3 below.

2.3.2.2.2 The safety policy must define the accountability for safety of all members of management [§ 5.23(a)(2)]. Managers with the support of SMS specialists are responsible for identifying hazards, conducting risk assessments, ensuring the effectiveness of safety risk controls, promoting safety, and advising the accountable executive of safety performance of the SMS. These personnel have the technical expertise and are responsible for implementation and operation of risk controls (often in the form of operational procedures, specified tools, training, communication, etc.).

Members of management may not be in a regulatory required position and might not appear on an organizational chart.

2-20 04/26/24 AC 21-58 2.3.2.2.3 The safety policy must define the accountability of safety for all employees relative to the organization’s safety performance in the safety policy [§ 5.23(a)(3)]. All employees should be aware of the organization’s safety policies, as well as the processes, procedures, and tools relevant to their responsibilities.

2.3.2.2.4 You must identify the levels of management with authority to make decisions regarding safety risk acceptance [§ 5.23(b)]. Table 2-2 provides an example safety risk acceptance authority matrix.

Table 2-2. Safety Risk Acceptance Authority Example Safety Risk Level Safety Risk Acceptance Authority High Risk Accountable Executive Medium Risk Safety Committee, Department Manager Low Risk Process Owner 2.3.2.3 Scalability Examples. The method for meeting these requirements is not expected to vary greatly between different organizations. Rather, the numbers and relationships of personnel will be unique to your organization. In SMS documentation, the identified managers and process owners may be indicated by position title rather than name.

2-21 04/26/24 AC 21-58 2.3.3 Designation and Responsibilities of Required Safety Management Personnel.

§ 5.25 Designation and responsibilities of required safety management personnel.

(a) Designation of the accountable executive. Any person required to have an SMS under this part must identify an accountable executive who, irrespective of other functions, satisfies the following: (1) Is the final authority over operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.

(2) Controls the financial resources required for the operations to be conducted under the person’s certificate(s) or Letter(s) of Authorization.

(3) Controls the human resources required for the operations authorized to be conducted under the person’s certificate(s) or Letter(s) of Authorization.

(4) Retains ultimate responsibility for the safety performance of the operations conducted under the person’s certificate(s) or Letter(s) of Authorization.

(b) Responsibilities of the accountable executive. The accountable executive must accomplish the following: (1) Ensure that the SMS is properly implemented and is performing across all pertinent areas.

(2) Develop and sign the safety policy.

(3) Communicate the safety policy throughout the person’s organization.

(4) Regularly review the safety policy to ensure it remains relevant and appropriate to the person.

(5) Regularly review the safety performance and direct actions necessary to address substandard safety performance in accordance with § 5.75.

(c) Designation of management personnel. The accountable executive must designate sufficient management personnel who, on behalf of the accountable executive, are responsible for the following: (1) Coordinate implementation, maintenance, and integration of the SMS throughout the person’s organization.

(2) Facilitate hazard identification and safety risk analysis.

(3) Monitor the effectiveness of safety risk controls.

(4) Ensure safety promotion throughout the person’s organization as required in subpart E of this part.

(5) Regularly report to the accountable executive on the performance of the SMS and on any need for improvement.

2-22 04/26/24 AC 21-58 2.3.3.1 Discussion. Section 5.25 provides requirements to designate an accountable executive and defines the accountable executive’s responsibilities. This section also requires the accountable executive to designate management personnel with responsibility for operation of the SMS.

2.3.3.2 Implementation Strategies.

2.3.3.2.1 You must designate an accountable executive who holds the ultimate decision-making authority over the organization’s operations [§ 5.25(a)].

This person is responsible for planning, organizing, directing, and controlling the personnel, organizational structure, financial, and other resources necessary for safe operations. A flowchart outlining a process for designating an accountable executive is available in Appendix B, Identifying the Accountable Executive .

2.3.3.2.2 The accountable executive must accomplish the responsibilities in § 5.25(b). These responsibilities include ensuring that the SMS is properly implemented and is performing across the organization; developing and signing the safety policy; communicating the safety policy throughout the organization; regularly reviewing the safety policy to ensure it remains relevant and appropriate; and regularly reviewing the safety performance and directing actions to address substandard safety performance.

2.3.3.2.3 The accountable executive must designate sufficient management personnel that are responsible for operation of the SMS [§ 5.25(c)]. These responsibilities include coordination, implementation, maintenance, and integration of the SMS throughout the organization; facilitating hazard identification and safety risk analysis; monitoring the effectiveness of safety risk controls; promoting safety throughout the organization; and reporting to the accountable executive on the performance of the SMS and on any need for improvement.

2.3.3.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the accountable executive may personally participate in or directly supervise operational processes. This individual may serve in multiple positions within the organization. For organizations on the higher end of the spectrum of complexity, the accountable executive is responsible for ensuring that management personnel are clearly designated for ensuring the safety of operational and safety management processes.

The accountable executive may be identified by position title.

2-23 04/26/24 AC 21-58 2.3.4 Coordination of Emergency Response Planning.

§ 5.27 Coordination of emergency response planning.

Where emergency response procedures are necessary, any person required to have an SMS under this part must develop, and the accountable executive must approve as part of the safety policy, an emergency response plan that addresses at least the following: (a) Delegation of emergency authority throughout the person’s organization.

(b) Assignment of employee responsibilities during the emergency.

(c) Coordination of the emergency response plans with the emergency response plans of other organizations it must interface with during the provision of its services.

2.3.4.1 Discussion. Section 5.27 requires coordination of emergency response planning “where emergency response procedures are necessary.” Emergency response plans are for accidents and incidents in aircraft operations and other aviation-related emergencies. As a part 21 certificate holder, you may be involved in the investigation of aircraft accidents or incidents but are likely not involved in the emergency response to the aircraft accident or incident. For this reason, the FAA has determined that emergency response planning is not necessary for part 21 certificate holders.

2.3.4.2 Implementation Strategies. Emergency response planning is not necessary for part 21 certificate holders.

2.3.4.3 Scalability Examples. Not applicable.

2-24 04/26/24 AC 21-58 2.4 Subpart C: Safety Risk Management (SRM).

2.4.1 Applicability: Requirements to Apply Safety Risk Management (SRM).

§ 5.51 Applicability.

