What is the purpose of the Safety Risk Management Policy?

The purpose of the Safety Risk Management Policy is to establish common terms and processes for analyzing, assessing, mitigating, and accepting safety risk in the aerospace system.

What are the components of the Safety Management System?

The Safety Management System consists of four components: Safety Policy, Safety Risk Management (SRM), Safety Assurance, and Safety Promotion.

How does the SRM policy affect FAA organizations?

The SRM policy allows FAA organizations to conduct safety risk assessments with flexibility, recognizing their unique missions and requirements while providing standardized principles for risk-based decision-making.

When will the new SRM policy take effect?

The new SRM policy will be effective 18 months after its publication date, which is September 29, 2023.

Safety Risk Management Policy — 8040.4C

Q: What does the SRM process involve?

The SRM process involves conducting system analysis, identifying hazards, and analyzing, assessing, and controlling safety risk associated with those hazards.

Document

ORDER National Policy 8040.4C 09/29/23 SUBJ: Safety Risk Management Policy 1. This order supports Federal Aviation Administration (FAA) Order 8000.369, Safety Management System , and establishes requirements for how to conduct Safety Risk Management (SRM) in the FAA.

It formalizes SRM guidance for FAA Lines of Business (LOBs) and Staff Offices and describes specific steps when performing and documenting SRM.

2. The FAA’s mission is to provide the safest, most efficient aerospace system in the world. In support of this mission, the FAA uses a Safety Management System (SMS) to integrate the management of safety risk into operations, acquisitions, rulemaking, and decision making. The SMS enhances the safety of the flying public and strengthens the FAA’s worldwide leadership in aviation safety.

3. The SMS consists of four components: Safety Policy, SRM, Safety Assurance, and Safety Promotion. The objective of SRM is to provide information regarding hazards, safety risk, and safety risk controls/mitigations to decision makers and to enhance the FAA’s ability to address safety risk in the aerospace system. SRM consists of conducting a system analysis; identifying hazards; and analyzing, assessing, and controlling safety risk associated with the identified hazards. SRM, as described in this order, outlines standardized principles that enhance the FAA’s ability to coordinate risk-based decision making across organizations. Safety Policy and Safety Promotion are not addressed in this order but are discussed in detail in FAA Order 8000.369, Safety Management System . However, this order describes Safety Assurance due to its importance in triggering SRM through the identification of potential hazards or ineffective safety risk controls, as well as its role in monitoring safety risk controls. All four components work together to enable the FAA to manage safety within the aerospace system.

Polly Trottenberg Acting Administrator Distribution Initiated By: AVP-1 09/29/23 8040.4C Table of Contents Appendix A. Definitions ............................................................................................................. A-1 Appendix B. Acronyms .............................................................................................................. B-1 Appendix C. Safety Risk Definition Tables and Risk Matrix .................................................... C-1 Appendix D. Disclosure for FAA Personnel to Participate on SRM Teams .............................. D-1 09/29/23 8040.4C Chapter 1. General Information 1. Purpose of This Order. This order establishes the Safety Risk Management (SRM) policy for the Federal Aviation Administration (FAA). It also establishes common terms and processes used to analyze, assess, mitigate, and accept safety risk in the aerospace system. The design of this policy is to prescribe common SRM language and communication standards to be applied throughout the FAA. Furthermore, the policy recognizes that FAA organizations have unique missions and requirements, so it allows flexibility in how organizations conduct SRM and the tools and techniques that are employed. Specific requirements in this order apply when a safety issue or planned change affects more than one FAA Line of Business (LOB) or Staff Office.

When the team conducting the assessment comprises members from multiple LOBs and Staff Offices, the team uses the risk matrices in this policy unless all stakeholder FAA organizations agree to use a different method or tool. However, if a safety issue or planned change only affects one LOB or Staff Office, the affected organization can use its existing safety risk assessment methodology, and it does not have to use the severity and likelihood definitions or risk matrices in Appendix C. Processes for assessing risk within the FAA should be consistent with SRM principles within this order. Appendix A, Definitions , contains definitions for terms used in this policy. Appendix B, Acronyms , contains acronyms used in this policy.

2. Audience. This order applies to the following LOBs: Air Traffic Organization (ATO), Aviation Safety (AVS), Airports (ARP), Commercial Space Transportation (AST), and Security and Hazardous Materials Safety (ASH), as well as the Office of NextGen (ANG), which is a Staff Office. This order is written to be broadly applicable to the aerospace system, which would allow it to be applied to other FAA organizations in the future if management determines a broader application to be appropriate.

3. Where You Can Find This Order. You can find this order on the MyFAA Employee Website: https://employees.faa.gov/tools_resources/orders_notices/ . This order is available to the public at http://www.faa.gov/regulations_policies/orders_notices/ .

4. Cancellation. This order replaces FAA Order 8040.4B, Safety Risk Management Policy , dated May 2, 2017.

5. Action Date. This order will be effective 18 months after signature and publication. The interlude between the signature and effective date will allow sufficient time to update guidance and training to support the implementation of this order. However, LOBs and Staff Offices may utilize this order prior to the effective date. Additionally, both FAA Orders 8040.4B and 8040.4C allow the use of a different risk analysis method or tool when all stakeholder FAA organizations agree.

6. Explanation of Changes. This revision: a. Adds information on when SRM should be performed for rulemaking; b. Defines when risk acceptance occurs; c. Adds requirements for documenting safety risk assessments; 09/29/23 8040.4C d. Adds requirements for items entered into the Hazard Identification, Risk Management, and Tracking (HIRMT) tool, specifies who enters information into HIRMT, and requires that the Office of Primary Responsibility (OPR) provide updates on mitigation implementation to the HIRMT Program Manager; e. Includes additional and revised definitions in Appendix A and additional acronyms in Appendix B; f. Updates the hazard definition to include aircraft incidents; g. Provides new severity definitions that are mutually exclusive and collectively exhaustive; h. Provides new likelihood definitions that apply to both commercial aviation and general aviation; the definitions are mutually exclusive and collectively exhaustive, based on flight hours, and described using probability and expected value; and i. Provides new risk matrices for both commercial aviation and general aviation that include logarithmic scales on the vertical axes.

7. Background.

a. The FAA’s mission is to provide the safest, most efficient aerospace system in the world. In support of this mission, the FAA uses a Safety Management System (SMS) to integrate the management of safety risk into operations, acquisition, rulemaking, and decision making. The SMS enhances the safety of the flying public and strengthens the FAA’s worldwide leadership in aviation safety. As described in FAA Order 8000.369, Safety Management System , the SMS consists of four components: Safety Policy, SRM, Safety Assurance, and Safety Promotion. These components work together to enable the FAA to manage safety within the aerospace system.

b. This order establishes the SRM policy for the FAA. This SRM policy supports the FAA SMS by providing the ability to consistently conduct SRM and provide safety risk information to decision makers. Further, along with Safety Assurance functions, SRM assists the FAA in ensuring that hazards are identified and the safety risk associated with those hazards is managed to acceptable levels throughout the aerospace system. To manage safety risk, controls or mitigations are used to reduce or eliminate the effects of identified hazards. The terms control , mitigation , and safety risk control are used synonymously in this document.

c. The International Civil Aviation Organization (ICAO) has established frameworks for a State Safety Program (SSP) in Member States and SMSs in product/service provider organizations. Because the FAA includes both regulatory and product/service provider organizations, the FAA chose to implement an SSP and an SMS. This order, together with FAA Order 8000.369 and the U.S. SSP document, helps the FAA to address the ICAO SSP and SMS provisions and ensure interoperability among safety management functions across FAA organizations.

(1) The FAA as Regulator. Regulators perform rulemaking, certification, operational oversight, and continued operational safety functions. Therefore, they provide regulatory oversight of the aerospace system. As such, regulators do not own the systems/operations; rather, the product/service providers own and control their operations. Within the limits of the regulator’s 09/29/23 8040.4C authority, regulators can apply controls to product/service provider activities and operations. The regulator promulgates these controls through regulations, standards, policy, approvals, guidelines, etc., which are the output of the regulator’s SRM activities. The actual implementation of the safety risk mitigation rests largely with the product/service provider. However, the regulator may conduct SRM when it creates, modifies, or removes regulations (or other safety risk controls within its purview).

Additionally, the regulator does conduct SRM when it discovers safety issues of a systemic nature that meet Aerospace System Level (ASL) criteria. Hazards with significant associated safety risk may exist, but because of the limitations within which the regulator must operate, the regulator may not be able to establish controls sufficient to mitigate the safety risk to an acceptable level. Such limitations include the regulator’s legal authority (which is established by statute and executive order), technological limitations, cost-benefit requirements for regulations, the lack of cost-effective solutions, and rulemaking resource and time constraints. When this is the case, the regulator must document the analysis and/or assessment, any decisions made, and the rationale for those decisions.

The regulator must also apply the controls within its purview and establish a methodology to monitor the safety risk. In general, FAA organizations that are regulators do not perform SRM on behalf of individual product/service providers. Rather, the product/service provider is responsible for conducting their own SRM. A regulator may conduct an independent assessment to validate a product/service provider’s assessment or, simply, to have an independent view of the issue/concern.

Additionally, the FAA may need to facilitate SRM in situations where the safety risk owner is unable to do so or requires additional support.

