Unmanned Aircraft Systems (UAS) Safety Risk Management (SRM) Policy

09/01/23 8040.6A Chapter 1. General Information 1. Purpose of This Order. This Order establishes the methods by which the FAA manages applicants’ requests to operate unmanned aircraft systems, and how AVS performs safety risk management in accordance with FAA Order 8040.4, Safety Risk Management Policy. This Order defines the scope, roles and responsibilities, triage, governance, SRM triggers, and includes an outline for documenting SRM steps. This Order also clarifies responsibilities and describes the duties of Air Traffic Organization (ATO) and AVS to facilitate repeatable work processes when handling waivers. Exemption requests are currently handled per 14 CFR Part 11.

Processes contained herein support FAA Order 8040.4, establishing a safety risk baseline with common hazards and mitigations, that enable the FAA to address safety risk associated with UAS operations in the National Airspace System in a more consistent, coordinated, and timely manner.

2. Audience. The chapters in this document (except Chapter 4) apply to the same FAA lines of business as described in FAA Order 8040.4. The SRM steps in Chapter 4 only apply to AVS.

3. Where to Find This Order. This Order is available on the FAA website at http://www.faa.gov/regulations_policies/orders_notices / 4. Cancellation. This Order replaces FAA Order 8040.6, Unmanned Aircraft Systems (UAS) Safety Risk Management (SRM) Policy, dated October 4, 2019.

5. Explanation of Policy Changes. This revision does the following: a. Adds and clarifies terms and definitions in Appendix A.

b. Updates information in Chapter 4 providing guidance for recommended training prior to a participant serving on a panel.

c. Updates severity and likelihood definitions in Appendix C and adds a matrix that is more focused on quantitative assessments and aligns with FAA Order 8040.4.

d. Clarifies SRM triggers, governance and triage steps in Chapter 3 to align with FAA Order 8040.4.

e. Updates UAS hazards, mitigations, and outcomes in Appendix B.

f. Updates the roles and responsibilities in Chapter 3 per the memorandum of agreement between AVS and ATO.

6. Background. The FAA’s mission is to provide the safest, most efficient aerospace system in the world. In support of this mission, the FAA uses a Safety Management System – the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk. Safety Risk Management is one of the four components of SMS that enables the Agency to effectively manage safety across the NAS. As a newer entrant into the NAS, UAS are striving to get the quantity and depth of data needed to make better decisions, like that of manned aircraft. The UAS industry has experienced exponential growth as demonstrated 1-1 09/01/23 8040.6A by the number of drone registrations, airspace authorizations, waivers, and certificated remote pilots, and continues to grow. The regulatory system is striving to keep up with the pace of UAS technology and the unique nature of hazards and mitigations in these operations. Thus, this Order establishes the SRM process for UAS requests and provides a generalized list of common hazards and possible mitigations that should be considered with each applicable assessment.

Those involved in the identification and management of risk must evaluate the unmanned aircraft (UA), its associated elements (AE), the proposed operation, and the operational environment to identify all hazards that may be introduced or impacted by UAS operations in the NAS.

7. Scope. This Order describes FAA activity from the point at which a UAS operator makes a request to operate in the NAS, until the FAA responds to the applicant, either granting approval or denying the request. The SRM process is scalable to establish a new national policy or by an individual assessing a waiver. This document supplements and does not supersede requirements contained within FAA Order 8040.4 and may be used to assess NAS changes as they pertain to UAS. This Order focuses on hazards that expose persons or property to harm or damage, within the NAS or on the ground, while the UAS is prepared for flight and during UAS operations.

Ensuring hazards are identified and sufficient mitigations are in place helps ensure the safety of individuals involved in flight operations, as well as nonparticipants on the ground and in the air.

Pursuant to SMS, this Order does not address occupational safety/health issues or consider typical workplace hazards such as slips/falls, chemical exposure, hearing, or eye protection.

1-2

09/01/23 8040.6A Chapter 2. Roles and Responsibilities 1. General. This section defines roles and responsibilities for the FAA, as a regulator, in identifying hazards, assessing safety risk, and evaluating the effectiveness of proposed risk mitigations in support of FAA decisions regarding the operation of UAS in the NAS.

2. Roles and Responsibilities.

a. Receiving Organization. This is the FAA organization that receives requests concerning a UAS operation and is typically the Office of Primary Responsibility (OPR). The receiving organization follows FAA Order 8040.4 and associated FAA SRM processes andensures coordination with stakeholder organizations in the FAA.

b. Office of Primary Responsibility (OPR) . In general, the OPR is the FAAorganization with oversight responsibility for the regulation(s) from which the applicant is requesting an exemption or waiver. In the case of multiple OPRs, each OPR evaluates the portion they oversee and coordinates with the other OPRs.

(1) UAS Program/Project Leads. The UAS Program/Project Leads are appointed by and generally reside within the OPR. They will: (a) Follow the current SRM processes and apply the appropriate line of business SRM process to assess safety risk associated with the UAS operational approval.

(b) Coordinate with applicable stakeholders in accordance with (IAW) this Order.

(c) Facilitate the SRM process or identify an SRM Panel facilitator within the appropriate LOB, if necessary.

(d) Ensure the SRM process is properly documented IAW the appropriate LOB process. The panel facilitator or a designee may write the SRM document. The FAA may also use the operators’ safety risk assessment if they feel it has identified all relevant hazards and accurately captured the risk level. In either case, the document must be coordinated with the OPR(s).

(e) Communicate with the applicant regarding the FAA response to requests to ensure seamless coordination between FAA offices.

(f) Brief the appropriate management level or executive(s) when SRM decisions need to be elevated.

c. Risk Acceptor(s). The risk acceptor is a management official, or officials, in the FAA OPR(s) with authority for overseeing the proposed UAS operation. The risk acceptor(s) decides whether the predicted residual risk is acceptable. The risk acceptor(s) seeks to understand the predicted residual risk associated with the proposed operation and may choose to accept that safety risk by approving the operation.

d. The Safety Analyst or Team. FAA subject matter experts (SMEs) selected by the OPR to participate in the safety risk assessment as a panel member. Each organization within the FAA with regulatory oversight responsibility for the regulation(s) associated with the request must 2-3 09/01/23 8040.6A have SME participation throughout the safety risk assessment. SME responsibilities include: (1) Considering whether the mitigation strategy is sufficient, to ensure that the predicted residual risk is not exceeded.