Any person required to have an SMS under this part must apply safety risk management to the following: (a) Implementation of new systems.

(b) Revision of existing systems.

(c) Development of operational procedures.

(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.

2.4.1.1 Discussion. Section 5.51 provides the triggers that require application of safety risk management (SRM). The SRM process is triggered when you are considering new systems or revisions to existing systems as identified in your organizational system description. The SRM process is also triggered when developing operational procedures or when hazards or ineffective risk controls are identified through the safety assurance processes.

2.4.1.2 Implementation Strategies.

2.4.1.2.1 You must apply SRM if you decide to implement any new system that directly impacts the aviation safety of the products or services you provide [§ 5.51(a)]. For example, SRM is required if the organization decides to develop and implement a new design system.

2.4.1.2.2 You must apply SRM when an existing aviation safety-related system is being revised [§ 5.51(b)]. For example, SRM is required if the organization revises their production system.

2.4.1.2.3 You must apply SRM when procedures are being developed that directly impact the aviation safety of the products and services you provide [§ 5.51(c)]. Examples requiring SRM include development of procedures for design, certification, manufacturing, and continued operational safety.

2.4.1.2.4 You must apply SRM when hazards or ineffective risk controls are identified through your safety assurance processes [§ 5.51(d)]. Examples requiring SRM include product hazards (e.g., a quality escape) or ineffective risk controls in a system (e.g., a design and certification sub- system procedure that caused a design error).

2-25 04/26/24 AC 21-58 Note: Two levels of SRM should be conducted when product hazards are identified through safety assurance. First, conduct SRM at the product level to determine if you need additional risk controls for the product. In addition, conduct SRM at the system level to determine if you need additional risk controls to prevent similar hazards for future products. For example, if you identify a design error through safety performance monitoring, you first analyze, assess, and mitigate, if necessary, the risk of the design error on the fielded product. Next, you analyze your design and certification system to determine if you need additional risk controls to prevent similar design errors on future products.

2.4.1.3 Scalability Examples. Not applicable.

2.4.2 System Analysis and Hazard Identification.

§ 5.53 System analysis and hazard identification.

(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).

(b) In conducting the system analysis, the following information must be considered: (1) Function and purpose of the system.

(2) The system's operating environment.

(3) An outline of the system's processes and procedures.

(4) The personnel, equipment, and facilities necessary for operation of the system.

(5) The interfaces of the system.

(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.

2.4.2.1 Discussion. Section 5.53 provides the requirements for system analysis and hazard identification.

2.4.2.2 Implementation Strategies.

2.4.2.2.1 You must analyze the systems in § 5.51 to identify hazards [§ 5.53(a)].

Completing a system analysis means that you have defined the functions and interactions among the hardware, software, people, and environment that make up the system in sufficient detail to identify and analyze hazards. At a minimum, you must consider the following when documenting the system analysis: the function and purpose of the system; 2-26 04/26/24 AC 21-58 the system's operating environment; an outline of the system's processes and procedures; the personnel, equipment, and facilities necessary for operation of the system; and the interfaces of the system [§ 5.53(b)].

2.4.2.2.2 You must develop processes to identify hazards within the context of the system analysis [§ 5.53(c)]. The hazard identification process should provide the steps to determine what could go wrong with your systems or processes that could cause or contribute an incident or aircraft accident.

Outputs from the hazard identification process should include a list of each hazard along with a short description.

2.4.2.2.3 You must maintain the hazard identification processes [§ 5.53(c)].

Maintaining these processes means that they are accurate and kept current whenever they are changed.

2.4.2.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, system analysis and hazard identification could be performed by the owner/manager and/or another assigned employee(s).

An analysis could consist of a discussion between the engineering and production managers and other individuals designated by them. For organizations on the higher end of the spectrum of complexity, system analysis and hazard identification might be performed at multiple organizational levels (e.g., corporate, division, or department levels) and facilitated by the safety department/division or its equivalent. The organization might have standing committees of subject matter experts (SMEs) and stakeholders participating at various levels.

2.4.3 Safety Risk Analysis.

§ 5.55 Safety risk assessment and control.

Any person required to have an SMS under this part must: (a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).

2.4.3.1 Discussion. Section 5.55(a) provides requirements to develop and maintain processes to analyze safety risk for identified hazards.

2.4.3.2 Implementation Strategies.

2.4.3.2.1 You must develop processes to analyze safety risk for each hazard identified in § 5.53(c) [§ 5.55(a)]. Risk analysis should include a determination of the severity and likelihood of a hazard’s potential outcomes. For each identified hazard, determine the severity of the injury or damage that may result from the aircraft accident or incident and then 2-27 04/26/24 AC 21-58 determine the likelihood of occurrence. It is important to remember that the severity and likelihood do not refer to the hazard but of an aircraft accident or incident that could be caused by the hazard. The risk analysis process should include criteria for severity and likelihood that are appropriate for your organization. For example, severity levels are sometimes defined as minimal, minor, major, hazardous, and catastrophic.

Likewise, likelihood levels are sometimes defined as frequent, probable, remote, extremely remote, and extremely improbable.

2.4.3.2.2 You should consider the basis for the estimates of severity and likelihood when conducting the risk analysis. Risk analyses are often based on expertise and expert judgment, but you should also use data from your organization’s own experience or those of others in the industry, where available. The type of consequence (aircraft accident or incident) that is envisioned normally drives the estimate of severity. Severity estimates should be based on reasonable expert judgment by applying a disciplined analysis. Review of accident statistics, failure data, error data, or equipment reliability data may help in determining likelihood.

2.4.3.2.3 You must maintain the safety risk analysis processes [§ 5.55(a)].

Maintaining these processes means that they are accurate and kept current whenever they are changed.

2.4.3.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk analysis could be performed by the owner/manager and/or another employee(s). It might be performed in conjunction with system description and analysis, hazard identification, risk assessment, and risk control using the same individual/group. Organizations on the higher end of the spectrum of complexity might perform risk analysis at multiple organizational levels (e.g., the corporate, division, or department levels) and be facilitated by the safety department or specially trained analytical personnel shared with other departments. The organization might have standing committees of SMEs and stakeholders participating at various levels.