(2) The FAA as Product/Service Provider. Product/service providers are organizations engaged in the delivery of aviation products or services. When an FAA organization performs in the capacity of a product/service provider (e.g., FAA air traffic controllers, technicians, and others providing air navigation services), it is responsible for conducting SRM and applying mitigations because it has the ability to directly control safety risk in its operations. Specifically, it has the responsibility and/or authority over the personnel, processes, equipment, and systems to provide a product or service. A product/service provider can even, if necessary, cease operations in certain environments, discontinue the use of some systems, alter the configurations or operating practices of their systems, etc.

(3) The FAA’s Role in Other Federal Actions. Certain FAA LOBs perform functions such as developing standards, approvals, and oversight. These functions are typically required by statute or executive order, not regulation. While not directly addressed in the ICAO SMS framework, the FAA must ensure that the safety risk of any hazards associated with these activities is acceptable. SRM provides LOBs with an additional tool to assist in performing these functions. For example, ARP must approve certain development activities before an airport service provider can begin construction.

While there is an expectation that the service provider will conduct SRM on the development project, the FAA may need to conduct its own SRM in addition to other evaluations to adequately assess the proposed project before approval. In this case, the appropriate FAA LOB would lead the SRM activity with assistance from other impacted LOBs or Staff Offices and applicable industry representatives.

8. Scope.

a. This order supports the current version of FAA Order 8000.369, and it describes the principles used to guide SRM within the FAA. It formalizes the use of SRM across the FAA, describes the specific steps to use when performing SRM, and enables communication and coordination across 09/29/23 8040.4C FAA organizations for enhanced safety risk decision making. In general, the scope of the assessment is a function of the nature, complexity, and consequence of the identified issue. The scope and complexity of the safety assessment should be tailored to the issue or change being analyzed. In addition, limits in data availability/quality may necessitate a less quantifiable approach and/or result than when pertinent data is available. However, regardless of the scope and complexity, the intent of the SRM process is to provide safety information as an input to decisions, such that risks can be prioritized and resources can be allocated accordingly and in a timely manner.

b. This order requires the use of HIRMT for ASL safety issues. Chapter 2, subparagraphs 5b through 5g, describe HIRMT and the criteria for ASL safety issues.

c. Safety risk assessments and controls that cross organizations must be fully coordinated among the affected organizations. The FAA SMS Committee is a resource for organizations to work through when trying to coordinate safety issues across LOBs or Staff Offices. Organizations should supplement this order with organizational process and procedure instructions to aid in promoting effective SRM and must collaborate with their respective and affected organizations when performing SRM. Documenting the assessment to include what was considered, as well as the rationale for the findings and any resultant decisions, is an important step in the process and will help facilitate better communication and coordination. Chapter 2, paragraph 4 describes the documentation of assessments and decisions.

The FAA SMS Committee was established in FAA Order 8000.369, Safety Management System.

09/29/23 8040.4C Chapter 2. Conducting Safety Risk Management 1. General Information.

a. Introduction. SRM is one of the four components of the SMS that enables the FAA to manage safety within the aerospace system. SRM is composed of describing the system; identifying the hazards; and analyzing, assessing, and controlling safety risk. A hazard is a condition or an object with the potential to cause or contribute to an incident or aircraft accident, as defined in Title 49 of the Code of Federal Regulations (49 CFR) § 830.2.

b. Objective. The objective of SRM is to provide critical information for decision makers by identifying hazards, analyzing safety risk, assessing safety risk, and developing controls to reduce safety risk to an acceptable level. SRM facilitates communication and coordination across FAA organizations for enhanced safety risk decision making.

Figure 2-1: SRM Process Outputs c. Applicability. In general, organizations conduct SRM when making planned changes to the aerospace system and when they discover potential and previously unidentified hazards and/or ineffective risk controls. SRM is used to evaluate the need for, as well as develop, safety risk controls in the aerospace system. Effective SRM requires early and ongoing involvement by appropriate stakeholders. Each applicable organization (listed in the Audience section) must: (1) Document when SRM must be applied within its organization; (2) Engage other FAA organizations early and throughout their own SRM initiatives as appropriate; and (3) Participate in SRM initiated by other FAA organizations as requested.

09/29/23 8040.4C d. Relationship Between SRM and Safety Assurance.

(1) While the focus of this policy is on SRM, it is important to understand how the SRM and Safety Assurance functions work together within an SMS. The SRM process provides a system analysis, the identification of hazards, and the analysis and assessment of safety risk. When appropriate, organizations develop safety risk controls, and once these organizations determine that the safety risk controls are practicable in mitigating safety risk to an acceptable level, the organization employs the safety risk controls operationally. Safety Assurance is used to ensure the safety risk control strategies that have been employed are achieving their intended safety risk mitigation objectives. When the Safety Assurance process reveals that the controls are not adequately mitigating safety risk, the appropriate organization modifies the controls and/or develops additional controls through SRM. Safety Assurance functions also include the identification of potential new hazards.

Appropriate organizations then analyze and assess the potential new hazards using SRM.

(2) The FAA uses Safety Assurance functions to monitor aerospace system data to determine the existence of potential hazards, ineffective safety risk controls, or instances of nonconformance with requirements intended to control safety risk. The FAA implements systems and procedures and applies expertise to use Safety Assurance to identify hazards in the aerospace system.

This order discusses Safety Assurance functions because this activity feeds and follows SRM. While the Safety Assurance functions generally follow the flow chart shown in Figure 2-2, SRM and Safety Assurance Processes , the functions are not required to be performed in the exact sequence as illustrated. For the purposes of illustration, this order will describe Safety Assurance as shown generically in Figure 2-2.

(a) System Operation . This represents the entire aerospace system in operation with all controls in place. Safety Assurance activity is focused on National Airspace System (NAS) surveillance to detect emerging hazards and trends, as well as specific hazards that have been identified.

(b) Data Acquisition and Process . This function includes collecting data regarding the operation of the aerospace system, including the performance of safety risk mitigations, which are acquired and stored for analysis by the FAA. Data sources external to the FAA, such as industry or international organizations, should also be considered and used when data is available and can be validated.

(c) Data Analysis . FAA organizations analyze the acquired data to assess system performance, identify potential hazards (including frequency of events), measure the effectiveness of safety risk controls (i.e., safety performance targets identified in monitoring plans are met), and identify instances of nonconformance.

(d) System Assessment . The system assessment is based on data analysis to identify potential new hazards or ineffective safety risk controls and determine conformance with requirements. FAA organizations may use a variety of tools and techniques to conduct the system assessment. Three possible outcomes of the system assessment are: 1) When a potential hazard or ineffective control is identified, FAA organizations will initiate SRM.

09/29/23 8040.4C 2) When the system is determined to be in conformance with requirements and standards, FAA organizations may continue operation.

3) When a nonconformance is identified, further action may be taken.

(e) Corrective Action . When an instance of nonconformance is identified, FAA organizations investigate and may implement corrective action(s), which might require SRM.

Figure 2-2: SRM and Safety Assurance Processes e. Triggers. There are two basic triggers for applying SRM. The first is planned changes that control, generate, or affect an aviation hazard, and the second is the discovery of potential hazards or ineffective controls from the Safety Assurance process, as shown in Figure 2-2.

09/29/23 8040.4C f. SRM and the Rulemaking Process. Changes to Title 14 of the Code of Federal Regulations (14 CFR) accomplished through the FAA’s rulemaking process are considered planned changes and should undergo SRM, except as provided below. Additionally, an SRM Team may identify rulemaking as a mitigation intended to control safety risk associated with hazards identified during a safety risk assessment. SRM establishes a safety risk baseline from which safety performance can be measured after the FAA publishes the regulation. Benefits associated with performing SRM prior to initiating rulemaking include more informed decisions regarding regulatory text and whether to proceed with rulemaking. In addition, performing SRM prior to the Notice of Proposed Rulemaking (NPRM) provides the FAA with confidence that the rule will not introduce new hazards or exacerbate existing hazards. Changes made in response to NPRM comments could affect the original safety analysis. Therefore, the OPR should update the safety analysis to establish a safety risk baseline for the final rule.

(1) Prior to submitting a rulemaking project to the FAA’s Rulemaking Management Council (RMC), the OPR for the rule should: (a) Document the results of SRM in the OPR’s Pre-Rulemaking Evaluation and Prioritization (PREP) Application that the OPR submits to the RMC, or (b) Complete the SRM Checklist (accessible at FAA SRM Guidance ) or record why the checklist cannot be completed in the PREP Application.

(2) Prior to issuing a decision on precedent-setting exemptions, the regulatory OPR should either complete the SRM Checklist ; document the Safety Risk Assessment per Chapter 2, Section 4 of this order; or record why neither can be completed.

g. SRM in the Operational Environment.

(1) Just as SRM is an integral part of the design and deployment of equipment and processes, it is equally important in evaluating safety in the operational environment. There are additional considerations for SRM in the operational environment. Operational data provide information for evaluating failure modes, frequencies, and consequences. As such, operational data support safety risk estimation by providing real-world information.