(2) Identifying hazards that are introduced or affected by the proposed UAS operation.

(3) Assisting with the safety risk analysis and/or verifying that the applicant’s analysis is complete and accurate.

(4) Providing a clear and accurate picture of safety risk associated with approval of the UAS request.

(5) Substantiating severity and likelihood determinations by documenting the rationale used.

(6) Providing rationale for disagreement with the SRM Panel’s assessment (dissenting opinion) where appropriate.

3. LOB Coordination. In general, the primary stakeholders for UAS requests are Flight Standards Service (FS) and Aircraft Certification Service (AIR) in AVS, and Mission Support Services (AJV) in the ATO. The Services/Offices (S/O) are often the OPR, conduct SRM or request facilitation from UAS Integration (AUS-430), and serve as the risk acceptor for regulations within their purview. To ensure a thorough and well-rounded safety analysis, other AVS S/Os and FAA LOBs may be invited to serve as SMEs. AVS and ATO responsibilities are further described below: a. Aviation Safety (AVS). AVS is the OPR responsible for approving mitigations that rely on aircraft systems, third-party systems, or operator procedures and training, where the operator/proponent retains responsibility for collision avoidance.

(1) Flight Standards Service (FS)/Aircraft Certification Service (AIR)/Office of Aerospace Medicine (AAM). FS, AIR, and AAM each conduct SRM and serve as the risk acceptor when a UAS request pertains to the regulations that S/O oversees. They ensure coordination across FAA organizations prior to providing a response to the applicant, as necessary. As the OPR and risk acceptor, they use accepted data in the following order: analytical, empirical, and lastly judgmental to determine whether mitigations are sufficient. To ensure a thorough and well-rounded safety analysis, other AVS S/Os and FAA LOBs may be invited to serve as SMEs.

(2) Office of Rulemaking (ARM). ARM is not a risk acceptor. They receive and manage the review and coordination of UAS rules and exemptions.

(3) Unmanned Aircraft Systems Integration Office (AUS). AUS is not a risk acceptor and has the following responsibilities: (a) Safety and Integration Division (AUS-400). AUS-400 supports FAA offices by evaluating UAS operational requests and assisting with SRM in coordination with the OPR. When a project involves multiple organizations, AUS supports intra- agency coordination as outlined in FAA Order 8040.4. When a request is made 2-4 09/01/23 8040.6A through a partnership program, AUS-400 will assign an AUS Project Manager (PM) to facilitate a “one FAA voice” philosophy.

(b) Program Manager (PM). The AUS PM manages coordination across FAA organizations for any UAS requests through established partnerships. The AUS PM engages with stakeholders and assists in finding solutions for technical issues.

b. Air Traffic Organization (ATO) . ATO is the OPR responsible for approving mitigations that promote the safe, orderly, and expeditious flow of air traffic, including mandatory services required for the purpose of preventing collision between known aircraft and Air Traffic Control (ATC) requirements within controlled airspace.

c. Air Traffic Safety Oversight Service (AOV). AOV supports AVS and FAA missions through independent oversight of the ATO’s provision of air traffic services using risk- based, data-supported surveillance methods to monitor the safety of the NAS. AOV must approve controls that are designed to mitigate or eliminate initial or current high-risk hazards before ATO can implement the change. AOV supports ATO SRM Panels.

d. Security and Hazardous Materials Safety (ASH). ASH conducts SRM to assess the safety risk for UAS requests that may include hazardous materials. ASH might also be asked to participate as a SME in AVS or ATO-led SRM activities.

2-5

09/01/23 8040.6A Chapter 3. Triggers, Governance, and Triage 1. SRM Triggers. There are two basic triggers for applying SRM. The first is the discovery of potential hazards or ineffective controls from the Safety Assurance process, e.g., safety issues.

The second is a Planned Change, e.g., new regulations.

Regulations serve as safety risk controls. Requests for relief from applicable regulations, waivers, and exemptions, must be evaluated to determine if gaps in regulations, standards, procedures, and guidelines would require planned changes to address the shortfall. FAA organizations with product/service provider oversight responsibility must apply the concepts of SRM to decisions that may lead to the initiation of regulatory changes through rulemaking.

Doing so ensures that regulations address hazards in the aerospace system and provide boundaries on the acceptability of the design and performance of products and services.

Regulations and subsequent oversight activities are part of a systematic strategy of risk control.

The FAA as a regulator does not own the systems or operations, rather the product/service providers own and control their operations. Within the limits of the regulator’s authority, the regulator may apply controls to product/service provider activities and operations. These controls are promulgated through regulations, standards, procedures, guidelines, etc.

Since regulations are risk controls, requests for relief from applicable regulations (e.g., waivers, exemptions) must be evaluated to determine if gaps in regulations, standards, procedures, and guidelines would require planned changes to address the shortfall. Operational approvals such as waivers may be granted if existing policy and established controls are sufficient in addressing the potential hazard without the need for further SRM.

2. Governance. UAS Program/Project Leads must apply the following governance model and triage steps (Figure A) to help ensure timely coordination across FAA organizations, consistent application of SRM, if required, and uniformity of FAA responses to applicants for UAS requests. For additional details regarding roles and responsibilities, see Chapter 2.

If a proposed UAS operation does not result in a new change it will be filtered through existing processes. In cases in which the proposed operations may require the development of new policies, SRM must be applied. SRM will be conducted IAW the applicable SRM Order(s) (this Order, FAA Order 8040.4, and/or the ATO SMS Manual). The Triage Steps (Figure A) help the UAS Program/Project Leads determine which process applies. Chapter 4 of this Order identifies how AVS meets requirements for situations in which FAA Order 8040.4 applies.

3. Triage Steps. When an applicant requests a waiver or an exemption, a new rule is proposed or a change to a rule is proposed, the receiving UAS Program/Project Leads must answer the following questions (Figure A) to ensure appropriate coordination and handling of the request.

3-6 09/01/23 8040.6A Figure A - Triage Steps Triage Steps: a. Does the planned change control, generate, or affect an aviation hazard, e.g., was a hazard identified because of an SRM trigger, e.g., a precursor or planned change to the NAS?

If yes: SRM is required and proceed to paragraph b.

If no: SRM is not required. Document the rationale as to why no new hazards are introduced and no known hazards are affected, or why the safety risk associated with the previously approved operation is still valid.

b. Has the associated safety risk been previously assessed and verified?