2.4.4 Safety Risk Assessment.

§ 5.55 Safety risk assessment and control.

Any person required to have an SMS under this part must: (b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.

2.4.4.1 Discussion. Section 5.55(b) provides requirements to define a risk assessment process for the determination of acceptable safety risk.

2-28 04/26/24 AC 21-58 2.4.4.2 Implementation Strategies.

2.4.4.2.1 You must define a risk assessment process to determine whether risk is acceptable [§ 5.55(b)]. A risk matrix is a common tool used in risk assessment decisions. A risk matrix provides you with a way to integrate the effect of the severity and likelihood of a hazard’s potential outcomes, enabling you to assess risks, compare potential effectiveness of proposed risk controls, and prioritize risks where multiple risks are present.

Table 2-3 depicts a sample risk matrix.

Table 2-3. Sample Risk Matrix Risk Severity Risk Likelihood Minimal Minor Major Hazardous Catastrophic Frequent low medium high high high Probable low medium high high high Remote low medium medium high high Extremely low low medium medium high Remote Extremely low low low medium medium Improbable 2.4.4.2.2 Table 2-3 categorizes risk as high, medium, or low based on severity and likelihood. Your risk assessment process should define the risk levels you will consider acceptable and the risk levels that require mitigation and risk controls. For example, you may determine that low risks are acceptable without mitigation and do not require any risk controls. However, you may also determine that medium and high risks are unacceptable without additional risk controls. These risk acceptability determinations should be clearly defined in your risk assessment process and procedures. The risk assessment process should also involve the levels of management with the authority to make risk acceptance decisions (refer to 2.3.2.2.4 ).

2.4.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, risk assessment could be performed by the owner/manager and/or other employee(s) making the risk decisions. Risk acceptance could also be conducted by this individual/group. Organizations on the higher end of the spectrum of complexity might need to coordinate SRM across the divisional and geographic units of the organization to assure integrated decision making and communication. Decisions involving multiple systems may require joint decision making among departments or managers responsible for those systems. Many organizations have standing committees made up of senior managers, who are the decision makers, supported by working groups of technical personnel. For example, 2-29 04/26/24 AC 21-58 the accountable executive could make organization-level decisions and department managers could make the decisions for their operations. A risk matrix may be useful to determine who makes the risk decision, whether the risk is acceptable, or to determine the priority for mitigating risk.

2.4.5 Safety Risk Control.

§ 5.55 Safety risk assessment and control.

Any person required to have an SMS under this part must: (c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.

(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.

2.4.5.1 Discussion. Section 5.55(c) provides requirements to develop risk controls for unacceptable risks identified in the risk assessment process. Section 5.55(d) provides requirements to evaluate whether the risk will be acceptable before a safety risk control is applied.

2.4.5.2 Implementation Strategies.

2.4.5.2.1 You must develop a process to develop risk controls for risks that have been determined to be unacceptable and require mitigation [§ 5.55(c)].

You should use the knowledge gained from the previous system analysis and risk analysis steps to develop the risk controls. Risk controls include anything that would lessen the likelihood or severity of a potential accident or incident. Examples of risk controls include new processes, equipment, training, new supervisory controls, new equipment or hardware, new software, new information technology controls, changes to staffing arrangements, or any of a number of other system changes.

2.4.5.2.2 You must evaluate the system with the proposed risk control(s) in place to determine if the level of risk is acceptable before the risk control is implemented [§ 5.55(d)]. The first step in this evaluation involves completion of the system analysis, hazard identification, and risk analysis to determine the risk with the proposed risk control in place. This risk is commonly referred to as “substitute risk.” The next step is to complete an assessment to determine if the substitute risk is acceptable. The risk control may be implemented if the substitute risk is determined to be acceptable. If the substitute risk is not acceptable, additional risk control(s) should be developed and the risk control evaluation in this paragraph should be repeated until the substitute risk is acceptable.

2-30 04/26/24 AC 21-58 2.4.5.2.3 You must maintain the safety risk control development processes [§ 5.55(c)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.

2.4.5.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the risk control process could be a documented activity performed by the owner/manager and/or other employee(s) developing and evaluating the risk controls. It might be performed in conjunction with system analysis, hazard identification, risk analysis, and risk assessment, and using the same individual/group. For organizations on the higher end of the spectrum of complexity, the risk control process could be performed by a member of management or SMS management representatives with a small workgroup of organizational SMEs and stakeholders to develop the risk controls. There might need to be interdepartmental coordination before the controls are implemented. After the control is approved, it may be implemented and documented through the organization’s publication system. Implementation of risk controls may include distribution of manual revisions and training of organization personnel.

2.4.6 Notification of Hazards to Interfacing Persons.

§ 5.57 Notification of hazards to interfacing persons.

If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person’s knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder’s aviation-related products and services.

2.4.6.1 Discussion. Section 5.57 provides requirements for providing hazard notifications to interfacing persons.

2.4.6.2 Implementation Strategies.

2.4.6.2.1 You must provide hazard notifications to interfacing persons, that to the best of your knowledge, could address a hazard or mitigate the hazard’s risk [§ 5.57]. Section 5.57 limits hazard notification to only those interfacing persons that contribute to the aviation safety of the products or services you provide.

Note: A hazard is defined as “a condition or an object that could foreseeably cause or contribute to an incident or aircraft accident.” Reporting under § 5.57 should only occur for issues you have identified as hazards and the report should only be provided to the interfacing person you believe can best address the hazard or mitigate its risk. Section 5.57 2-31 04/26/24 AC 21-58 does not require reporting of issues that are not hazards (e.g., commercial issues between companies). The intent of § 5.57 is to facilitate timely sharing of safety information.

2.4.6.2.2 Figure 2-1 provides a process that may be used for hazard notification.

Details for each step in this process follow: Start: Complete the following steps for each hazard that is identified through your SRM processes.

Step 1: Is there an external organization (interfacing person) that, to the best of your knowledge, could address the hazard or mitigate its risk? If the answer is “yes”, go to step 2. If the answer is “no,” notification is not required for this hazard.

Note: This decision may occur at any time while the hazard is being processed through the SRM steps (§§ 5.51, 5.53, 5.55).