(2) Sometimes, organizations discover previously unidentified hazards or find that known hazards have more safety risk than was initially assessed or predicted. Analysis and assessment processes may uncover safety risk that would not have met risk acceptance criteria when the product or system was first put into service. This can present a difficult situation, especially if controls to mitigate the risk associated with the newly identified hazard require changes that cannot be immediately implemented. For this reason, SRM in the operational environment often necessitates allowing safety risk to exist in the system that is higher than would have been initially accepted while organizations develop and implement controls to lower the safety risk. For example, the Aircraft Certification Service (AIR) has acceptable safety risk guidelines and limits for continued operation while the newly identified risk is investigated and mitigated.

h. Office of Primary Responsibility. The OPR for SRM is the organization that manages and tracks the issue or change through closure. The OPR’s responsibilities include leading and managing the safety risk assessment, identifying the appropriate management officials to accept safety risk and 09/29/23 8040.4C approve mitigations, coordinating any necessary approvals and safety risk acceptance decisions, providing status updates to the FAA SMS Committee and Safety Collaboration Team (SCT), and providing the necessary information to the HIRMT Program Manager, who resides in AVP-300 (for more information regarding HIRMT, see Chapter 2, paragraph 5 of this order). The OPR must provide approvals, safety risk acceptance information, and the status of mitigation activities based on the monitoring plan to the HIRMT Program Manager. The OPR is typically the office with the certification or responsibility for the issue or change under consideration. Ultimately, assignment of the OPR or acceptance of the responsibility is a management decision and is typically the result of discussion and agreement amongst the stakeholder organizations.

i. FAA SMS Committee. The FAA SMS Committee, on behalf of the SMS Executive Council, provides a forum for organizations to coordinate SRM activities across LOBs and Staff Offices when appropriate. Organizations can raise safety issues to the FAA SMS Committee when an organization determines that the issue would best be addressed cross-organizationally. After review, the FAA SMS Committee determines whether to track and manage the safety issue on behalf of the FAA SMS Executive Council. In this case, cross-organizational SRM Teams conduct SRM in order to most efficiently and effectively use safety management resources. The FAA SMS Committee has authority to assign the OPR for safety risk assessments that it manages and tracks on behalf of the FAA SMS Executive Council. The OPR must coordinate with the FAA SMS Committee to determine when the assessment is complete and/or when the issue can be closed.

j. SRM Responsibilities.

(1) Depending on the issue or change under consideration, the safety risk analysis may be conducted by an individual or team within a single organization. Other times, the OPR should form a cross-organizational team of stakeholders to adequately address the scope and complexity of the issue.

In order to be most useful to decision makers, SRM is best conducted by an individual who has, or a team whose members have, a diverse set of skills. Multiple disciplines should be represented on these teams, including those with expertise in the system or operation being analyzed, as well as technical, engineering, and safety areas. Individuals performing safety risk analysis or participating in SRM activities should complete FAA SRM training, though it is not required. SRM Teams must include representatives from the various organizations that could be affected by the issue or change under consideration, which often means that multiple LOBs and/or Staff Offices will be represented. SRM Team members do not make safety risk acceptance decisions, which is a management function; however, they are responsible for coordinating the results of the assessment within their organizations and with their management, as appropriate. To ensure the quality of participation from team members, The Safety Collaboration Team (SCT) helps the OPR coordinate any necessary approvals and safety risk acceptance decisions.

For more information regarding the FAA SMS Committee and FAA SMS Executive Council, refer to the current version of FAA Order 8000.369.

For guidance on how to elevate or address a potential safety issue, see the FAA Safety Issue Identification and Management process or LOB-specific guidance for potential elevation criteria.

An SRM Team is a cross-organizational group that is established to conduct SRM on issues that affect more than one FAA organization. An SRM Team is roughly equivalent to an SRM Panel. However, an SRM Team is cross organizational, while an SRM Panel may or may not be cross organizational.

09/29/23 8040.4C it is important that all team members have a basic understanding of SRM prior to commencing the SRM Team meetings.

(2) This order encourages peer review to strengthen decision-maker confidence in the findings. Individuals, other than those who have conducted SRM, should perform the peer reviews.

These individuals should have similar expertise as the SRM Team members. The FAA SMS Committee reviews safety risk assessments that it tracks and manages on behalf of the FAA SMS Executive Council.

k. Coordination Among LOBs. A safety issue may affect multiple LOBs and/or Staff Offices.

Under such circumstances, all affected FAA organizations must be part of the process. Effective SRM requires early and ongoing involvement by appropriate members of all affected FAA organizations. If a disagreement arises among FAA organizations regarding SRM that cannot be resolved, the issue should be raised for resolution to the FAA SMS Committee. If a hazard, its associated safety risk, and safety risk controls affect a single LOB or Staff Office, no further coordination beyond that LOB or Staff Office is necessary (except where required by another FAA order).

l. Coordination With Stakeholders Outside the FAA.

(1) FAA Participation on SRM Teams Established and Led by Outside Entities . There are many instances when the FAA may be asked to participate on SRM Teams established and led by entities outside the FAA, including product/service provider organizations for which the FAA has oversight responsibilities. The FAA employee participating on an SRM Team established and led by entities outside the FAA must provide that organization with the Disclosure in Appendix D of this order. The FAA representative must request that an authorized representative of the organization acknowledge receipt of the disclosure by signing and dating it. FAA personnel will properly document the signed disclosure in accordance with the policies and guidance for their organization. In accordance with the disclosure, FAA employees’ participation on an SRM Team established and led by entities outside the FAA does not constitute the FAA’s endorsement of the findings of the SRM Team. Therefore, FAA personnel participating on the SRM Team should not concur with any document, recommendation, or other product developed by the SRM Team. If the outside entity wishes to obtain FAA concurrence, it should be advised to submit the product to the FAA for review.

(2) Non-Governmental Entity Participation on SRM Teams Established and Led by the FAA. In order to conduct a thorough assessment, it is important to have all the necessary expertise on an SRM Team. For some assessments, the FAA may request subject matter expert (SME) participation from non-governmental entities, including product/service provider organizations for which the FAA has oversight responsibility. In such cases, the OPR must confer with the FAA Office of the Chief Counsel (AGC) to avoid any potential data protection and Freedom of Information Act (FOIA) requirements and/or legal/statutory issues. This is especially important if the SRM Team will have access to data/information that is not publicly available.

2. Safety Risk Management Process. This section describes the steps of the SRM process.

While it describes the steps sequentially, they may be accomplished in parallel. The SRM requirements and concepts described in this order do not preclude FAA organizations from taking See FAA SRM Guidance for additional guidance regarding the SRM process.

09/29/23 8040.4C immediate interim action to mitigate existing safety risk prior to conducting SRM and identifying permanent mitigations.

a. System Analysis. System analysis refers to examining an issue or change in terms of what it affects and what is affected by the issue or change. The purpose of the system analysis step is to understand and describe the system to the extent necessary to identify potential hazards. A thorough system analysis is the foundation for conducting a sound safety analysis. The system analysis provides information that serves as the basis for identifying and understanding hazards, as well as their causes and associated safety risk. When describing and analyzing the system, the individual or team conducting SRM should: (1) Define and document the scope (i.e., system boundaries) and objectives related to the system.

(2) Gather the relevant available data/information regarding the issue or change to be analyzed. This includes available incident/accident data; previous applicable analyses and assessments; and related requirements, rules, and regulations, as necessary.

(3) Develop a safety risk acceptance plan that includes evaluation against safety risk acceptance criteria, designation of authority to make the required safety risk decisions involved, and assignment of the relevant decision makers, ensuring consistency with Table 2-1, Safety Risk Acceptance Criteria for Issues or Changes That Cross LOBs/Staff Offices (see Chapter 2, subparagraph 3d). If an organization does not have risk acceptance criteria, a combination of Table 2-1 and the risk matrices and definitions provided in Appendix C may be used. The OPR may need to update some parts of the risk acceptance plan based on the results of later steps in the process (for instance, the OPR may need to update the designation of authority to make risk acceptance decisions depending on the proposed safety risk mitigations).

(4) Describe and model the system and operation in sufficient detail for the safety analysts to understand and identify the hazards that can exist in the system, as well as their sources and possible effects. One example of modeling is creating a functional flow diagram to help depict the system and the interface with the users, other systems, or subsystems.

(5) Look at the system in its larger context. A system is often a subcomponent of some larger system(s). Therefore, a change to a system could affect the interfaces with these systems. SRM should address the effects on the interfaces or other systems and/or coordinate with the owners of those other systems. For example, a change to the design of an aircraft may affect the maintenance and/or operation of that aircraft type.

(6) Consider the following in the analysis, depending on the nature and size of the system: (a) The function and purpose of the system; A system is defined as an integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, hardware, software, firmware, information, procedures, facilities, services, and other support facets.

09/29/23 8040.4C (b) The system’s operating environment; (c) The interfaces of the system; (d) An outline of the system’s processes, procedures, and performance; and (e) The personnel, equipment, and facilities necessary for the system’s operation.

b. Identify Hazards. When identifying hazards in this step, consider the system analysis. A hazard is a condition or an object with the potential to cause or contribute to an incident or aircraft accident, as defined in 49 CFR § 830.2. During the hazard identification step, the individual or team conducting SRM specifically identifies and documents hazards and each hazard’s corresponding effects. The hazard identification step considers all reasonably possible sources of hazards. Remember that elements in the system analysis may be sources of hazards. Depending on the nature and size of the system under consideration, these could include: (1) Ambient environment (physical conditions, weather, etc.); (2) Equipment (hardware and software); (3) External services (contract support, electric, telephone lines, etc.); (4) Human-machine interface; (5) Human operators; (6) Maintenance procedures; (7) Operating environment (airspace, air route design, etc.); (8) Operational procedures; (9) Organizational culture; (10) Organizational issues; and (11) Policies/rules/regulations.

c. Analyze Safety Risk.