Risk is a result of a hazard. The safety analyst or team needs to determine if the safety risk(s), or if the safety hazard(s) associated with the proposed operation have been previously assessed.

The UAS Program/Project Leads review and assess the operation to identify any gaps not satisfied by existing policies . If there are questions concerning previously assessed mitigations by another LOB, the UAS Program/Project Lead will coordinate with the other LOB. The UAS Program/Project Leads determine whether existing controls exist to address the safety risk.

3-7 09/01/23 8040.6A If yes: proceed to paragraph c.

• If the hazards associated with a proposed operation have been previously assessed, the analyst should consider whether the severity and likelihood is impacted by other factors, e.g., system state. If they are not, no SRM is required.

The analysis and reason for not performing a full SRM must be documented.

If no: SRM is required.

• If the hazards associated with the proposed operation have not been previously assessed and verified, and adequate controls do not exist to address the safety risk, SRM is required. If some, but not all, of the hazards have been previously assessed and verified, SRM is required on the differences/changes to the NAS.

c. Are there differences/changes from the precedent-setting approval?

When safety risks associated with a proposal are not addressed by existing controls, the request must undergo SRM analysis. The resulting safety risk assessment may require new controls for that type of operation, which should inform updates to the applicable regulations, standards, procedures, approvals, guidelines, etc. If the proposed operation is only partially covered by existing controls, then a risk assessment is only required on the differences.

After determining if the gap will be addressed through changes to widely applicable policies or if the proposal must be evaluated based on specifics to the request, the UAS Program/Project Leads determine the applicable SRM process. Note: When some operations are approved for experimental reasons with a very limited scope, they should be addressed on an individual basis. After identifying new controls within the applicable process, additional safety analysis must be performed to ensure that no new hazards have been introduced or that existing safety risk controls have not been compromised based on the proposed safety risk controls.

If yes: SRM is required on the differences and changes.

If no: SRM is not required. Document the rationale and proceed to paragraph d.

d. Is the safety hazard associated with the previously approved operation still valid (if applicable)?

The UAS Program/Project Leads consider the validity of existing governing policies.

Factors such as technological advances, changes in the acceptable risk level, and improved operational experience may impact the validity of the previously evaluated operations. The safety risk identified for a previously evaluated type of operation may no longer be valid if the monitoring results indicate increased safety risk or inaccurate safety risk predictions. The goal is to have an accurate understanding of safety risk when deciding whether existing policies are sufficient.

3-8 09/01/23 8040.6A (1) Safety risk analyses for previously evaluated operations simply provide a starting point for the rationale that the safety risk associated with a given request for appropriate action is controlled to a level of safety required by the existing processes.

(2) Previous approvals do not eliminate the need for continuous monitoring of UAS related safety risk, e.g., Safety Assurance functions, or the potential need for updating established controls. The need to re-apply SRM based on UAS-related occurrence reports is at the discretion of FAA management (refer to “SRM Triggers” at the beginning of this chapter). Continuous monitoring and continuous improvement of UAS-related safety risk (e.g., collecting and reviewing occurrence reports, precursor data, and employee reporting) must be conducted IAW FAA Order 8000.369 and FAA Order 8040.4, SRM and Safety Assurance Processes, as well as the monitoring plan of each approved safety risk assessment. In the case of a UAS request renewal, e.g., annual UAS events, synchronized UAS lightshow performances, or previously approved UAS operations in a new geographic location, SRM needs only to be applied to changes within the environment, operation, and/or mitigation strategy. If it is determined that a safety risk assessment is not required, the rationale for that decision must be documented. After the rationale has been documented and all stakeholders have been consulted, the OPR may process the request for appropriate action in accordance with the OPR process. Decision-makers can compare safety assurance and monitoring data to the safety risk guidelines on the risk matrix to understand whether action is needed for risk to remain at acceptable levels.

If no: Continue with the SRM process, e.g., assess further.

If yes: SRM is not required. Document the rationale as to why no new hazards are introduced and no known hazards are affected, or why the safety risk associated with the previously approved operation is still valid.

4. Determine SRM Process and Panel Leads. If SRM is required: a. AVS and ATO understand that timely forthright communications will be key to accomplishing these efforts. AVS and ATO will remain committed to ensuring an efficient flow of necessary information and maintaining open lines of communication. Based on the criteria outlined below, determine which SRM processes and which LOB will lead, AVS, ATO, or both.

(1) AVS is responsible for conducting SRM using , this process, 8040.4 or any S/O approved process when mitigations rely on aircraft systems, third-party systems, or operator procedures and training, where the operator/proponent retains responsibility for collision avoidance are required to be assessed. These include but are not limited to the following: (a) Onboard detect and avoid (DAA) technology solutions (b) Airframe-based solutions Note SRMs can be conducted separately with each LOB assessing their appropriate mitigations, but there is nothing that would restrict both LOBs from working together on a SRM assessment if both LOBs agree on which LOB leads and which process to use.

3-9 09/01/23 8040.6A (c) Pilot requirements and qualifications (d) Chase plane – Chase plane aircraft performance requirements and characteristics to meet pilot requirements of §91.113 (e) Ground-based DAA technologies that are new entrant technology and are non-NAS systems (f) Operational use of NAS-based information by the operator (g) Pilot procedures (h) Assessment of the radio frequency interference risks associated with the proposed spectrum (as identified by ATO), ensuring the applicant proposes acceptable mitigations (with concurrence from ATO if the risk could affect NAS systems) necessary to address the risks (2) ATO is responsible for conducting SRM using the ATO SMS Manual when mitigations that promote the safe, orderly, and expeditious flow of air traffic, including mandatory services required for the purpose of preventing collision between known aircraft and ATC requirements within controlled airspace are required to be assessed. These include but are not limited to the following: (a) Ground-based DAA technologies that are, or will have the potential to interact with, NAS systems or will interact with or are defined as NAS Data (b) Navigation technologies that are, or will interact with, NAS systems (c) As it relates to air traffic service requirements in controlled airspace, or air traffic policy to include air traffic procedures: 1) Communication with air traffic 2) Procedures to provide separation service between the unmanned aircraft and any other aircraft 3) ATC clearance (d) Charting provided by the FAA (e) Operational use of NAS-based information by the operator (f) Evaluation of radio frequency spectrum for compliance and compatibility with spectrum allocations and identify the interference risks associated with the proposed spectrum (g) ATC provided, or third-party services required by the FAA to prevent collision between aircraft in controlled airspace (h) Aircraft equipage that interacts with ATC secondary surveillance systems 3-10

09/01/23 8040.6A Chapter 4. AVS SRM Requests 1. Introduction. The steps in this chapter apply to UAS actions in AVS’s purview as noted in Chapter 3, Section 4. The safety risk assessment will provide this information so that they may determine whether the residual risk level is acceptable or not. Taking a holistic approach to the UA and its associated elements to risk analysis means accounting for the strengths and gaps of each mitigation layer and understanding the totality of all the measures are sufficient to maintain an acceptable level of safety. The SRM process and resulting documentation provide the risk acceptors with a clear and accurate picture of the safety risk, informing their decision to grant approval or deny a request.