Step 2: Does the external organization (interfacing person) directly contribute to the safety of the aviation-related products and services you provide? If the answer is “yes,” go to step 3. If the answer is “no,” notification is not required for this hazard.

Note: For design and manufacturing organizations, the external organization (interfacing person) will typically be suppliers of parts or engineering services because these suppliers contributed to the safety of the products or services you provide. Competitors or customers will not typically be an external organization (interfacing person) requiring a hazard notification because they do not contribute to the safety of the products or services you provide.

Step 3: Provide a notification of the hazard to the external organization.

Note: Only provide information about the hazard to the external organization. Confidential or proprietary information may be removed from the hazard notification (e.g., how the hazard was identified, or risk controls put in place to address the hazard). You may use a non-disclosure agreement or other contract if you determine that the hazard notification can’t be provided without disclosing confidential or proprietary information.

2-32 04/26/24 AC 21-58 Figure 2-1. Hazard Notification Process 2.4.6.3 Hazard Notification Example.

2.4.6.3.1 The following example demonstrates how hazard notification in accordance with § 5.57 should occur between an airline operator with an SMS, an aircraft manufacturer with an SMS, and a technical standard order article manufacturer that is not required to have an SMS.

2-33 04/26/24 AC 21-58 2.4.6.3.2 An airline operator received an employee report from a pilot stating that the aircraft flight management system deviated from the expected approach at a particular airport. The flight crew noticed the deviation and corrected the flight path for a safe landing. The operator’s SMS classified this employee report as a hazard because the airport is surrounded by high elevation terrain. Although this incident occurred during daytime and in visual meteorological conditions, management determined that if the same issue occurred during a night landing or instrument meteorological conditions, the aircraft could be turned toward terrain without detection by the flight crew, foreseeably resulting in an accident.

2.4.6.3.3 The operator followed its hazard notification process and decided that the aircraft manufacturer was best person to mitigate the risk (step 1). The operator also decided that the aircraft manufacturer contributed to the safety of the services provided by the operator (step 2). The operator provided the following hazard notification to the aircraft manufacturer (step 3): “Aircraft model Alpha-1 (serial number 225) performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.” 2.4.6.3.4 The aircraft manufacturer received the hazard report and began an investigation of the issue per § 5.71(a)(8). The aircraft manufacturer followed its hazard notification process and decided that the flight management system supplier was best person to mitigate the risk (step 1).

The aircraft manufacturer also decided that the flight management system supplier contributed to the safety of the aircraft (step 2). The aircraft manufacturer provided the following hazard notification to the flight management system supplier (step 3): “Aircraft with flight management system model YZX performed a wrong turn at waypoint YAYGO on XYXYX TWO ARRIVAL (RNAV) approach to airport KXYZ.” 2.4.6.3.5 No further action under § 5.57 is required by either the operator or aircraft manufacturer. Both organizations met the § 5.57 hazard notification requirements in this example.

2-34 04/26/24 AC 21-58 2.5 Subpart D: Safety Assurance.

2.5.1 Monitoring of Operational Processes.

§ 5.71 Safety performance monitoring and measurement.

(a) Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following: (1) Monitoring of operational processes.

(2) Monitoring of the operational environment to detect changes.

(3) Auditing of operational processes and systems.

(4) Evaluations of the SMS and operational processes and systems.

(5) Investigations of incidents and accidents.

(6) Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part.

(7) A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting.

(8) Investigations of hazard notifications that have been received from external sources.

2.5.1.1 Discussion. Section 5.71(a) provides requirements for the acquisition of data to monitor the safety performance of the organization.

2.5.1.2 Implementation Strategies.

2.5.1.2.1 You must monitor the organization’s operational processes [§ 5.71(a)(1)].

Monitoring operational processes is what managers/process owners do on a day-to-day basis (e.g., direct supervision of employee activities, monitoring of reports from in-service product users, conducting design reviews to monitor the design process, monitoring of results from manufacturing or acceptance testing). Monitoring also involves reviewing data that is collected for operational purposes to look for anything of safety significance. This may include monitoring aviation safety-related products and services from outside sources. For example, if you choose to outsource the design of a critical system to a supplier, you may choose to co-locate some engineers at the supplier facility to monitor the design progress and attend design reviews.

2-35 04/26/24 AC 21-58 2.5.1.2.2 You must monitor the organization’s operational environment to detect changes [§ 5.71(a)(2)]. Monitoring of the operational environment involves practices that are similar to those of monitoring processes. The context for monitoring the environment of a system is developed from the system analysis that is conducted under SRM. Once the scope of the environment is defined under SRM, you must monitor the environment to assess impacts on the safety of your organization’s products or services.

For example, outsourcing a critical design activity to a supplier may require you to increase oversight to ensure safety critical design activities continue to be properly performed.

2.5.1.2.3 You must conduct audits of the organization’s processes and systems [§ 5.71(a)(3)]. Audits are a means of collecting data to confirm whether or not actual practices are being followed within your organization. Audits should typically involve the management and process owners responsible for the system(s) being audited. Procedures for auditing should describe your audit process, criteria, scope, frequency, method for selecting auditors, and methods of documentation and recordkeeping. Audit planning should take into account the safety criticality of the processes to be audited and the results of previous audits.

2.5.1.2.4 You must conduct evaluations of the SMS and the organization’s processes and systems [§ 5.71(a)(4)]. An evaluation is typically an independent review of your organization’s processes, procedures, and systems. An evaluation is an internal oversight tool that provides your accountable executive with a snapshot of the safety performance of your organization’s processes and systems, as well as your organization’s SMS processes. Conducting evaluations at planned intervals will help your organization’s management determine if your organization’s safety management methods and practices are meeting the safety objectives and expectations set out in your safety policy. Your evaluation planning should take into account the safety criticality of your processes being evaluated and your results from previous evaluations. The scope, content, and frequency of evaluations should be based on your need for information to assess the health of your processes and your SMS.

2.5.1.2.5 You must conduct investigations of incidents and accidents involving the organization’s products and services [§ 5.71(a)(5)]. You should treat investigations of aviation-related incidents and accidents as an opportunity for organization learning to prevent a repeat of errors and to change your organizational processes so that mistakes do not recur. Your investigations should focus on what went wrong, rather than who caused the error, and emphasize improvement of safety performance. You should include investigation data, if available, from outside sources such as FAA or National Transportation Safety Board (NTSB) investigations and your organization may, where appropriate, participate as a party to official 2-36 04/26/24 AC 21-58 investigations. Note that investigations of incidents and accidents not directly related to aviation are not covered by this provision.