(1) A thorough understanding of the components of safety risk must entail an examination of the factors that increase or decrease the likelihood of system events (errors or failures) that can result in unwanted effects (accidents or incidents). The analysis must also consider the type of effects possible in order to estimate potential severity. The objective of this step is to determine the initial If the individual or team conducting SRM does not identify any hazards, they should document the findings and report them to the OPR who will determine the next steps for the issue or change being analyzed.

09/29/23 8040.4C safety risk associated with the effects of each identified hazard. The safety risk associated with a hazard is the combination of the severity and the likelihood of the potential effect(s) of the hazard.

Where appropriate, existing controls are taken into account prior to safety risk determination. If the -11 probability of an effect of a hazard is less than 1 × 10 , it does not need to be formally assessed or considered.

(2) When conducting safety analyses that cross LOBs, the individual or team conducting SRM performs the analysis using the risk analysis and assessment process of the LOB accepting the safety risk. If multiple LOBs will accept the safety risk and these LOBs cannot agree on which severity and likelihood definitions to use, the definitions and risk matrices documented in Appendix C should be considered for use, as appropriate, or advice from the FAA SMS Committee should be sought to resolve differences.

(3) When a hazard, its associated safety risk, and safety risk controls stay within an LOB or Staff Office, the FAA organization may use its existing safety risk analysis methodologies (including severity and likelihood definitions, if applicable). In these cases, an office shall not be required to use any methodologies other than its existing safety risk analysis methodologies (e.g., AIR's Compliance & Airworthiness or Integrated Certificate Management Divisions would use Transport Airplane Risk Assessment Methodology [TARAM] for a transport airplane certification-related safety issue).

(4) Regardless of which definitions/criteria organizations use, this step includes the following common characteristics: (a) The safety risk of a hazard is the function of the severity and likelihood of the hazard’s potential effects. The safety risk associated with the hazard must be determined and documented in terms of severity and likelihood.

1) Severity is the consequence or impact of a hazard’s effect in terms of degree of loss or harm. It is a prediction of how bad the effect of a hazard can be. There may be many effects associated with a given hazard, and the severity should be determined for each effect.

2) Likelihood is the chance of a hazard and an effect at a specific level of severity. It is an expression of how often an effect of a hazard is predicted to occur in the future. See Appendix C, paragraph 3 for an explanation of the different types of data that are acceptable for use in likelihood calculations. While any data is better than no data, when available, analytical data is preferred, followed by empirical, and finally, judgmental.

(b) The individual or team conducting SRM should limit assumptions as much as practical. If the SRM Team makes any assumptions, the assumptions and their rationale must be documented.

(c) Any known limitations of the safety risk analysis should be described. Limitations may also include the margin of error of the analysis if it can be calculated.

For more information regarding safety risk acceptance, refer to Chapter 2, paragraph 3.

09/29/23 8040.4C d. Assess Safety Risk. In this step, the individual or team conducting SRM assesses each hazard’s associated safety risk against the risk acceptance criteria identified in the safety risk acceptance plan and plots the risk of each hazard on a risk matrix based on the severity and likelihood of the effect. The objective of this step is to determine the safety risk level acceptability. A risk matrix provides a visual depiction of the safety risk and enables prioritization in the control of the hazards.

Appendix C provides risk matrices to be used in this step of the process. If a hazard’s associated safety risk and/or safety risk controls only affect one LOB or Staff Office, the organization can use its existing safety risk assessment methodology, and it does not have to translate its assessment into the risk matrices in Appendix C. Note that certain organizations in the FAA do not have definitions for severity categories below those that include fatalities (Hazardous and Catastrophic). These organizations can use their existing definitions and are not expected to develop definitions for the other categories.

e. Control Safety Risk.

(1) The individual or team conducting SRM may need to design, develop, and evaluate additional safety risk controls (to reduce the safety risk to a level acceptable to the decision maker).

The individual or team conducting SRM conducts the analysis to predict the residual safety risk as if the proposed controls had been put in place. The individual or team conducting SRM assesses the prediction of the residual safety risk to determine if it meets the safety risk acceptance criteria. If an organization does not have risk acceptance criteria, a combination of Table 2-1 and the risk matrices and definitions provided in Appendix C may be used (see Chapter 2, subparagraph 2a(3)). The individual or team conducting SRM performs further analysis to ensure that no new hazards have been introduced or that existing safety risk controls have not been compromised based on the proposed safety risk controls. If the residual risk is not acceptable, the individual or team conducting SRM redesigns proposed safety risk controls, or develops new safety risk controls as necessary, and reconducts the analysis. The individual or team conducting SRM does this until the proposed safety risk controls enable the predicted residual safety risk to meet the safety risk acceptance criteria. When the FAA is unable to apply controls for unacceptable risk, the OPR should consult with LOB management and AGC, as appropriate.

(2) Before safety risk can be accepted, safety risk controls established by the FAA must be approved by the FAA management officials who are responsible for their implementation. By approving a control, the management official agrees to establish the control as described in the SRM documentation. The OPR must obtain necessary approval(s) and safety risk acceptance(s) after the safety risk assessment and development of proposed safety risk controls are complete. The appropriate management officials either approve the proposed safety risk mitigations/controls within their purview or send the assessment back for additional analysis or identification of additional proposed alternatives for safety risk mitigations/controls. Note that the management officials who approve the safety risk controls may be the same management officials who accept the safety risk, but this is not always the case.

(3) In cases in which controlling safety risk is outside the authority of the FAA (as described in Chapter 2, subparagraph 3a), the FAA must document the assessment and decision, as well as apply the controls that it is able to and establish a methodology to monitor the safety risk. When possible, the FAA should identify if another organization(s) is in a position to implement safety risk controls. If 09/29/23 8040.4C another organization(s) is in a position to do so, the FAA should seek to enter into an agreement(s) with the organization(s) to implement and monitor the safety risk controls, if possible.

(4) There may also be circumstances in which there is not enough information to determine the appropriate risk control strategies. In these circumstances, the FAA must document the assessment and any decisions made, establish a methodology to monitor the safety risk, and establish a plan to collect the necessary data and reassess the issue at a later time.

3. Safety Risk Acceptance.

a. As described in Chapter 1, subparagraph 7c(1), there are cases where hazards with significant associated safety risk may exist, but because of the constraints within which the FAA must operate, the FAA may not be able to establish controls sufficient to mitigate the safety risk to a level that would be acceptable to the decision maker. Such limitations include the regulator’s legal authority (which is established by statute and executive order), technological limitations, cost-benefit requirements for regulations, the lack of cost-effective solutions, and rulemaking resource and time constraints. When this is the case, the FAA must document the analysis and any decisions made, apply the controls that it is able to, and establish a methodology to monitor the safety risk. When the FAA is unable to apply controls for unacceptable risk, the OPR should consult with LOB management and AGC, as appropriate.

b. In the context of the SRM process, managers are made aware of the risk via a risk determination presented to them in a briefing or memo, and they are asked to make a decision regarding how to proceed (i.e., whether to implement risk controls), as well as to accept the risk. Risk acceptance occurs when management is informed of the risk via the results of the safety risk assessment and makes one of the following decisions.

(1) For safety issues, management makes the decision to allow the current situation to continue without taking additional action to mitigate risk. This includes continuing a current operation or allowing an entity that management oversees to continue the operation. Management accepts either the initial risk indefinitely, or the initial risk until mitigations are fully implemented and predicted residual risk is determined. If management decides to implement additional risk controls, the initial risk continues to exist until those risk controls have been implemented unless management takes action to pause affected operations in the interim.

(2) For planned changes, management makes the decision to implement a planned change without taking additional action to mitigate risk. This includes implementing a new system, procedure, or process or allowing an entity that management oversees to do so. Management is accepting the risk predicted to exist once the planned change is implemented.

c. In order to properly document risk acceptance, the manager signs a memo affirming any decisions that were made and confirming risk acceptance. The signature is for documentation/record purposes only. Risk acceptance for safety issues, as defined above, occurs regardless of the signature status. Planned changes cannot proceed without a risk acceptance signature.

d. Hazards may also be identified through the Safety Assurance functions used to monitor the aerospace system. In these situations, it is necessary to determine whether continued operation is acceptable (and for how long) while new safety risk controls are introduced. If an existing hazard is 09/29/23 8040.4C identified and the operation is allowed to continue, any risk associated with the hazard is inherently accepted by management officials and/or the FAA, regardless of the risk acceptance being documented by the signature of a management official. Each LOB and Staff Office to which this order is applicable must develop its own guidance and procedures for addressing existing high risk while working toward a mitigation plan to lower the safety risk. The guidance and procedures should include guidelines for managing and communicating elevated safety risk while developing a plan to reduce the safety risk. Ultimately, the LOB or Staff Office’s risk acceptance decisions should be made at the lowest level possible in which the management officials acknowledging or accepting the risk have the responsibility and authority for the issue or change being assessed. Table 2-1 (below) summarizes the management levels for safety risk acceptance.