2. Risk Analysis/Assessment. AVS may accept the applicant’s risk analysis or perform a risk assessment using an SRM process. If the applicant’s risk analysis is accepted, this indicates AVS concurrence. Once the applicant’s risk analysis is accepted or an SRM Panel is completed, the analysis is documented and maintained in accordance with FAA Order 8040.4. Appendix D, Safety Risk Management Template may be used as a sample to outline the topics for documenting the risk analysis. The UAS industry and data sources continue to evolve, therefore a safety analyst or team should use the best available data and SMEs to make their determinations and document the rationale. This chapter expands on, but does not supersede, the information contained within FAA Order 8040.4. Questions regarding FAA Order 8040.4 should be directed to the AVS Safety Management and Research Planning Division (AVP-300).

3. UAS SRM Process . A thorough understanding of the safety risk components requires an examination of the factors that increase or decrease the likelihood of system events, e.g., identify and document hazards, analyze and assess potential risks, and develop appropriate mitigation strategies.

a. Identify Safety Analyst or Team . Depending on the request under consideration, the safety risk analysis may be conducted by an individual or a team. It is important that the individual analyst or team members conducting the analysis have the appropriate subject matter expertise and SMS training. It is imperative that all necessary AVS and FAA stakeholder organizations are involved. The safety analyst or team reviews the application package and other available information to determine the level of safety. Each analyst or team member must complete the AVS SMS SRM Overview course prior to participating on an AVS UAS SRM Panel for the first time, and again when the course is updated. The current course, FAA Safety Risk Management Overview (FAA27000023), may be found in the FAA’s Learning Management System.

b. System Analysis. The applicant provides the technical and operational information needed for the safety analyst or team to verify or perform SRM. The following information/documentation may be provided by the UAS applicant: (1) Concept of Operations (CONOPS) describes the operational scenarios, environment, risk assessment, and safety case. It includes a description of each hazard and mitigation, operational procedures and manuals, and test documentation or flight time. The applicant’s submission should contain: 4-11 09/01/23 8040.6A (a) determined risk levels (b) identified hazards (c) potential effects before mitigations (d) mitigation with rationale (e) a statement of how each mitigation is expected to reduce the severity, and likelihood of the risk’s effect (f) test results or modeling to validate the mitigations (if available) (g) determined severity category (Table C-1) -9 (h) determined likelihood value expressed in scientific notation, e.g., 1x10 , Table C - (i) determined level of predicted residual risk and rationale, after mitigations (2) The safety analyst or team reviews the CONOPS, risk assessment, and/or safety case, or other risk assessment tool, to ensure completeness and accuracy. Additional hazards that were not originally outlined in the applicant’s documentation may be identified by the analyst or team. The analyst, team, or facilitator documents the system assessment with information pertaining to at least the following elements of the operation: (a) Aircraft and its Associated Elements – Identify characteristics of the UAS that have the potential to affect the severity and/or the likelihood of the risk.

1) Examples of characteristics may include equipment, size, aircraft weight, payload weight, speed, composition, configuration, software assurance, contingency features, airworthiness, camera/visual components, sensors, maintenance procedures, applicable limitations, command, control, communications (C3) link, DAA, etc.

(b) Airman/Operator – Identify specifics pertaining to the airman/operator (responsible person), Part 137 agriculture operator, Part 135 air carrier certificate holder, etc., that have the potential to affect the severity and/or likelihood of the risk. Examples include other crew members, experience, certification, required training, pilot’s location, Visual Observers (VOs), safety culture, track record, procedures, contingency actions, training manuals, training curriculum, pilot intervention, applicable limitations, etc. Identify the number of aircraft being managed by a single pilot or crew. Note the expected effect on pilot/crew workload of failures that require an alteration in the management of these aircraft and what mitigations are available to handle any changes in workload.

(c) Airspace/Operating Environment – The NAS is a shared resource, and therefore all users must adapt their ways of operating so that the airspace remains safe as new entrants emerge. The FAA recognizes that unmanned aircraft operations typically take advantage of lower altitudes where the airspace may be less congested, and perhaps a safer area to incorporate UAS operations, representing an efficiency gain in the NAS. Consideration should include how the airspace and environment are being used for the request, e.g., class of airspace, traffic density, Note: Detect-and-Avoid (DAA) is not an ATC separation standard nor an alternate means of achieving ATC separation responsibilities. DAA systems provide surveillance, alerting, and maneuver guidance that are critical to unmanned aircraft systems’ (UAS) ability to maintain separation from hazards such as manned aircraft and other unmanned aircraft.

4-12 09/01/23 8040.6A speed of other traffic, complexity of airspace, adjacent airspace, altitude of operations, communication with ATC, UAS Traffic Management (UTM), awareness of other operators, applicable limitations, types of manned and unmanned aircraft the UA may encounter, etc. Other considerations may include how elements of the operating environment have the potential to affect the severity and/or likelihood of the risk. For example, population density, prevailing or possible weather conditions, season of operation, time of day, proximity to airports, type of operations at nearby airports and in the area (jet, piston, rotorcraft, skydiving, glider, etc.), terrain, structures, duration of the operation, other UAS operations in the area, number of operations planned per day, applicable limitations, lateral and vertical boundaries of operating area, carriage of hazardous materials (HAZMAT), security issues, etc.

