Safety Management Oversight of Design and Production Approval Holders

8120.25 Chapter 1. General Information 1. Purpose of This Order. This order provides guidance and assigns responsibility for AIR personnel to provide oversight of a design and production approval holder with an SMS that is required under Part 5 or accepted by the FAA under the voluntary SMS program.

This order also provides guidance for AIR personnel to conduct oversight of design and production approval holders that are not required to meet Part 5 and have not voluntarily implemented an SMS. Insights from engagement with these approval holders may identify risks in their operations. Awareness of these risks can benefit the approval holder and guide future FAA oversight. Findings from engagement with these approval holders do not result in a Part 5 noncompliance because the approval holder is not required to comply with Part 5.

If this order is utilized by persons other than the FAA or the Administrator’s designees, it is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only.

Nonconformity will not affect rights and obligations under existing statutes and regulations.

2. Audience. All Integrated Certificate Management Division (AIR-500), Compliance and Airworthiness Division (AIR-700), and System Oversight Division (AIR-800) personnel.

3. Where to Find This Order. You can find this order on the Federal Aviation Administration (FAA) website at FAA Regulations and Policies. This order is also available on the Dynamic Regulatory System at DRS.

4. Structure of This Order. Chapter 2 provides an overview of the process for oversight of an approval holder’s SMS. Chapter 3 provides guidance on how to complete activity reviews during existing interactions with approval holders. Chapter 4 provides guidance on the completion of SMS compliance audits that are integrated with quality system audits and principal inspector audits. Chapter 5 provides guidance on the completion of an SMS maturity assessment. Chapter 6 provides the process to be followed for the oversight of a corporate SMS. Chapter 7 provides administrative information for this order.

1-1

8120.25 Chapter 2. Safety Management Oversight Process Overview 1. Purpose of This Chapter. This chapter provides an overview of the AIR process for safety management oversight of an approval holder.

2. Relationship Between Safety Management Oversight and Other Policies. An effective SMS strengthens the activities and FAA interactions with an approval holder in several areas: a. Accountability Framework. Design and production approval holders are responsible for the safety and compliance of their articles and products. AIR personnel perform a variety of oversight activities to ensure compliance of the design and production to applicable regulations.

When noncompliances are identified, the approval holder must correct the noncompliance, and the FAA may elect to take other action. An SMS can be an effective means for reducing the risk of noncompliance occurring and can be a factor in the FAA’s decision to take other action. This order was developed to include specific activities that will provide AIR personnel with a method for assessing the performance, effectiveness, and maturity of an approval holder’s SMS. The objective of FAA oversight is to advance the approval holder’s safety performance and to develop their SMS maturity to increase safety in the National Airspace System (NAS).

b. Continued Operational Safety. The FAA evaluates reports of in-service failures and risks through the “Monitor Safety / Analyze Data” process in Order 8110.107. SMS augments the FAA’s evaluation by requiring the approval holder to analyze the risk, and either mitigate it, accept it, or communicate it to another stakeholder for mitigation (e.g., an operator). The approval holder’s assessment may provide valuable information for the FAA to consider in our evaluation.

c. Compliance Program. When faced with a discovered noncompliance, the FAA has a range of potential actions as described in Order 8000.373. The history of an approval holder’s actions under an SMS program, or otherwise as recorded through oversight, is valuable in determining the appropriate FAA action that would assure compliance and prevent recurrence.

d. Risk Based Involvement and Surveillance. Given limited resources, AIR personnel routinely choose what to delegate and when to conduct surveillance. The maturity of a company’s SMS is a significant factor in assessing the need for FAA involvement and surveillance.

3. Safety Management Oversight Starting Date. For approval holders required to meet Part 5 or are in the voluntary SMS program, oversight begins immediately following implementation under Order 8120.24 through completion of the SMS verification and completion of the SMS evaluation. Oversight under Order 8120.25 starts immediately after the SMS evaluation completion letter is sent to the approval holder as described in Order 8120.24.