Table 2-1: Safety Risk Acceptance Criteria for Issues or Changes That Cross LOBs/Staff Offices* Initial Safety Risk Level Safety Risk Acceptance Responsibility ** Associate Administrators of LOBs; Assistant Administrators of High Risk Staff Offices; ATO Chief Operating Officer** * The appropriate management officials within the stakeholder Medium Risk organizations who have the positional responsibility and authority for the issue or change being assessed**** Low Risk Per LOB/Staff Office Guidance for Safety Risk Acceptance * For Airworthiness Directives, acceptance of safety risk may be delegated in accordance with the current version of FAA Order 1100.154, Delegations of Authority .

** By accepting risk, the management official is deciding to authorize the operation without additional mitigation at the present time. Accepting risk is a management decision. This policy does not compel a management official to accept risk, nor does it require FAA organizations to circumvent their existing risk acceptance criteria or safety standards.

*** The ATO must comply with the current versions of FAA Order 1100.161, Air Traffic Safety Oversight, and FAA Order JO 1000.37, Air Traffic Organization Safety Management System , as well as the ATO SMS Manual. Per FAA Order JO 1000.37, the ATO Chief Operating Officer (COO) is informed of any existing hazards that are determined to be a high-risk hazard and any interim actions taken to mitigate the risk. The ATO COO either approves the interim action and accepts the associated risk or requires that the operation be stopped.

**** In general, risk acceptance decisions should be made at the lowest level possible in which the management officials accepting the risk have the responsibility and authority for the issue or change being assessed.

e. For hazards with associated predicted residual safety risk that is medium or high, the OPR should define a methodology for monitoring and tracking the residual risk and assessing the safety risk against defined safety risk acceptance criteria. The OPR should document this methodology in a monitoring plan, which is included in the documentation of the safety risk assessment. The monitoring plan describes who is responsible for tracking and monitoring and how it will be done. Specifically, the monitoring plan describes the tracking and monitoring activities, including their frequency (how often they will be performed), their duration (how long the monitoring activities will be conducted), and the data necessary to evaluate the effectiveness of safety risk controls. In addition, the monitoring plan includes a description of the safety performance targets that will be used to assess the safety performance of existing controls and any newly implemented safety risk controls.

09/29/23 8040.4C 4. Documenting Assessments and Decisions.

a. Safety risk acceptance decisions made as a result of the safety risk analysis must be recorded with the safety risk assessment report. Standardized documentation of safety risk acceptance facilitates consistent decision making and assists future decisions based on related analyses. The documentation should bring together the relevant information to enable the management official to understand the issue or system, its associated safety risk, and safety risk controls implemented (or proposed) to reduce the safety risk such that the residual safety risk is acceptable. The document should contain sufficient detail to enable the reader to comprehend what steps have been taken to identify safety issues and the corrective steps taken or proposed. The OPR must document the following information for ASL issues: (1) Identification of the Individual or Team Who Conducted the Analysis (a) Name(s) and contact information; (b) Organization(s); and (c) Role of the team member/individual in performing the analysis (e.g., area of expertise, organizational representative, or role such as a facilitator).

(2) Description of the Issue or Change and the Current System (a) Explanation of the trigger that resulted in undertaking the analysis; (b) Statement reflecting the impact of the issue or change (e.g., industry segment and level of impact such as local, regional, or national); (c) Available data on related incidents or accidents; (d) Existing safety risk controls; (e) Pertinent interfaces and support systems required to maintain system function; and (f) Reference to any other related analyses.

(3) Identification of Hazards (a) Description of the hazards and how they were identified.

(4) Analysis of the Associated Safety Risk (a) Description of the hazard model used in the analysis, including causes, system states, event(s), and effects identified for each hazard; (b) The safety risk, including initial risk level (in terms of severity and likelihood) and when and how it appears in the current or proposed system; 09/29/23 8040.4C (c) Analytical basis and rationale for each of the above (e.g., historical data or other studies, modeling, simulation, experience with similar systems, or expert judgment); and (d) Assumptions made and known limitations of the analysis, including the margin of error when it was calculated.

(5) Analysis of Proposed Safety Risk Controls.

(a) Description of the safety risk controls that were considered; and (b) Description of proposed safety risk control(s) and rationale, including how the selected safety risk control(s) will mitigate the cause/effects of the hazard and, if applicable, expectations for implementation and compliance on the part of product/service providers affected by the decision and its associated safety risk controls.

(6) Residual Safety Risk (a) Description of any remaining safety risk, including risk created by the proposed safety risk controls and strategies employed to mitigate/control this new safety risk; and (b) Description of how the hazards and their associated controls will be tracked and monitored against safety risk acceptance criteria.

(7) Safety Recommendations and Requirements (a) Safety Recommendations contained in a final Safety Risk Assessment Report; (b) Status of Safety Risk Assessment Report Addendum and conversion of Safety Recommendations to Safety Requirements; (c) Safety Requirements that have been approved by Risk Mitigation Implementer(s); (d) Expected implementation date for each mitigation; and (e) Monitoring plan approved by the OPR.

5. Safety Performance Monitoring and Hazard Tracking. Safety performance monitoring and hazard tracking include documenting safety risk controls, confirming the implementation and effectiveness of safety risk controls, and updating the residual risk levels, as appropriate.

a. Safety performance monitoring measures the effectiveness of existing and new safety risk controls, as well as provides information regarding the accuracy of the prediction of residual risk Information on ASL issues is entered into HIRMT throughout the lifecycle of the issue or change. When an SRM Team finalizes its safety risk assessment, the report includes proposed safety risk controls (Safety Recommendations). Safety Recommendations become official when they are converted to Safety Requirements upon management signature.

09/29/23 8040.4C resulting from the risk analysis and assessment. OPRs may determine that safety risk controls are effective when system performance meets the safety performance targets identified in the monitoring plans. Organizations accomplish safety performance monitoring primarily through the Safety Assurance functions.

b. Hazard identification and tracking are foundational requirements for effective SRM. Hazard tracking is the process of tracking and managing the information regarding a hazard through safety risk management until the monitoring plan is complete. LOBs and Staff Offices must identify and track hazards within their purview. LOBs and Staff Offices must report the hazard and mitigation status of identified ASL safety issues, including the implementation progress of the assigned safety requirements, to the HIRMT Program Manager, who resides within AVP-300.

c. ASL Criteria. While LOBs and Staff Offices can use their own tools to collect and maintain information regarding safety issues that are addressed wholly within their organization, if a safety issue meets one or more of the following criteria, it is considered an ASL issue and must be reported and tracked through HIRMT: (1) The safety issue is tracked and managed by the FAA SMS Committee; (2) The safety issue is present in the NAS, its safety risk has not been accepted, and it is expected to have high risk (e.g., it is identified as a result of an accident or incident, or it is assumed to have high risk but an assessment has not been completed); (3) The safety issue has high risk and has a potentially systemic effect (e.g., the effect crosses LOBs or the effect impacts an industry segment rather than an individual certificate holder); or (4) Any safety issue that an FAA organization’s management elects to track in HIRMT.

d. The FAA SMS Committee monitors the reporting and closing of ASL safety issues in HIRMT. The OPR of the ASL safety issue and organizations responsible for mitigation implementation must coordinate with the HIRMT Program Manager to ensure proper capture of the SRM results and associated Safety Assurance efforts regarding the safety issue into HIRMT. For ASL safety issues that stay within an organization, the OPR must coordinate within their organization for safety risk acceptance and with the HIRMT Program Manager to record that decision on behalf of their organization in HIRMT. The OPR must then notify the HIRMT Program Manager when the OPR believes that the issue is ready to be closed. For cross-organizational issues, the OPR must coordinate safety risk acceptance decisions with the appropriate organizations and with the HIRMT Program Manager to record those decisions in HIRMT. The OPR must then facilitate close-out procedures with the FAA SMS Committee to determine when the HIRMT record can be closed.

e. LOBs and Staff Offices that have a documented process/tool for capturing and managing safety issues that is comparable to the process in HIRMT, as determined by the FAA SMS Changes being processed through the NAS Change Proposal (NCP) may be considered to be present in the NAS if they are in the live test and evaluation phase.

The organization should consider the risk and visibility of a safety issue when determining if it should be entered into HIRMT.

09/29/23 8040.4C Committee, are exempted from the requirement to report and track safety issues through HIRMT. In order for an LOB or Staff Office to receive an exemption from the requirement to use HIRMT, the organization must submit a formal request to the FAA SMS Committee. The request must include a description of the safety issue or type of safety issue for which the exemption is being requested, a detailed description of the process/tool that is or will be used to track the safety issue or type of safety issue, and documentation (e.g., policies, process/procedure documents, work instructions) that describes the tracking process/tool and its applicability.

f. Reporting. ASL safety issues must be coordinated with the HIRMT Program Manager for entry and capture into HIRMT. The information required in Chapter 2, paragraph 4 of this order must be provided to the HIRMT Program Manager. In addition, the OPR must provide periodic updates to the HIRMT Program Manager to include: (1) Status of mitigation implementation, including the following: (a) Whether the mitigations will be implemented in accordance with the timeline established in HIRMT; (b) If the mitigations will be delayed, a revised mitigation implementation deadline and justification for adjusting the deadline; and (c) Whether the OPR recommends additional action due to an adjusted timeline.

(2) Status of monitoring plan activities; and (3) Results of safety performance monitoring (i.e., whether performance meets targets).

g. Briefing. The HIRMT Program Manager must publish monthly HIRMT Monitoring and Tracking Reports that provide the status of Safety Recommendations, Safety Requirements, and monitoring activities. The HIRMT Program Manager presents HIRMT Monitoring and Tracking reports to FAA SMS Management on a regular basis.