(3) When an application does not provide adequate information, a Request for Information (RFI) may be sent to the applicant to ask for information to complete the safety risk assessment.

c. Identify Hazards, Risks, Causes, Effects and Outcomes. During this step, the SRM analyst or team must identify hazards, risk levels, causes, effects, and outcomes. A hazard is a condition that could foreseeably cause or contribute to an aircraft accident. When analysis reveals that a condition could cause damage to an aircraft or injury to a person, regardless of the severity, it should be assumed that the condition could cause an accident and therefore meets the definition of a hazard. Hazard is a constant, and risk is a result of the hazard. Risk may be mitigated or eliminated, meaning risk needs management, e.g., Safety Risk Management.

(1) The safety analyst or team must identify and document the causes of the hazards using information from the applicant, common hazards listed in Appendix B, and the system assessment. Hazards controlled by the rule being relieved must be assessed. The safety analyst or team must also identify and document the causes of the risk. The list of hazards in Appendix B is a starting point, and all hazards applicable to the operation must be identified and recorded. Refer to the list below for UAS hazards with the worst credible outcome. For exemptions, 14 CFR §11.81 requires that an alternative to compliance not adversely affect safety or provide a level of safety at least equal to that provided by the rule being relieved. A Certificate of Waiver (CoW) or Certificate of Authorization (COA) authorizing relief from regulations may be issued if the UAS operation can be conducted with an equivalent level of safety under the terms of the CoW/COA.

(a) Collision between an UAS and a manned aircraft in the air (b) Collision between two or more UAS (c) Collision between a UAS and person on the ground or a moving vehicle (d) Collision between a UAS and critical infrastructure on the ground (e) Collision between a UAS and terrain (CFIT) (f) Near Midair Collision (NMAC) between UAS and a manned aircraft in the air (g) Manned aircraft making an evasive maneuver to avoid UA (proximity from UA Note: Carriage or transport of HAZMAT, and/or security matters may require participation by the FAA’s Office of Security and Hazardous Materials Safety (ASH).

4-13 09/01/23 8040.6A remains greater than 500 feet) (h) Collision between UAS component(s) and persons and/or property (i) Collision between package/cargo and persons and/or property (2) The safety analyst or team must also consider less severe outcomes. Less severe outcomes may have higher likelihoods and a higher risk level than hazards with catastrophic outcomes and lower likelihoods. These less severe outcomes must also be assessed and documented during the safety risk analysis. For example, NMAC without evasive action between a manned aircraft and a UAS may not result as catastrophic, but it may be more likely to occur, thus raising the residual risk level. Some less severe hazards include but are not limited to: (a) Technical Issue with UAS (b) Deterioration of external systems supporting the UAS operation (c) Human Error (d) Adverse operating conditions (e) Unable to Detect and Avoid d. Analyze Safety Risk. During this step, the safety analyst or team must determine the initial risk levels expected with the proposed UAS operation, new regulation, or modification to a regulation. The initial risk is based upon the proposed operation including applicant controls and existing controls , the new regulation, or change to the regulation. Existing controls are always looked at prior to determining credible outcomes. Existing controls are verified controls and may be provided by the FAA or by the applicant. For initial risk, the safety analyst or team relies upon information provided by FAA stakeholders or the UAS applicants, e.g., the system assessment, and their own FAA SMEs to determine the severity and likelihood of the hazard’s outcomes. The safety analyst or team’s rationale for how they arrived at their determination is just as important as the severity and likelihood. The Severity and Likelihood definitions (Appendix C, Table C-1 and Table C-2, respectively) and Risk Matrix (Appendix C, Figure C-1) are used to better define the safety impact of the proposed UAS operation and to ensure consistency of term usage.

(1) Severity – The potential consequences or impact of a hazard’s effect in terms of degree of loss or harm. Refer to Appendix C Table C-1: Severity Definitions.

(a) What are the credible outcomes for severity? (e.g., catastrophic, hazardous, major, minor, minimal) (b) Why? (e.g., data, line of thought, expertise, rationale for how the safety analyst or team arrived at the determination) (c) How do existing controls and additional mitigations change the aircraft, airman/operator, or airspace/operating environment, such that the severity is reduced?

(2) Likelihood – The estimated probability of frequency, in quantitative or qualitative terms, of the outcome(s) associated with a risk. Refer to Appendix C Table C-2: Likelihood Definitions. New sources of data and the findings from various research efforts have validated a mathematical basis for the many variables in UAS operations.

This is enabling the FAA to turn to an emerging quantitative framework that minimizes the use of subjective assumptions. When sufficient empirical data exists, 4-14 09/01/23 8040.6A statistical probabilities should be used, e.g., airspace and ground density data.

(a) What is the likelihood of each hazard’s credible outcome? (e.g., frequent, infrequent, extremely infrequent, remote, extremely remote, improbable, extremely improbable) (b) Why? (e.g., data, research, line of thought, expertise, rationale for how the safety analysis or team arrived at their determination) (c) How do mitigations change the aircraft, pilot, airspace/operating environment, such that the likelihood is reduced?

e. Validity of Mitigations. The safety analyst or team must consider the validity of mitigations presented by the applicant or FAA stakeholders as part of the layered approach to mitigating risk. What evidence does the FAA have that the mitigations are effective (e.g., test data, third- party verification)? How are the mitigations dependent on each other? How much credit should be given for the mitigations? Is there asingle point failure? This information must be included in the SRM documentation.

f. Assess Safety Risk . A risk matrix provides a visual depiction of the safety risk levels and enables prioritization in the control of the hazards. Appendix C, Figure C-1: Risk Matrix General Aviation is the risk matrix used during this step. The safety analyst or team uses the determined severity and likelihood to plot the initial risk level on the risk matrix. The safety analyst or team documents the initial risk level(s), the rationale of how the severity and likelihood were determined, and compares the level(s) against the risk acceptance criteria.

g. Additional Safety Risk Controls and Residual Safety Risk . During this step, the safety analyst or team assesses the need for additional controls (e.g., conditions and limitations in exemptions and special provisions in waivers) to reduce the risk of the operation to an acceptable level. Conditions and limitations and special provisions are intended to document specific safety risk controls presented by the FAA. Further analysis is performed to ensure that the UAS operation’s mitigations do not introduce new hazards, impact existing hazards, or compromise existing safety risk controls. The safety analyst or team must record a description of the additional safety risk controls that were considered prior to analyzing and assessing the residual safety risk. The safety analyst or team documents the new severities, likelihoods, rationale, and residual risk level on the risk matrix with the additional safety risk controls considered.