4. Safety Management Oversight Approach. Safety management oversight is performed by personnel from AIR-500, AIR-700, and AIR-800, and is integrated with existing oversight of design and production approval holders. Components of the safety management oversight approach are shown in Figure 2-1 of this order and include the following: 2-1 8120.25 a. Activity reviews completed during existing interactions with approval holders (these apply to all approval holders, refer to Chapter 3); b. SMS compliance audits completed during existing principal inspector audits and quality system audits under Order 8120.23 (these only apply to approval holders that are required to meet Part 5 or are in the voluntary SMS program, refer to Chapter 4); and c. SMS maturity assessments completed annually (these only apply to approval holders that are required to meet Part 5 or are in the voluntary SMS program, refer to Chapter 5).

Figure 2-1. Safety Management Oversight Process 5. Safety Management Oversight Applicability. Table 2-1 of this order defines the oversight components that are performed based on the design or production approvals held by the approval holder. The design or production approvals in Table 2-1 include type certificate (TC), production certificate (PC), supplemental type certificate (STC), technical standard order authorization (TSOA), and parts manufacturer approval (PMA). Approval holders may be required to have an SMS under Part 5 (TC and PC), elect to participate in the voluntary SMS (VSMS) program (STC, TSOA, PMA, or PC for parts only), or choose to not have an SMS at all (STC, TSOA, 2-3 8120.25 PMA, or PC for parts only). Activity reviews apply to all design or production approval holders.

Note: If an approval holder enters into the VSMS program, that approval holder agrees to be subject to the oversight requirements of Part 5.

Table 2-1. Safety Management Oversight Components Required Based on Approvals Held SMS Activity Maturity Approvals Compliance Reviews Assessments Held Audits (Chapter 3) (Chapter 5) (Chapter 4) TC and PC for same X X X product [§ 5.1(d)] PC and are licensee of the TC for same X X X product [§ 5.1(e)] TC (except TC under § 21.29) that is licensed X X for production under a PC [§ 5.1(g)] STC in VSMS program X X TSOA, PMA, or PC for parts only in VSMS X X X program STC, TSOA, PMA, or PC for parts only that X are not in the VSMS program 6. Safety Management Oversight Leader for Approval Holders. The principal inspector (PI) is the overall oversight leader for approval holders that hold a production approval (PC, PMA, TSOA). AIR-500 or AIR-700 assigns an overall oversight leader, typically an aviation safety engineer (ASE), for approval holders that do not hold a production approval (TC only or STC only). The oversight leader combines information from all oversight components to complete the SMS maturity assessment for the approval holder.

Note: An oversight leader is not required for approval holders that are not required to meet Part 5 and are not in the VSMS program (STC, TSOA, PMA, PC for parts only).

7. Data Collection Tools (DCTs). DCTs are used to document results from the reviews, audits, and assessments conducted during oversight. DCTs guide the aviation safety inspector (ASI) and ASE with a series of questions designed to gather information about the approval holder’s SMS, safety performance, and Part 5 compliance. DCTs are available for each oversight component.

8. Principles for Successful Safety Management Oversight. Performance based regulations, including Part 5, require understanding that compliance can be achieved through a variety of means by different approval holders. Therefore, AIR personnel are expected to use a full set of skills and attributes, such as the ability to:  make a good faith effort to understand the perspective of the approval holder;  ask open ended questions, based on curiosity; 2-4 8120.25 • make judgements based on each specific set of facts; • work together to obtain perspectives from colleagues; and • consider all available information.

These skills will allow AIR personnel to evaluate and consider the approval holder’s SMS compliance, performance, and maturity. With this information, the FAA can promote safety to the highest degree possible by maximizing the effectiveness of the approval holder's SMS for the benefit of all stakeholders.

9. Addressing Noncompliances for Approval Holders Required to Meet Part 5. Part 5 noncompliances identified after the Order 8120.24 implementation completion deadline are processed in accordance with FAA Order 2150.3 and the AIR Compliance and Enforcement Process, AIR-002-035. Part 5 noncompliances identified before the Order 8120.24 implementation completion deadline are addressed through informal corrective action instead of using AIR-002-035.