2.5.1.2.6 You must conduct investigations of reports regarding potential non- compliance with regulatory standards or other safety risk controls [§ 5.71(a)(6)]. This subject is very similar to the one described above in that the focus of your investigation should reveal information that, when utilized correctly, will identify hazards related to non-compliances. It is not as important to identify “who did it” as it is to learn why it happened.

Within this process, it is important to distinguish between error and intentional/willful noncompliant actions. You should investigate reports regarding potential noncompliance with regulatory standards or of inadequate safety risk controls established through the SRM process.

2.5.1.2.7 You must develop a confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, and incidents, and propose solutions and safety improvements [§ 5.71(a)(7)].

Employees should be encouraged to report safety issues and not fear reprisal from management as long as the issue was not either deliberately caused or created through gross negligence. Policies that assure employees of fair treatment and a non-reprisal reporting policy which establishes clear standards of behavior are essential parts of your reporting process.

Another aspect of your confidential reporting system is that the submitter’s identity is protected to the extent that is practicable. Therefore, you should define methods for employee reporting and de-identification of sources without losing essential information.

2.5.1.2.8 You must conduct investigations of hazard notifications that have been received from external sources [§ 5.71(a)(8)]. When an aviation organization receives notification of a hazard from an external source, they are required to evaluate the hazard utilizing the same safety assurance processes as they would if they received a confidential employee report.

The hazard should be evaluated using the SRM processes and if the aviation organization determines the hazard would best be addressed by an external organization, they must notify that organization utilizing their processes in §5.57.

2.5.1.2.9 You must maintain the data acquisition processes to monitor the safety performance of the organization [§ 5.71]. Maintain means that these processes are accurate and kept current whenever they are changed.

2-37 04/26/24 AC 21-58 2.5.1.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, most of the data/information-gathering for monitoring of operational processes will likely occur as a normal business process by the management personnel who are directly involved in the organization’s day-to-day activities. For example, regularly reviewing in-service reports from customers is a form of monitoring and could be conducted during the normal course of duties. For organizations on the higher end of the spectrum of complexity, monitoring may involve multiple levels of management, safety professionals, functional area managers, trained auditors/analysts, and teams/groups of line managers. This may include review of customer reports from field service departments, monitoring of safety critical manufacturing processes, and monitoring of design process adherence.

2.5.2 Analysis of Data.

§ 5.71 Safety performance monitoring and measurement.

(b) Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services.

2.5.2.1 Discussion. Section 5.71(b) provides requirements for the analysis of safety data.

2.5.2.1.1 Implementation Strategies.

2.5.2.1.2 You must develop processes that analyze the data acquired in § 5.71(a) along with any other relevant data with respect to the organization’s operations, products, and services [§ 5.71(b)]. Analysis involves examining the data acquired in order to make inferences about the safety performance of operational systems and the SMS. It is common for organizations to treat each employee report, audit finding, or investigation in isolation; however, system problems may not be seen if data points are examined in isolation. You should also look across individual reports and among various data sources for patterns or trends as you are conducting your analysis processes. You can record the outputs from data analysis in a simple recording medium such as a notebook, paper files, common desktop software, or specialized systems.

2.5.2.1.3 You must maintain the data analysis processes [§ 5.71(b)]. Maintaining these processes means that they are accurate and kept current whenever they are changed.

2-38 04/26/24 AC 21-58 2.5.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, analysis may consist of making notes about how things didn’t go as planned. This data could be reviewed on a regular basis, perhaps monthly or quarterly. For organizations on the higher end of the spectrum of complexity, various departments may have their own data analysis group reviewing data and analyzing the data by SMEs within the respective department, possibly supported and coordinated by a safety department.

2.5.3 Confidential Employee Report Summary Reporting Requirements.

§ 5.71 Safety performance monitoring and measurement.

(c) Any person that holds both a type certificate and a production certificate issued under part 21 of this chapter for the same product must submit a summary of the confidential employee reports received under subparagraph (a)(7) of this section to the Administrator once every 6 months.

2.5.3.1 Discussion. Section 5.71(c) provides requirements for submission of confidential employee report summaries to the FAA.

2.5.3.2 Implementation Strategies.

2.5.3.2.1 Holders of both a type certificate and a production certificate for the same product must submit a summary of confidential employee reports received to the FAA every six months [§ 5.71(c)]. This summary should include the number of reports received during the six-month period and a concise description of each report. Reports should be submitted to the certificate management section that oversees your production certificate.

Note 1: Section 5.71(c) only applies to holders of both a type certificate and production certificate for the same product.

Note 2: Title 49 U.S.C. 44735(a)(2) provides protection from freedom of information act disclosure for reports submitted under § 5.71(c). You may label each page of the report with the following for protection from freedom of information act disclosure: “The information in this document is protected from disclosure under 49 U.S.C. 44735(a)(2).” 2-39 04/26/24 AC 21-58 2.5.4 Safety Performance Assessment.

§ 5.73 Safety performance assessment.

(a) Any person required to have an SMS under this part must conduct assessments of its safety performance against its safety objectives, which include reviews by the accountable executive, to: (1) Ensure compliance with the safety risk controls established by the person.

(2) Evaluate the performance of the SMS.

(3) Evaluate the effectiveness of the safety risk controls established under § 5.55(c) and identify any ineffective controls.

(4) Identify changes in the operational environment that may introduce new hazards.

(5) Identify new hazards.

(b) Upon completion of the assessment, if ineffective controls or new hazards are identified under paragraphs (a)(2) through (5) of this section, the person must use the safety risk management process described in subpart C of this part.

2.5.4.1 Discussion. Section 5.73(a) provides requirements to conduct assessments of the organization’s safety performance against its safety objectives. In addition, section 5.73(b) requires SRM if ineffective risk controls or new hazards have been identified through the assessments.