h. Safety Risk Acceptance. Once the assessment is complete and the findings and alternatives/proposals for safety risk mitigations/controls are documented, the results are delivered to the appropriate management official within the OPR. The OPR is responsible for obtaining necessary approval(s) and safety risk acceptance(s). The appropriate management officials either accept the safety risk associated with the identified hazard(s) within their purview or send the assessment back to the panel for additional analysis or identification of additional proposed alternatives for safety risk mitigations/controls. Risk acceptance is a management decision. However, the risk acceptor cannot modify the risk levels determined by the SRM team. Hazards may also be identified through the Safety Assurance functions used to monitor the aerospace system. In these situations, it is necessary to determine whether continued operation is acceptable (and for how long) while 4-15 09/01/23 8040.6A new safety risk controls are introduced. If an existing hazard is identified and the operation is allowed to continue, any risk associated with the hazard is inherently accepted by management officials and/or the FAA.

i. Safety Performance Monitoring and Hazard Tracking. When the safety risk assessment is complete, residual risks must be tracked and monitored in accordance with FAA Order 8040.4 for medium and high residual risk levels. Per the monitoring plan, safety performance monitoring is conducted to verify the risk assessment and the safety controls.

The safety analyst or team provides a description of the data to be collected, at specific intervals for a specific duration, defines safety performance targets for each hazard, and provides the point of contact (POC) responsible. The safety performance targets are used to verify the predicted residual risklevels.

Initial UAS Safety Risk Acceptance Safety Risk Level Associate Administrator for Aviation Safety High Risk Division or appropriate office manager Medium Risk (e.g., the appropriate management official within AVS who has the positional responsibility and authority for the issue or change being assessed) Low Risk Figure B – UAS Safety Risk Acceptance (1) Safety Risk Documentation . Once SRM is completed, the information must be documented in accordance with FAA Order 8040.4.

(2) Safety Performance Monitoring. Per the monitoring plan, safety performance monitoring is conducted to verify the risk assessment and the safety controls.

4-16

09/01/23 8040.6A Chapter 5. Administrative Information 1. Distribution. This order is distributed to all offices in Washington Headquarters, regions, and centers, with distribution to all field offices and facilities of the applicable FAA organizations (identified in Chapter 1, subparagraph 2).

2. Related Publications. This Order is consistent with the latest versions of the following aviation safety documents in effect at the time the Order was published: a. FAA Order 8040.4, Safety Risk Management Policy b. FAA Order VS 8000.367, Aviation Safety (AVSSMS) Safety Management System Requirements c. FAA Order 8000.368, Flight Standards Service Oversight d. FAA Order 8000.369, Safety Management System e. FAA Order 1100.154, Delegations of Authority f. FAA Order JO 1000.37, Air Traffic Organization Safety Management System g. Air Traffic Organization Safety Management System (ATO SMS) Manual 5-17 09/01/23 8040.6A Appendix A Appendix A. Terms and Definition 1. Air Traffic Control (ATC) – A service operated by appropriate authority to promote the safety, orderly, and expeditious flow of air traffic.

2. Accident – An unplanned event or series of events that results in death, injury, or damage to, or loss of, equipment or property.

a. (Manned) Aircraft Accident – An occurrence associated with the operation of an aircraft that takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage.

b. Unmanned Aircraft Accident An occurrence associated with the operation of any public or civil unmanned aircraft system that takes place between the time that the system is activated with the purpose of flight and the time that the system is deactivated at the conclusion of its mission, in which: (1) Any person suffers death or serious injury; or (2) The aircraft holds an airworthiness certificate and sustains substantial damage.

UAS accidents are defined in 14 CFR §107.9 Accident Reporting and by the National Transportation Safety Board (NTSB) in 49 CFR §830.

3. Analysis – The process of identifying a question or issue to be addressed, examining the issue, investigating the results, interpreting the results, and possibly making a recommendation.

Analysis typically involves using scientific or mathematical methods for evaluation.

4. Assessment – The process of measuring or judging the value or level of something.

5. Common Cause Failure – A failure that occurs when a single fault results in the corresponding failure of multiple system components or functions. See Single Point Failure.

6. Control – See Risk Control, Safety Risk Control. The terms Control, Mitigation, and Safety Risk Control are used synonymously.

7. Critical Infrastructure – Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. USA Patriot Act of 2001 (42 U.S.C. 5195c(e)) 8. Existing Control – A mitigation already in place that prevents or reduces the hazard’s likelihood or mitigates its effects. A control can only be considered existing if it has been validated and verified with objective evidence.

9. Hazard – A condition that could foreseeably cause or contribute to an aircraft accident.

Whenever analysis reveals that a condition could cause damage to an aircraft or injury to a A-1 09/01/23 8040.6A Appendix A person, regardless of the severity, it should be assumed that the condition could cause an accident and therefore meets the definition of a hazard. See FAA SRM Guidance for the technical definition.

10. Incident – An occurrence other than an accident that affects or could affect the safety of operations.

11. Likelihood – The chance of a hazard and an effect at a specific level of severity. See FAA SRM Guidance FAA SRM Guidance for the technical definition.

12. Mitigation – A means to reduce or eliminate the effects of hazards. See Safety Risk Control.

The terms Control , Mitigation , and Safety Risk Control are used synonymously.

13. Monitoring – Tracking and keeping information under systematic review.

14. National Aerospace System (NAS) – A complex system that is composed of airspace, airports, aircraft, pilots, air navigation facilities, and air traffic control facilities; communication, navigation, and surveillance services and supporting technologies and systems; operating rules, regulations, policies, and procedures; and people who implement, sustain, or operate the system components.

15. Office of Primary Responsibility (OPR) – The organization that manages and tracks the issue or change through closure. Their responsibilities include leading and managing the safety risk assessment, identifying the appropriate management officials to accept safety risk and approve mitigations, coordinating any necessary approvals and safety risk acceptance decisions, and coordinating with the HIRMT Oversight Team to enter results and decisions into HIRMT, as required.

16. Outcome – The potential undesirable result of a hazard or the ill effects potentially resulting from exposure to a hazard. A specific system state and sequence of events supported by data and expert opinion that clearly describes the outcome. The term implies that it is reasonable to expect the assumed combination of conditions may occur within the operational lifetime of the system.