6. Confirming Safety Risk Control Implementation and Effectiveness. Risk management involves developing processes for monitoring and tracking the implementation of identified safety risk controls. Confirming the implementation of the safety requirement is essential when evaluating the effectiveness of the safety risk control and assessing residual risk classification.

a. The safety requirement implementation monitoring and tracking strategy should include mechanisms for evaluating the status of the safety requirement and measuring implementation progress in accordance with the scheduled implementation date. Risk analysis to determine current or potential risk vulnerability when scheduled implementation dates are not met should be conducted, as well as ongoing safety requirement validity monitoring and analysis. ASL safety issues and identified safety controls, as well as the status of their implementation, must be documented and reported in HIRMT on a recurring basis.

b. If not using HIRMT to track and monitor non-ASL safety issues, each LOB and Staff Office must identify the process and documentation used to document the findings and results of each step of the SRM process. The documentation should be written to be understood by a 09/29/23 8040.4C reviewer familiar with the discipline(s) relevant to the issue or change that was assessed. The name, position, and signature of management official(s)/executive(s) approving any safety risk controls and/or accepting the residual safety risk should be included.

09/29/23 8040.4C Chapter 3. Administrative Information 1. Distribution. This order is distributed to all offices in Washington Headquarters, regions, and centers, with distribution to all field offices and facilities of the applicable FAA organizations (identified in Chapter 1, paragraph 2).

2. Related Publications. This order was developed to be consistent with the latest versions of the following aviation safety documents that existed at the time the order was published: a. FAA Order 8000.369, Safety Management System b. FAA Order 1100.154, Delegations of Authority c. U.S. State Safety Program d. FAA Order VS 8000.367, AVS Safety Management System (AVSSMS) Requirements e. FAA Order 1100.161, Air Traffic Safety Oversight f. Risk Analysis Specification (Aircraft Certification Service) g. FAA Order JO 1000.37, Air Traffic Organization Safety Management System h. Air Traffic Organization Safety Management System Manual i. Safety Risk Management Guidance for System Acquisitions (SRMGSA) j. FAA Order 5200.11, FAA Airports (ARP) Safety Management System (SMS) k. FAA Office of Commercial Space Transportation Safety Management System (SMS) Manual l. Advisory Circular (AC) 450.115-1, High Fidelity Flight Safety Analysis m. AC 450.101-1, High Consequence Event Protection n. Safety Approval Guide for Applicants (Commercial Space Transportation) o. FAA Order NG 1000.44, NextGen Safety Management System p. International Civil Aviation Organization Annexes 1, 6, 8, 11, 13, 14, 18, and 19 q. ICAO Safety Management Manual (Document 9859) 3. Authority to Change This Order. The FAA Administrator has authority to issue changes and revisions to this order.

09/29/23 8040.4C Appendix A Appendix A. Definitions a. Accident means an unplanned event or series of events that results in death, injury, or damage to, or loss of, equipment or property.

(1) Aircraft Accident means an occurrence associated with the operation of an aircraft that takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage.

b. Aerospace System means U.S. airspace and delegated airspace, all manned and unmanned vehicles operating in that airspace, all U.S. aviation operators, airports, airfields, air navigation services, pilots, regulations, policies, procedures, facilities, equipment, and all aviation-related industry.

c. Analysis means the process of identifying a question or issue to be addressed, examining the issue, investigating the results, interpreting the results, and possibly making a recommendation.

Analysis typically involves using scientific or mathematical methods for evaluation.

d. Assessment means the process of measuring or judging the value or level of something.

e. Common Cause Failure means a failure that occurs when a single fault results in the corresponding failure of multiple system components or functions.

f. Control – See Safety Risk Control. The terms Control , Mitigation , and Safety Risk Control are used synonymously.

g. Effect means the real outcome that has occurred, or a potential outcome with a probability of -11 occurring that is greater than or equal to 1 × 10 , expected if the hazard exists in the defined system state.

h. Expected Value is equal to the probability of an event times the exposure to the event (expected number of events). Example: for a series of coin flips, the expected number of heads is equal to the probability of heads times the number of coin flips. See FAA SRM Guidance for the technical definition.

i. Hazard means a condition or an object with the potential to cause or contribute to an incident or aircraft accident, as defined in 49 CFR § 830.2. See FAA SRM Guidance for the technical definition.

j. Incident means an occurrence other than an accident that affects or could affect the safety of operations.

k. Likelihood means the chance of a hazard and an effect at a specific level of severity. See FAA SRM Guidance for the technical definition.

l. Mitigation – See Safety Risk Control . The terms Control , Mitigation , and Safety Risk Control are used synonymously.

A-1 09/29/23 8040.4C Appendix A m. Monitoring means tracking and keeping information under systematic review.

n. Office of Primary Responsibility (OPR) means the organization that manages and tracks the issue or change through closure. An OPR’s responsibilities include leading and managing the safety risk assessment, identifying the appropriate management officials to accept safety risk and approve mitigations, coordinating any necessary approvals and safety risk acceptance decisions, providing status updates to the FAA SMS Committee and the SCT, and coordinating with the HIRMT Program Manager to enter results and decisions into HIRMT, as required.

o. Probability means an expression of uncertainty that quantifies the chance of something happening (e.g., the chance of an event occurring). All probability values fall between zero (no chance) and one (absolute certainty). See FAA SRM Guidance for the technical definition.

p. Risk – See Safety Risk. The terms Risk and Safety Risk are used synonymously.

q. Risk Acceptance – See Safety Risk Acceptance . The terms Risk Acceptance and Safety Risk Acceptance are used synonymously.

r. Risk Guidelines means the recommended limits that establish the boundaries of high and medium risk. See also the various Risk definitions.

s. Safety means the state in which the risk of harm to persons or property damage is acceptable.

t. Safety Assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.

u. Safety Issue means any information (e.g., event, report, data) suggesting (1) an emerging safety concern (including novel features and technologies being introduced into the aerospace system) that has not been thoroughly analyzed and requires further evaluation or (2) a concern that was identified in the past but circumstances have changed since the concern was initially identified, possibly requiring reevaluation. Some safety issues may need to be elevated to an appropriate level of management to be adequately addressed.

v. Safety Performance Target means a measurable goal used to verify the predicted residual safety risk of a hazard’s effect.

w. Safety Recommendation means a safety risk control proposed by an SRM Team for FAA management approval. The goal of a safety recommendation is to reduce or eliminate the effects of the hazard(s) assessed by the SRM Team.

x. Safety Requirement means a safety recommendation that has been approved by FAA management and will be implemented.

A-2 09/29/23 8040.4C Appendix A y. Safety Risk means the composite of predicted severity and likelihood of the effect of a hazard.

See FAA SRM Guidance for the technical definition.

(1) Types of Safety Risk (a) Initial Risk means the predicted severity and likelihood of a hazard’s effects when it is first identified and assessed and includes the effects of preexisting safety risk controls in the current environment.

(b) Residual Risk means the remaining predicted severity and likelihood that exists after all selected safety risk control techniques have been implemented.

(2) Levels of Safety Risk (a) High Risk means severity and likelihood map to the red cells in the risk matrix (in Appendix C). This safety risk requires mitigation, tracking, and monitoring, and it can only be accepted at the highest level of management within LOBs and Staff Offices (see Chapter 2, paragraph 3, Safety Risk Acceptance).

(b) Medium Risk means severity and likelihood map to the yellow cells in the risk matrix (in Appendix C). Although this safety risk is acceptable without additional mitigation, tracking and monitoring are required. However, it is desirable to achieve the lowest practicable risk levels (factoring in the principles of appropriate resource management).

(c) Low Risk means severity and likelihood map to the green cells in the risk matrix (in Appendix C). This safety risk is acceptable without restriction or limitation; hazards are not required to be actively managed, but they must be documented and reported if a safety risk assessment has been performed.

z. Safety Risk Acceptance means the decision by the appropriate management official to authorize the operation without additional safety risk mitigation.

aa. Safety Risk Analysis means the first three steps of the SRM process (analyze the system, identify hazards, and analyze safety risk).

bb. Safety Risk Assessment means the first four steps of the SRM process (analyze the system, identify hazards, analyze safety risk, and assess safety risk).

cc. Safety Risk Control means a means to reduce or eliminate the effects of hazards. The terms Control , Mitigation , and Safety Risk Control are used synonymously.

dd. Safety Risk Management (SRM) means a process within the SMS composed of describing the system; identifying the hazards; and analyzing, assessing, and controlling safety risk.

ee. Severity means the consequence or impact of a hazard’s effect in terms of degree of loss or harm.

ff. Single Point of Failure means an element of a system or operation for which no backup (i.e., redundancy) exists. Single-pilot operations are an exception.

A-3 09/29/23 8040.4C Appendix A gg. System means an integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, hardware, software, firmware, information, procedures, facilities, services, and other support facets.