2.5.4.2 Implementation Strategies.

2.5.4.2.1 You must conduct assessments of the organization’s safety performance against its safety objectives [§ 5.73(a)]. In addition, you must complete SRM if the assessments identify ineffective risk controls or new hazards [§ 5.73(b)]. Under § 5.73, you review the analysis of your safety performance data to assess the organization’s safety performance against its safety objectives. The assessments should determine if the organization’s safety performance is effective and is meeting the safety objectives that are identified in the safety policy required by § 5.21. These assessments should be made by personnel with assigned responsibility and authority in the process area. The conclusions of the safety assessments are reviewed by the accountable executive, who possesses ultimate authority to act on such conclusions, as necessary.

2.5.4.2.2 Assessments can have one of the following general outcomes: • Performance is acceptable and objectives are being met.

• Performance is not acceptable, and analysis suggests that the problem lies with compliance with risk controls, regulations, organizational 2-40 04/26/24 AC 21-58 policy and procedures, or necessary resources have not been provided.

In this case, corrective action under § 5.75 would be warranted.

• Compliance with risk controls and regulations appears to be satisfactory; however, desired results are not being obtained (i.e., the risk control is ineffective). In this case, the SRM processes would be triggered under § 5.73(b).

• New or uncontrolled hazards are discovered. This may be due to new hazards having arisen since the system was developed or discovery of factors that were previously unknown. In this case, the SRM processes must be followed under § 5.73(b).

2.5.4.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, safety performance and assessment could be a documented activity performed by the accountable executive. For organizations on the higher end of the spectrum of complexity, this process is best addressed at the highest level in the organization and involves the accountable executive, division vice presidents, and other defined leaders and decision makers. At each level, the organization would define who is responsible to either correct the problem or develop new risk controls. These organizations typically have standing management committees at the functional organization level and a second body at the corporate level to assure integration, coordination, and review by the accountable executive.

2.5.5 Continuous Improvement.

§ 5.75 Continuous improvement.

Any person required to have an SMS under this part must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73.

2.5.5.1 Discussion. Section 5.75 provides requirements to correct safety performance deficiencies that have been identified in the organization’s assessments of its safety performance against its safety objectives.

2.5.5.1.1 Implementation Strategies.

2.5.5.1.2 You must establish and implement processes to correct safety performance deficiencies identified in the assessments conducted under § 5.73 [§ 5.75].

As discussed in paragraph 2.5.4.2.2 , the corrective action process of § 5.75 is triggered when compliance with, or implementation of, risk controls has been found to be deficient. In this case, it is not necessary to conduct a new safety risk analysis. Risk has already been assessed as being unacceptable without satisfactory completion of the risk control. The 2-41 04/26/24 AC 21-58 required corrective action for this case is to make the necessary corrective actions to ensure that the organization conforms to the risk controls.

2.5.5.2 Scalability Examples.

2.5.5.2.1 Continuous improvement decision making is an output of the performance assessment process. The managers, committees, or working groups that make assessment decisions would also lay out courses of corrective action.

2-42 04/26/24 AC 21-58 2.6 Subpart E: Safety Promotion.

2.6.1 Competencies and Training.

§ 5.91 Competencies and training.

Any person required to have an SMS under this part must provide training to each individual identified in § 5.23 of this part to ensure the individuals attain and maintain the competencies necessary to perform their duties relevant to the operation and performance of the SMS.

2.6.1.1 Discussion. Section 5.91 provides requirements to ensure that employees attain and maintain the competencies necessary for the operation and performance of the SMS.

2.6.1.2 Implementation Strategies.

2.6.1.2.1 Your organization must train its employees in the processes, requirements, and expectations of the SMS relevant to the duties of each employee [§ 5.91]. Your employees may receive initial safety training for them to understand and perform their safety related duties. Recurrent training may also be necessary to reinforce these skills to meet the requirement for an employee to maintain SMS-related competencies. For example, an employee who is a process owner will probably need more detailed SMS training (e.g., safety risk analysis, system evaluation, system assessment, and data mining, auditing, and inspections) than will an aircraft assembly technician. Line managers may need to know the potential consequences of safety failures and system failure modes more so than line employees will. Line employees may only need an overview of safety management fundamentals for their operational department (e.g., instructions on how to identify and report safety concerns). Intervals for training needed to maintain competencies are determined by your organization based on operational requirements. These intervals must be of sufficient frequency to ensure your employees maintain their SMS-related competencies.

2.6.1.2.2 Competency is an observable, measurable set of skills, knowledge, abilities, behaviors, and other characteristics that individuals exhibit as they perform work functions. Competencies are typically required at different levels of proficiency depending on the work roles or occupational function. You should establish competencies for all employees, commensurate with their duties relevant to the operation and performance of the SMS. Competence can be assessed at the completion of training by written, oral, or demonstration tests, and measured during the performance of that individual’s work by way of periodic evaluations or supervisor/management observations. As a part of safety assurance, you should periodically review your organization’s training program(s) to 2-43 04/26/24 AC 21-58 ensure that those programs meet the objectives set out in your safety policy.

2.6.1.2.3 It is the responsibility of your organization to determine its own training needs based on competency requirements. Management personnel, specifically designated by the accountable executive to ensure the SMS is fully implemented, may need to be trained first and may also need specialized training to fulfill their responsibilities. Determining your organization’s training needs starts with a careful review of the safety policy, processes, and objectives. Everyone working within the scope of your organization’s SMS should receive SMS training commensurate with their position in the organization.

2.6.1.3 Scalability Examples. You may choose to either train your employees in house or to contract out the training to outside vendors. Whichever option is taken, the training must be specific to your organization’s SMS and operations. Training can be in person or virtual based on your organizational needs. Training should be modular so only the material pertinent to the employee’s position within the organization is presented.

For example, an aircraft assembly technician might only need to be trained on employee reporting while a process owner would need to understand the organization’s SRM processes and procedures. An organization with only one or two employees would likely complete online training to meet this requirement. More complex organizations could have a training department that develops and conducts the training.

2.6.2 Safety Communication.

§ 5.93 Safety communication.

Any person required to have an SMS under this part must develop and maintain means for communicating safety information that, at a minimum: (a) Ensures that employees are aware of the SMS policies, processes, and tools that are relevant to their responsibilities.

(b) Conveys hazard information relevant to the employee's responsibilities.

(c) Explains why safety actions have been taken.