Note: Other terms used in risk management as substitutes for outcome include consequence, effect, and result.

17. Risk Acceptance – See Safety Risk Acceptance. The terms Risk Acceptance and Safety Risk Acceptance are used synonymously.

18. Risk Control – An action used to reduce or eliminate the risk severity and/or likelihood, by applying engineering and/or administrative controls, and can be anything that mitigates or lessens the risk. Risk mitigation is synonymous with risk control. See also existing control.

Safety risk controls necessary to mitigate an unacceptable risk should be mandatory, measurable, and monitored for effectiveness.

19. Risk Matrix – Table depicting the various levels of severity and likelihood as they relate to the levels of risk (e.g., low, medium, or high). Risk matrices may be color-coded, red, green or A-2 09/01/23 8040.6A Appendix A yellow.

20. Safety Assurance – Processes within the SMS that function systematically to ensure the performance and effectiveness of safety risk controls and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.

21. Safety Management System (SMS) - The formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.

22. Safety Performance Target – A measurable goal used to verify the predicted residual safety risk of a hazard’s effect.

23. Safety Risk – The composite of predicted severity and likelihood of the potential effect of a hazard. See FAA SRM Guidance for the technical definition.

a. Types of Safety Risk (1) Initial Risk – The severity and likelihood of the risk when it is first identified and assessed, including the effects of pre-existing risk controls in the current system.

(2) Residual Risk – The remaining predicted severity and likelihood that exists after all selected safety risk control techniques have been implemented.

b. Levels of Safety Risk (1) High Risk – Severity and likelihood map to the red cells in the risk matrix (in Appendix 789 C). This safety risk requires mitigation, tracking, and monitoring, and it can only be accepted at the 790 highest level of management within LOBs and Staff Offices (see Chapter 2, paragraph 3, Safety Risk Acceptance).

(2) Medium Risk – Severity and likelihood map to the yellow cells in the risk matrix (in Appendix C). Although this safety risk is acceptable without additional mitigation, tracking and monitoring are required. However, it is desirable to achieve the lowest practicable risk levels (factoring in the principles of appropriate resource management).

(3) Low Risk – Severity and likelihood map to the green cells in the risk matrix (in Appendix C). This safety risk is acceptable without restriction or limitation; hazards are not required to be actively managed, but they must be documented and reported if a safety risk assessment has been performed.

24. Safety Risk Acceptance – The decision by the appropriate management official to authorize the operation without additional safety risk mitigation.

25. Safety Risk Analysis – The first three steps of the SRM process (analyze the system, identify hazards, and analyze safety risk).

26. Safety Risk Assessment – The first four steps of the SRM process (analyze the system, identify hazards, analyze safety risk, and assess safety risk).

27. Safety Risk Control – A means to reduce or eliminate the effects of hazards. The terms A-3 09/01/23 8040.6A Appendix A Control , Mitigation , and Safety Risk Control are used synonymously.

28. Safety Risk Management (SRM) – A process within the SMS composed of describing the system; identifying the hazards; and analyzing, assessing, and controlling safety risk.

29. Safety Risk Management (SRM) document – Thoroughly describes the safety analysis for a proposed NAS change. This document serves as a safety analysis for a given proposed change and documents evidence to support that the proposed change to the system is acceptable from a safety risk perspective. It is maintained by the organization responsible for the change for the lifecycle of the system or change.

30. Safety Risk Management (SRM) Team/Panel – A SRM Team, or Panel, will conduct the safety risk assessment in accordance with the current version of FAA Order 8040.4 by following the 5-Step SRM Process, or whichever method was decided on for the assessment. The SRM Team may be composed of representatives and stakeholders from multiple LOBs throughout the FAA, as well as external organizations.

31. Severity – The consequence or impact of a hazard’s effect or outcome in terms of the degree of loss or harm.

32. Single-Point Failure – An element of a system or operation for which no backup (e.g., redundancy) exists. Single-pilot operations are an exception. The failure of an item that would result in the failure of the system and is not compensated for by redundancy or an alternative operational procedure. See Common Cause Failure .

33. System – An integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, hardware, software, firmware, information, procedures, facilities, services, and other support facets.

A-4 09/01/23 8040.6A Appendix B Appendix B. UAS Hazards, Mitigations, and Outcomes This list of common hazards is a starting point. All hazards applicable to the operation must be identified and documented.

5 6 Hazards Hazard Definition Causes (if applicable) Mitigations Outcomes Technical Issue Malfunction of any • Motor failure • Competent applicant/operator • Collision between UAS and a with UAS technical component manned aircraft in the air • Software failure • UAS manufactured by competent or of the UAS, which proven entity • Collision between two or more • Hardware failure causes a deviation UAS • UAS maintained by competent or from planned • Lost Link proven entity • Collision between a UAS and operations.

• GPS Failure person on the ground or a moving • UAS developed to authority • Communications vehicle recognized design standards failure • Collision between a UAS and • C2/3 link performance appropriate • Flyaway critical infrastructure on the • Preflight checks of UAS ground • Geofence failure • Operational procedures validated • Collision between a UAS and • Ground station failure • Remote crew trained and current terrain (CFIT) • Battery/power failure • Safe recovery from technical issue • NMAC between UAS and a • Avionics failure manned aircraft in the air • Methods to reduce kinetic energy • UA leaves planned • Manned aircraft making an • Ground population density route evasive maneuver to avoid UA • Emergency response plan in place • Failure of C2/3 change (proximity from UA remains over • Reduce effects of ground impact greater than 500 feet) • Package delivery • Technical containment in place and • Collision between UAS system failure effective component(s) and persons and/or • Parachute or frangible aircraft property • Collision between package/cargo and persons and/or property Deterioration of Malfunction of any • ADS-B signal • Procedures are in place to handle the • Collision between UAS and a external systems component that is not degradation deterioration of external systems manned aircraft in the air supporting the a part of the UAS but supporting the UAS operation • GPS signal • Collision between two or more UAS operation supports safe degradation • UAS is designed to manage the UAS operations.

deterioration of external systems • UAS Traffic • Collision between a UAS and supporting the UAS operation Management (UTM) person on the ground or a moving failure • External services supporting the UAS vehicle operation are adequate to the • Package delivery • Collision between a UAS and operation system failure critical infrastructure on the ground • Collision between a UAS and terrain (CFIT) • NMAC between UAS and a manned aircraft in the air • Manned aircraft making an evasive maneuver to avoid UA (proximity from UA remains greater than 500 feet) • Collision between UAS component(s) and persons and/or property • Collision between package/cargo and persons and/or property B-1 09/01/23 8040.6A Appendix B Human Error A person's mistake • Pilot errors • Operational procedures are defined, • Collision between UAS and a rather than the failure validated, and adhered to manned aircraft in the air • Maintenance errors of a machine, which • Remote crew trained and current and • Collision between two or more • Preflight planning causes a deviation able to control abnormal situation UAS errors from planned • Multi-crew coordination • Collision between a UAS and operations.