A-4 09/29/23 8040.4C Appendix B Appendix B. Acronyms a. AC – Advisory Circular b. AGC – Office of the Chief Counsel c. AIR – Aircraft Certification Service d. ANG – Office of NextGen e. ARP – Airports f. ASH –Security and Hazardous Materials Safety g. ASL – Aerospace System Level h. AST – Commercial Space Transportation i. ATC – Air Traffic Control j. ATO – Air Traffic Organization k. AVP – Office of Accident Investigation and Prevention l. AVS – Aviation Safety m. CFR – Code of Federal Regulations n. COO – Chief Operating Officer o. FAA – Federal Aviation Administration p. FOIA – Freedom of Information Act q. GA – General Aviation r. HIRMT – Hazard Identification, Risk Management & Tracking s. ICAO – International Civil Aviation Organization t. LOB – Line of Business u. M – Million v. NAS – National Airspace System w. NCP – NAS Change Proposal x. OPR – Office of Primary Responsibility B-1 09/29/23 8040.4C Appendix B y. SCT – Safety Collaboration Team z. SME – Subject Matter Expert aa. SMS – Safety Management System bb. SRM – Safety Risk Management cc. SSP – State Safety Program dd. TARAM – Transport Airplane Risk Assessment Methodology B-2 09/29/23 8040.4C Appendix C Appendix C. Safety Risk Definition Tables and Risk Matrix 1. The severity and likelihood definition tables in this appendix are used in the Analyze Safety Risk step of Safety Risk Management (SRM). These definitions are generalized for use by any stakeholder, but any affected Line of Business (LOB) and Staff Office may develop more specific definitions for use in its application of SRM.

2. It is important to recognize that an identified hazard can result in more than one effect and that these effects have different levels of severity and probabilities of occurrence. To facilitate this -11 evaluation, all system states should be considered. If the probability of an effect is less than 1 × 10 , it does not need to be considered.

3. Data. Acceptable data used in SRM analysis can be broadly classified into three categories: Analytical, Empirical, and Judgmental.

a. Analytical data is quantitative and based on analysis or logic. Empirical data is also quantitative and based on measurements from observed or simulated effects. Judgmental data is qualitative and based on expert opinion. For example, when looking for the probability of rolling two “6”s in a pair of dice, analytical data would calculate 1/6 × 1/6 = 1/36 probability. Empirical data would involve performing multiple test throws and recording data from the observed results.

Judgmental data would be reliant on the appropriate subject matter expertise with supporting rationale.

b. While any data is better than no data, when available, analytical data is preferred, followed by empirical, and finally, judgmental. This is due to the margin of error associated with each type of data.

Analytical data typically has the lowest margin of error; the margin of error of empirical data can be controlled by sample size; and judgmental data has the largest margin of error due to human biases and subjective experience. Although analytical data is preferred when available, stakeholders should consider its applicability to the past, present, and future system states being reviewed and supplement with other data types as appropriate to determine both severity and likelihood. Regardless of the data type(s) used, a thorough rationale for the choice should be articulated in the final SRM documentation.

4. Severity Definitions. The severity definitions in Table C-1 partition the possible severity of aviation effects across a spectrum ranging from the least to most severe. The categories are mutually exclusive in that any discrete effect must only fall within one of the categories. Additionally, the categories are collectively exhaustive such that any potential effect must fall within one of the categories. Fatalities and injuries that appear within the severity definitions encompass effects expected to result from both manned and unmanned aviation.

C-1 09/29/23 8040.4C Appendix C Table C-1: Severity Definitions* Minimal Minor Major Hazardous Catastrophic 5 4 3 2 1 Negligible An expected An expected An expected An expected safety unintentional effect unintentional effect that unintentional effect unintentional effect that includes any of includes any of the that includes any of effect that the following: following: the following: includes any of the following: • 1-2 minor injuries • 1-2 serious injuries** • 1-2 fatalities without manned • 3 or more • Minor damage to • 3 or more minor aircraft hull loss fatalities manned aircraft injuries • Manned aircraft • Manned • Substantial • Substantial damage** damage** to to manned aircraft hull loss without aircraft hull fatalities loss with at unmanned aircraft • Hull loss to unmanned weighing at least • 3 or more serious least 1 fatality aircraft weighing at 55 pounds least 55 pounds injuries** * Excludes commercial space flight vehicles, crew, and participants.

** SRM Teams may refer to 49 CFR § 830.2 for definitions of serious injury and substantial damage.

a. Critical effects associated with a hazard’s occurrence may have been observed rarely or not at all. However, if a hazard has resulted in effects such as runway incursions, separation losses, or similar events indicating an aircraft avoided an accident but experienced imminent danger, those precursor events may be used as the basis for a prediction of effects at all levels of severity by applying the likelihood definitions below to each severity category.

5. Likelihood Definitions. The likelihood definitions in Table C-2 are expressed on a per-flight-hour basis as both a probability and frequency.

Table C-2: Likelihood Definitions Category Less than Greater than or Equal to -5 Frequent – A 1 1 × 10 (1 per 100,000) -5 -6 Infrequent – B 1 × 10 (1 per 100,000) 1 × 10 (1 per 1,000,000) -6 -7 Extremely Infrequent – C 1 × 10 (1 per 1,000,000) 1 × 10 (1 per 10,000,000) -7 -8 Remote – D 1 × 10 (1 per 10,000,000) 1 × 10 (1 per 100,000,000) -8 -9 Extremely Remote – E 1 × 10 (1 per 100,000,000) 1 × 10 (1 per 1,000,000,000) -9 -10 Improbable – F 1 × 10 (1 per 1,000,000,000) 1 × 10 (1 per 10,000,000,000) -10 Extremely Improbable – G 1 × 10 (1 per 10,000,000,000) 0 a. For situations where SRM Teams prefer to use an expected value instead of, or in addition to, a probability to assess risk, Table C-3 provides a calendar-based expected value associated with the occurrence of the hazard’s effects rather than its probability. This alternate method assumes an exposure to the hazard’s effects, where approximately 10 million (10M) flight hours per year are flown by either commercial or General Aviation (GA). If exposure to the hazard’s effects is determined to be other than 10M annual flight hours, the SRM Team may estimate exposure and document rationale.

C-2 09/29/23 8040.4C Appendix C Table C-3: Expected Value Definitions Time/Calendar-based Occurrences Category Based on an average of 10 million flight hours per year Frequent – A Expected to occur more than once every 4 days Expected to occur one time every 4 days to more than one time every 1 Infrequent – B month Expected to occur one time every 1 month to more than one time every Extremely Infrequent – C 1 year Expected to occur one time every 1 year to more th an one time every Remote – D 10 years Expected to occur one time every 10 years to more than on e time every 100 years Extremely Remote – E Or unlikely, but possible to occur in the life of an aircraft Expected to occur one time every 100 to 1,000 years Improbable – F Or so unlikely, it can be assumed occurrence may not be experienced in the life of an aircraft type Extremely Improbable – G Expected to occur less than once every 1,000 years * * If the analysis is largely reliant on judgmental rather than empirical or analytical data, then the analysis must not reach a likelihood less than Improbable.

6. Risk Matrices. A risk matrix is a graphical means of depicting safety risk. The horizontal scale in the matrix represents severity and has been partitioned into categories as defined by Table C-1, Severity Definitions ; the vertical scale is a continuous logarithmic probability scale, partitioned into categories as defined by Table C-2, Likelihood Definitions and Table C-3, Expected Value Definitions .

The matrices in Figures C-1 and C-2 are intended as a standardized baseline to facilitate communication across Federal Aviation Administration (FAA) organizations and to establish the Administrator’s minimum standard regarding the safety of aviation per flight hour in the U.S.

a. Background. The divisions between risk categories illustrated by color changes in the risk matrices were derived from accident data. The commercial aviation guidelines were derived from Title 14 of the Code of Federal Regulations (14 CFR) part 121 operations only. GA guidelines were derived from flight activities conducted under several other aviation segments accounting for a majority of the remaining flights within the aerospace system.

b. Application. Analysts should use the matrix that most accurately reflects the type of operation and potential safety effects of the hazard assessed. The commercial aviation guidelines are intended to be minimum standards when assessing large air transport operations and aircraft systems providing air transportation for 10 or more seats, such as those operated by 14 CFR parts 121, 125, and 129 commercial air carriers. GA guidelines are intended to establish the minimum standard for all other aviation segments or combinations of segments. This includes, but is not limited to, all 14 CFR part 91 operations, small aircraft operated by part 121 certificate holders, part 135 commuters, and small for-hire operations such as those conducted under parts 107, 133, and 137.

C-3 09/29/23 8040.4C Appendix C Figure C-1: Risk Matrix for Commercial Aviation C-4 09/29/23 8040.4C Appendix C Figure C-2: Risk Matrix for General Aviation 7. Some FAA organizations have existing safety risk assessment processes to determine safety risk levels. These processes may include evaluating design constraints such as single points of failure or common cause failures, and risk levels may be adjusted to account for these conditions when appropriate. Organizational processes may also assess risk without using a risk matrix (for example, evaluation against the probability of a fatal effect). Since there is obvious overlap, the risk matrix may be useful in communication between LOBs and/or Staff Offices and with management. The risk matrix is a tool that facilitates communication regarding safety risk among FAA organizations through the graphical illustration of safety risk analysis and assessment results. Using the risk matrix across LOBs and/or Staff Offices does not preclude organizations from using their own means of analyzing and assessing safety risk. It also does not preclude organizations from using methodologies or frameworks other than the risk matrix to illustrate and communicate the results of those analyses and assessments within an LOB or Staff Office. Therefore, if a hazard, its associated safety risk, and safety risk controls stay within an LOB or Staff Office, the FAA organization may use its existing safety risk assessment methodology. In most cases, the organization does not have to translate its assessment into the risk matrix included in this order. However, when a hazard meets the Aerospace System Level (ASL) criteria described in Chapter 2, subparagraph 5c, information regarding the hazard must be entered into the Hazard Identification, Risk Management and Tracking (HIRMT) tool, and the hazard C-5 09/29/23 8040.4C Appendix C must be plotted onto one of the matrices depicted in Figures C-1 and C-2 (based on the type of operation) to facilitate communication and coordination.