(d) Explains why safety procedures are introduced or changed.

2.6.2.1 Discussion. Section 5.93 provides requirements for communicating safety information to employees.

2-44 04/26/24 AC 21-58 2.6.2.1.1 Implementation Strategies.

2.6.2.1.2 You must develop and maintain a means for communicating safety information to the organization [§ 5.93]. Effective communication involves adjusting the content and manner in which you deliver information, to match your target employee’s role in the organization.

Your accountable executive must ensure that communication mechanisms are available and are effectively used. Your delivery system should be appropriate according to the size and complexity of the organization. You could provide safety policy and information as text, visual media (e.g., posters, short videos), orally, or through examples. Your messages should be consistent, in a form to which employees at each level can relate and be delivered using whichever media you have available.

2.6.2.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, communicating safety considerations to employees will probably be simple and direct. For example, the organization or its accountable executive could conduct regular all-hands/employee meetings. Additionally, communication could include regular and periodic briefings to the employees, posting the status of safety issues on bulletin boards, emails to employees, and face-to-face meetings with division management teams. For organizations on the higher end of the spectrum of complexity, communication is more likely to be formal and a tracking system may be used to ensure that the appropriate safety messages are delivered to the appropriate personnel. An organization may consider information technology approaches, such as email broadcasts or intranet websites, to direct and record the flow of safety information and for evaluation and auditing purposes.

2-45 04/26/24 AC 21-58 2.7 Subpart F: SMS Documentation and Recordkeeping.

2.7.1 SMS Documentation.

§ 5.95 SMS documentation.

Any person required to have an SMS under this part must develop and maintain the following SMS documentation: (a) Safety policy.

(b) SMS processes and procedures.

2.7.1.1 Discussion. Section 5.95 provides requirements for SMS documentation.

2.7.1.1.1 Implementation Strategies.

2.7.1.1.2 You must develop and maintain SMS documentation including your safety policy along with SMS processes and procedures [§ 5.95]. Developing SMS documentation means that the safety policy, and SMS processes and procedures are written, have been recorded, and can be retrieved.

Maintaining SMS documentation means that the safety policy, and SMS processes and procedures are updated and kept current whenever they are changed.

2.7.1.2 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the owner/manager or designee may be responsible for maintaining and distributing current versions of guidance documents.

Documentation may consist of a set of written documents, spreadsheets, and forms that are kept in file cabinets or electronic systems.

Organizations on the higher end of the spectrum of complexity may use software applications or develop new database tools to support documentation requirements. These organizations should examine existing tools and infrastructure, as it is likely that these can be leveraged (modified) to meet SMS requirements.

2-46 04/26/24 AC 21-58 2.7.2 SMS Records.

§ 5.97 SMS records.

Any person required to have an SMS under this part must: (a) Maintain records of outputs of safety risk management processes as described in subpart C of this part. Such records must be retained for as long as the control remains relevant to the operation.

(b) Maintain records of outputs of safety assurance processes as described in subpart D of this part. Such records must be retained for a minimum of 5 years.

(c) Maintain a record of all training provided under § 5.91 for each individual. Such records must be retained for as long as the individual is employed by the person.

(d) Retain records of all communications provided under § 5.93 or § 5.57 for a minimum of 24 consecutive calendar months.

2.7.2.1 Discussion. Section 5.97 provides requirements for SMS recordkeeping.

2.7.2.2 Implementation Strategies.

2.7.2.2.1 Records associated with the outputs of SRM processes must be maintained for as long as any associated controls remain relevant to your operations [§ 5.97(a)]. While records of SRM processes that do not result in any risk controls being implemented (or where all risks are acceptable) are not required to be retained, organizations may choose to retain those records for historical purposes.

2.7.2.2.2 Records of your safety assurance processes must be maintained for a minimum of 5 years [§ 5.97(b)]. This includes appropriate safety performance monitoring, measurement, and assessment records.

2.7.2.2.3 Training records must be retained for as long as the individual is employed by the organization [§ 5.97(c)]. These records should show when the individual received initial and recurrent SMS training. Superseded recurrent training records must be retained in accordance with the organization’s record retention processes and procedures for as long as the employee is employed by the organization.

2.7.2.2.4 Records of your safety communications must be maintained for a minimum of 24 months [§ 5.97(d)]. This includes safety communications under § 5.93 and hazard sharing communications under § 5.57.

2-47 04/26/24 AC 21-58 2.7.2.3 Scalability Examples. For organizations on the lower end of the spectrum of complexity, the owner/manager or designee may be responsible for maintaining auditable records. Documentation may consist of handwritten records, spreadsheets, and completed forms that are kept in file cabinets or binders. Organizations on the higher end of the spectrum of complexity, may have a dedicated records staff or department whose duties include document distribution and records retention.

2-48

04/26/24 AC 21-58 CHAPTER 3. IMPLEMENTATION: BUILDING A SAFETY MANAGEMENT SYSTEM (SMS) 3.1 Process Overview. There are several steps to developing and implementing an SMS that is compliant with part 5 (ref §§ 5.11, 5.13, 5.15): • Required: Develop an organizational system description.

• Recommended: Complete a gap analysis to identify the areas where your organization complies with part 5 and where changes are required.

• Required: Develop and submit an SMS implementation plan to the FAA for approval.

• Required: Develop the necessary policies, processes, procedures, and systems to comply with part 5 and your implementation plan.

• Required: Implement the SMS in accordance with part 5 and your implementation plan.

3.1.1 Develop an Organizational System Description. Follow the guidance in paragraph 2.2.10 of this AC (ref § 5.17) to develop your organizational system description.

3.1.2 Gap Analysis. A gap analysis involves analyzing and assessing your existing programs, systems, processes, and activities with respect to SMS requirements found in part 5.

Most certificate holders have many of the elements of part 5 in their current processes, although those processes may not entirely fulfill the part 5 requirements. For example, the current processes may be limited in scope (i.e., do not cover the entire organization) and/or interoperability (i.e., do not interface sufficiently to form a “system”). If you determine that a process in your organization satisfies one or more part 5 requirements, your analysis should document how that process meets the requirements. You may document how you meet certain part 5 requirements by referencing the processes or procedures where the requirements are discussed. Your gap analysis should identify the additional policies, processes, and procedures you need to develop to fully comply with part 5.