• Mission and route person on the ground or a moving planning errors • Remote crew fit to operate vehicle • Cargo loading errors • Automate protection of the flight • Collision between a UAS and envelope from human error • Flight into unplanned critical infrastructure on the weather • Safe recovery from human error ground • Package delivery • A human factors evaluation has been • Collision between a UAS and system failure performed and the human machine terrain (CFIT) interaction (HMI) found appropriate to • Misloading of • NMAC between UAS and a the mission.

cargo/package manned aircraft in the air • Crew resource management practices • Manned aircraft making an evasive maneuver to avoid UA (proximity from UA remains greater than 500 feet) • Collision between UAS component(s) and persons and/or property • Collision between package/cargo and persons and/or property Adverse Operating into or • Unforecasted weather • Operational procedures are defined, • Collision between UAS and a Operating within conditions that validated and adhered to manned aircraft in the air • Reduced visibility Conditions the UAS was not • The remote crew is trained to identify • Collision between two or more • Climate and intended to, which critical environmental conditions and UAS topography unique causes a deviation to avoid them weather e.g., volcanic • Collision between a UAS and from planned ash • Environmental conditions for safe person on the ground or a moving operations.

operations are defined, measurable vehicle • Package Delivery and adhered to System Failure • Collision between a UAS and • UAS designed and qualified for critical infrastructure on the adverse environmental conditions ground • Collision between a UAS and terrain (CFIT) • NMAC between UAS and a manned aircraft in the air • Manned aircraft making an evasive maneuver to avoid UA (proximity from UA remains greater than 500 feet) • Collision between UAS component(s) and persons and/or property • Collision between package/cargo and persons and/or property B-2 09/01/23 8040.6A Appendix B Unable to Detect Beyond Visual Line • Transponder failure • Visual Observers (VOs) • Collision between UAS and a and Avoid of Sight (BVLOS) (communication between pilot and manned aircraft in the air • Communication failure operations and the observers) between VOs • Collision between two or more design of the UAS • Detect and avoid (DAA) system UAS • Traffic conflicts; give the aircraft a helicopter • Airspace of operation and adjacent • NMAC between UAS and a limited ability to routes/uncharted airspace manned aircraft in the air, sense intruding landing surfaces aircraft and yield • Time of day • Manned aircraft making an right of way as • Inability to comply evasive maneuver to avoid UA • Operating restrictions required by 14 CFR with 14 CFR (proximity from UA remains • Restricting operations within certain Parts §91.113 and Parts §91.113 greater than 500 feet) boundaries or airspace volumes §107.37 and §107.37 • A collision between a UAS and • Restricting operational flight time • Low altitude, General terrain (CFIT) • Low altitude Aviation (GA) • Collision between UAS operations • ATC separation services component(s) and persons and/or • Manned aircraft unable property • Traffic Alert and Collision Avoidance to see UA (due to the System (TCAS) • Collision between package/cargo small size of the UA) and persons and/or property • Proximity to structures • Pilot and crew errors • Unmanned aircraft systems traffic • UA maneuverability management (UTM) (due to UA performance limitations) This column includes any mitigation known or expected to reduce the severity and/or likelihood of the hazard’s effect.

A Hazard with a Low Severity level could become a Medium Severity if it occurs frequently. A Hazard with a Catastrophic Severity Level could be a Low Risk if it almost never happens (extremely remote).

B-3 09/01/23 8040.6A Appendix C Appendix C. Severity, Likelihood, and Risk Matrix The following SRM Table and Figures are used by AVS when conducting SRM.

Table C-1 Severity Definitions* Additional notes for Table C-1: Severity Definitions * Excludes commercial space flight vehicles, crew, and participants UAS are not currently carrying passengers and it is not possible to predict which types of crewed aircraft a UAS will encounter with absolute certainty. Panel members should use available data to determine if the UA would be most likely to encounter aircraft with one to two people, or three or more onboard and the likelihood of a fatality to all onboard when determining when the airborne risk is catastrophic or hazardous. Typically, in class G airspace under 400’, an UAS is likely to encounter GA aircraft so a collision could be considered hazardous as they typically carry one to two passengers.

Table C-2 Likelihood Definitions* *Note: Likelihood Definitions are in flight hours C-1 09/01/23 8040.6A Appendix C Table C-3 Likelihood Definitions C-2 09/01/23 8040.6A Appendix C Risk Matrix General Aviation Analysts should use the General Aviation (GA) table to accurately reflect the type of operation and potential safety effects of the hazard assessed. GA guidelines are intended to establish the minimum standard for certain aviation segments or combinations of segments. This includes, but is not limited to, all 14 CFR Part 91 operations, aircraft operated under Part 135, and small for- hire operations such as those conducted under Parts 107, 133, and 137.

Figure C - 1: Risk Matrix General Aviation C-3 09/01/23 8040.6A Appendix D Appendix D. Safety Risk Management Documentation Template The SRM template is used to document the assessment and streamline the coordination process.

The template helps ensure consistency and standardization of the SRM document.

1. Introduction 1.1 Overview of the Operation 1.2 Description of the Trigger That Resulted in the SRM Analysis 2. System Analysis 2.1 Aircraft 2.2 Airman/Operator 2.3 Airspace/Operating Environment 3. Identify Hazards and Outcomes 4. Analyze the Safety Risk(s) 4.1 Evaluation of Existing Controls 4.2 FAA Order 8040.6 Severity and Likelihood Analysis 4.3 Risk levels with Proponent Mitigations 5. Assess Safety Risk 6. Additional Safety Risk Controls and Residual Risk 7. Safety Performance Monitoring and Hazard Tracking 7.1 Dissentions 8. SRM Safety Analyst/Team Members 9. Risk Acceptance D-1