8. When the team conducting the assessment comprises members from LOBs and Staff Offices that use different risk matrices, the team uses the risk matrices in this policy, unless all stakeholder FAA organizations agree to use a different method or tool. For cases in which controlling safety risk is outside the authority of the FAA (as described in Chapter 2, subparagraph 3a of this order), the FAA must document the analysis and decision, as well as apply the controls that it is able to and establish a methodology to monitor the safety risk.

9. The safety risk levels used in the process are defined below.

a. High Risk means severity and likelihood map to the red cells in the risk matrices. This safety risk requires mitigation, tracking, and monitoring, and it can only be accepted at the highest level of management within LOBs and Staff Offices (see Table 2-1).

b. Medium Risk means severity and likelihood map to the yellow cells in the risk matrices.

Although this safety risk is acceptable without additional mitigation, tracking and monitoring are required. However, it is desirable to achieve the lowest practicable risk levels (factoring in the principles of appropriate resource management).

c. Low Risk means severity and likelihood map to the green cells in the risk matrices. This safety risk is acceptable without restriction or limitation; hazards are not required to be actively managed, but they must be documented and reported.

10. Each hazard is ranked and prioritized according to its associated safety risk levels following the steps below: a. When appropriate, rank hazards according to their associated safety risk levels (illustrated by where they fall on the risk matrix).

b. Plot the severity and likelihood of the effect associated with the hazard using the logarithmic scale.

c. If any of the plotted points fall within the red region, the safety risk associated with the hazard is high; if any of the plotted points fall within the yellow region with none in the red, the safety risk associated with the hazard is medium; otherwise, the risk is low.

d. Once mitigations are developed and the analysis is conducted, taking into account those mitigations, the residual safety risk is plotted. Plotting the prediction of the residual safety risk illustrates the impact of the safety risk controls on the initial safety risk and shows the decision maker whether the safety risk associated with the hazard will be mitigated to an acceptable level.

11. Ranking the safety risk associated with the identified hazards helps the team and decision maker prioritize the development and implementation of mitigations.

12. Conversions. The risk matrices presented in Figures C-1 and C-2 use a base-10 logarithmic probability scale for its vertical axis. These probability values are intended to reflect discrete C-6 09/29/23 8040.4C Appendix C probabilities associated with categories of potential effects for aviation activities in the U.S. The risk matrix reflects the baseline standard for aviation safety on a per-flight-hour basis. This metric treats any number of flight hours ( n ) as independent trials, with some probability ( p ) of a failure during any of those hours. SRM practitioners may wish to translate between calendar-based and probability-based metrics when applying the standard established by the risk matrix; conversions are described in the sections below.

a. Determining a Calendar-Based Metric from a Probability. In some instances, a risk analysis may lead to quantification of risk in which the probabilities of potential effects are plotted against associated severity categories. However, to clearly communicate the implied safety risk, the results may be augmented by providing a calculation of the expected value. This is accomplished as follows: (1) Determine the number of flight hours ( n ) of interest and the relevant time period. For demonstration, an activity flies 100,000 flight hours per week.

(2) Determine the probability of an effect in the severity category of interest. For -5 demonstration, an effect has a probability ( p ) of 0.00001 (1 × 10 ).

(3) Multiply the number of hours ( n ) by the probability of failure ( p ).

(4) 100,000 hours/week × 0.00001/hour = 1 per week.

(5) Convert as desired to number of events per month, year, etc.

b. Determine a Probability from a Calendar-Based Metric. In some instances, some number of occurrences of an event is expected over some period. This information may be used as the basis for expressing a probability by reversing the calculations discussed in the preceding section.

(1) Determine the number of flight hours ( n ) of interest and the relevant time period. For demonstration, an activity flies 100,000 flight hours per week.

(2) Determine the expected number of occurrences of an effect in the severity category of interest during that period. For demonstration, an effect is expected to occur once per week.

(3) Divide the number of occurrences per week by the number of hours per week.

-5 (4) 1 per week ÷ 100,000 hours/week = 0.00001/hour (1 ×10 ).

13. Equivalency. While the risk guidelines established by Figures C-1 and C-2 are expressed on a per-flight-hour basis, not all risk assessments will use flight hours as a basis for data collection and evaluation. When flight hours are not a practical metric, a conversion to flight hours or an estimate of equivalency may be necessary. The following examples may assist practitioners with developing estimates for unique safety assessments.

a. Appropriate Unit of Risk. In any risk analysis, careful consideration should be given to the appropriate parameter that establishes the risk exposure. For example, systems on an aircraft are in continuous operation, so their failure or malfunction can occur throughout the flight. Therefore, C-7 09/29/23 8040.4C Appendix C evaluation of risk, and comparison to the risk guidelines is likely best performed on a per-flight-hour basis. Contrast this with a gear collapse from a hard landing. The exposure to the hazard is a function of landing; the number of hours in flight has no effect on the risk. In this case, using flights rather than flight hours is more appropriate to quantify the risk.

(1) Accordingly, additional consideration should be given to applying the risk guidelines in terms of a per-flight rather than per-flight-hour basis. For example, there may be an aircraft operating 12-hour flights (thus 1 landing per 12 hours), whereas another aircraft may operate short flights and have 12 landings per flight hour. The risk process being used should consider the questions and implications of the various alternatives.

b. Equating Flights to Flight Hours. If a risk assessment is conducted on a per-flight basis, an hours-per-flight estimate may be used to establish equivalency.

(1) Commercial Aviation Example. If an SRM Team convenes to consider a commercial 14 CFR part 121 proposal, data from 2009 through 2018 shows these operators flew approximately 18M flight hours per year while flying approximately 9M flights per year. This leads to an average of 2 hours per flight. Therefore, if an SRM Team estimates an event occurs at an average of 1 per 1M flights, an equivalent estimate would be 1 per 2M flight hours.

(2) GA Example. The SRM Team would develop estimates of the number of flight hours per flight for the particular GA operation in question and use that factor for the conversion to flight hours.

c. Equating Operations to Flight Hours. If a risk assessment is conducted on a per-operation basis, an hours-per-operation estimate may be used to establish equivalency.

(1) Commercial Aviation Example. Continuing with the example from subparagraph 13b(1), since each flight includes one takeoff and one landing, 14 CFR part 121 operators averaged 1 operation per hour. In this unique case, the per-hour risk guidelines are equivalent to the per-operation risk guidelines.

(2) GA Example. The SRM Team would develop estimates of the number of flight hours per operation for the particular GA operation in question and use that factor for the conversion to flight hours. For example, an SRM Team evaluating operations at certain non-towered airports may determine that virtually all of an estimated 80M annual operations at these non-towered airports are flown by various GA aircraft. The same SRM Team may determine this accounts for about 80% of an estimated 25M GA flight hours per year. Dividing 80M operations by 20M flight hours results in a conversion factor of 4 operations per hour.

d. Equating Non-flight Operations to Flight Hours. In some cases, operations may not refer to aircraft flights but to air traffic operations. For example, there may be multiple Air Traffic Control (ATC) hand-offs per flight. Again, the SRM Team would be expected to provide estimates of the number of hand-offs per flight in order to translate the per-hour risk guidelines.

14. Cumulative Probability . When the risk plotted for any hazard results in a probability that lies close to the dividing line between Low to Medium or Medium to High, consideration should be given to calculating the cumulative probability of effects at each level of severity. This is done by plotting C-8 09/29/23 8040.4C Appendix C the sum of the probability of the effect and the probabilities of all other effects that are more severe.

This calculation will yield the probability of all effects that are at least as severe as the category in question.

C-9 09/29/23 8040.4C Appendix D Appendix D. Disclosure for FAA Personnel to Participate on SRM Teams The Federal Aviation Administration's (FAA’s) participation on a Safety Risk Management (SRM) Team established and led by entities outside the FAA is voluntary, and FAA personnel can leave SRM Team meetings any time they choose.

The FAA has the responsibility and authority to conduct regulatory oversight in the aerospace system. FAA participation on the SRM Team in no way affects the FAA’s ability to pursue any compliance action or enforcement actions that it deems appropriate and to use information obtained in connection with its membership on the team in such actions.

FAA employees’ participation on the SRM Team does not constitute FAA’s endorsement of the findings of the SRM Team or any actions that result from the assessment conducted by the team.

Further, when an FAA employee participating on an SRM Team provides an opinion or adds to the team’s discussion or knowledge base in any way, that employee is not providing an official FAA position on the topic. For an official FAA position or interpretation, a formal request must be submitted to the FAA.

The undersigned acknowledges that he/she has received this document and understands the scope of the FAA employee’s participation on the SRM Team as set forth above.

______________________________ ___________________ Authorized Representative (signature) Date ______________________________ Authorized Representative (print) D-1

Safety Risk Management Policy

Overview

Key points

Document

Source & rights

Document details