3.1.3 Develop and Submit an Implementation Plan. Follow the guidance in paragraph 2.2.11 of this AC (ref § 5.19) to develop your implementation plan, and in paragraphs 2.2.7 , 2.2.8 , or 2.2.9 of this AC (ref §§ 5.11, 5.13, or 5.15) to submit your implementation plan for FAA approval.

3.1.4 Develop the Policies, Processes and Procedures to Comply with Part 5. Develop the necessary policies, processes, and procedures in accordance with the implementation plan (ref §§ 5.11, 5.13, or 5.15).

3.1.5 Implement the SMS. Follow the guidance in paragraphs 2.2.7 , 2.2.8 , or 2.2.9 of this AC (ref §§ 5.11, 5.13, or 5.15) to implement the SMS in accordance with your implementation plan.

3-1

04/26/24 AC 21-58 APPENDIX A. GUIDANCE FOR DEVELOPING A SAFETY POLICY A.1 Safety Policy.

The safety policy must meet the requirements in § 5.21 and be signed by the accountable executive. References (i.e., “pointers” to other manuals which provide guidance how each requirement is to be met) could be embedded in the safety policy. It is important to remember the safety policy is unique to your organization and should be developed to meet the specific needs, activities, and structure of your organization. A safety policy is a document that states what your organization will do and how its employees are expected to act.

A.1.1 A sample safety policy is included in Paragraph A.2.

A.1.2 Reserved.

04/26/24 AC 21-58 A.2 Sample Safety Policy.

Safety is one of our core functions and an effective safety management system (SMS) is vital to the success and longevity of [company name]. We are committed to implementing, maintaining, and continuously improving a fully functional SMS to ensure that the safety of our products and services are our highest priority.

All employees, starting with the [title of the Accountable Executive], are accountable for supporting our organization’s ultimate goal to achieve the highest level of safety performance of the products and services we provide.

At [company name], we are committed to: • Supporting the management of safety through the provision of all necessary resources to establish and maintain a fully functional SMS.

• Establishing safety objectives that are available for all employees to review in the [location of objectives]. We will ensure that our safety objectives are monitored, measured, and tracked to ensure they are fulfilled.

• Regularly reviewing the safety performance of our organization and directing actions necessary to address substandard safety performance.

• Encouraging employees to disclose safety concerns without fear of reprisal and ensuring that no action will be taken against any employee who discloses a safety concern through the confidential employee reporting system. Specific reporting procedures are located [location of procedures].

• Communicating this safety policy to all employees to ensure each of us is aware of our SMS and safety-related duties and responsibilities.

• Periodically reviewing this safety policy to ensure it remains relevant and appropriate to our organization.

[Signed], Accountable executive [Additional management personnel optional] Activities involving intentional disregard for FAA regulations, company policies and procedures, illegal activities, and/or drugs or alcohol may be subject to disciplinary action.

04/26/24 AC 21-58 Appendix B APPENDIX B. IDENTIFYING THE ACCOUNTABLE EXECUTIVE B.1 Identifying the Accountable Executive Flowcharts. The following flowcharts provide a series of questions to assist you with the selection of your organization’s accountable executive: • Figure B-1, Accountable Executive Decision Process • Figure B-2, Verifying the Accountable Executive B.1.1 Figure B-1 identifies different organizational structures and how those structures may determine the accountable executive. These flowcharts cannot address all possible organizational structures.

B.1.2 Once you have identified the accountable executive, the questions in Figure B-2 will assist you in verifying that the person in the selected position is the correct choice. All questions must receive a “yes” answer as they are validating the requirements of part 5 and § 5.25(a). Should any of the questions result in a “no” answer, you should start the selection process again with a new candidate.

B-1 04/26/24 AC 21-58 Appendix B Figure B-1. Accountable Executive Decision Process B-2 04/26/24 AC 21-58 Appendix B Figure B-1. Verifying the Accountable Executive B-3

04/26/24 AC 21-58 Appendix C APPENDIX C. References and Additional Information C.1 Safety Management System (SMS)-Related Websites.

For additional information regarding SMSs, please see the following websites: • FAA public SMS website at FAA SMS .

• International Civil Aviation Organization (ICAO) Safety Management at website at ICAO Safety Management .

o Annex 19 to the Convention on International Civil Aviation, Safety Management.

o ICAO Document 9859, Safety Management Manual.

C.2 FAA Resources.

Refer to the current version of the following documents at FAA Regulations & Policies or FAA DRS .

• AC 120-92, Safety Management Systems for Aviation Service Providers.

• FAA Order VS 8000.367, Aviation Safety (AVS) Safety Management System Requirements.

• FAA Order 8000.369, Safety Management System.

C.3 Related 14 CFR Regulations.

• You can also obtain a copy of 14 CFR part 5, Safety Management Systems, and other current regulations online from the Federal Register website at Electronic CFR , jointly administered by the Office of the Federal Register (OFR) of the National Archives and Records Administration (NARA) and the U.S. Government Publishing Office (GPO). You can order a paper copy from the U.S. Superintendent of Documents, U.S. Government Publishing Office, Washington, D.C. 20401; at www.gpo.gov, by calling telephone number (202) 512-1800; or by sending a fax to (202) 512 2250.

• You can also obtain a copy of current regulations, Title 14 CFR Part 5, Safety Management Systems, online at Electronic CFR .

C-1 OMB Control Number: 2120-0746 Expiration Date: 11 /3 0 /202 4 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, completing and reviewing the collection of information.

All responses to this collection of information are voluntary FAA Order 1320.46D Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Barbara Hall, 800 Independence Ave, Washington, D.C. 20590.

If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to (9-AWA-AVS - AIR-DMO@faa.gov ) or (2) faxing it to the attention of the LOB/SO (202-267-1813).

Subject: Date: AC 21-58 Please mark all appropriate line items: □ An error (procedural or typographical) has been noted in paragraph on page .

□ Recommend paragraph on page be changed as follows: □ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)

□ Other comments: □ Iwould like to discuss the above. Please contact me.

Submitted by: Date: FAA Form 1320-73 ( 09/22) SUPERSEDES PREVIOUS EDITIONS