10. Addressing VSMS Program Findings. As noted in paragraph 5 of this chapter, approval holders in a VSMS opt-in to SMS oversight. AIR personnel request that approval holders in the VSMS program initiate corrective action to address SMS oversight findings. Approval holders that do not implement requested corrective action may have their SMS acceptance letter revoked.

Note: AIR-002-035 may not be used for approval holders in the VSMS program because these approval holders are not required to comply with Part 5.

11. Addressing Findings for Approval Holders that are not Required to Meet Part 5 and are not Participating in the VSMS Program. Oversight findings for these approval holders are presented to the approval holder as opportunities for improvement. Corrective action is not required because these approval holders are not required to meet Part 5 and are not in the VSMS program.

12. Information and Data Used for Oversight. Sections 5.11(e), 5.13(b)(5), 5.15(b)(5), 5.15(c)(5), and 5.19(b) require the approval holder to make available, upon request, information and data for FAA oversight demonstrating their SMS meets Part 5. The term “make available” means that the approval holder is required to provide FAA access to SMS information and data for oversight but is not required to submit the information and data to the FAA.

13. Protection of Information and Data from Public Disclosure. All information and data provided by the approval holder to FAA is protected from public disclosure under Title 49 of the United States Code § 44735. This includes information and data that is required to be submitted under Part 5, is voluntarily submitted, or is made available. FAA personnel must segregate all data provided for protection from public disclosure.

2-5

8120.25 Chapter 3. Activity Reviews 1. Purpose of This Chapter. This chapter describes the process to be followed to complete an activity review during an existing interaction (activity) with an approval holder.

2. Activity Review. An activity review is an FAA evaluation of the inputs, outputs, interactions, and decisions as the approval holder manages safety, with a focus on the tenets of safety assurance and safety risk management (SRM) as shown in Figure 3-1 (refer to Appendix A for a detailed discussion of Figure 3-1) as they relate to a particular activity. The activity review results provide input to the SMS maturity assessment (for approval holders with an SMS) and provide feedback to all approval holders on their safety management performance.

Figure 3-1. Safety Assurance / SRM Interaction Loop 3-1 8120.25 3. Applicability. AIR conducts activity reviews for all approval holders, including those that are not required to meet Part 5 and are not in the VSMS program. Activity reviews must be conducted during existing interactions with approval holders, so as not to create any additional administrative burdens.

4. Responsibilities. All AIR personnel are responsible for considering and documenting safety management observations when conducting an activity (meetings, reviews, assessments, or surveillance) with an approval holder. Examples of activities include, but are not limited to, interim TC board meetings, certification program reviews, continued operational safety reviews, meetings regarding significant changes to production operations, 14 CFR 21.3 investigations, organization designation authorization surveillance activities, review of a § 5.71(c) confidential employee report summaries received from an approval holder, additional certificate management activities, and compliance action or voluntary disclosure meetings.

Note: Activity reviews are not intended to be completed when conducting PI audits or quality system audits (QSA).

5. Activity Review Process. The process for conducting an activity review is for the AIR personnel who are assigned to the activity to investigate the role that safety management is playing for the approval holder on that activity, complete the DCT to document observations, and share those observations with the approval holder. If there are no safety management observations, that should be documented in the DCT. The safety assurance/safety risk management interaction loop shown in Figure 3-1 is used to guide the activity review process.

Note: AIR personnel may use discretion to determine that safety management is not applicable to the interaction or activity with the approval holder. An activity review is not required for these cases.

6. Activity Reviews for Approval Holders that are not Required to Meet Part 5 and are not in the VSMS Program. Activity reviews for these approval holders should focus on the general concepts of safety management rather than the specific Part 5 requirements in the safety assurance/safety risk management interaction loop in Figure 3-1. For example, the review may include a discussion about whether the activity being reviewed could affect the safety of the articles or designs being provided by the approval holder. The review may also include a discussion of methods that are being used, or could be used, by the approval holder to improve the safety of the articles or services provided. Feedback from the activity review must be provided as guidance only because these approval holders are not required to meet Part 5.

Note 1: AIR personnel conducting these activity reviews must use caution to avoid any implication that these approval holders are required to meet any section of Part 5.

Note 2: Completion of a DCT is encouraged but not required for these activity reviews.

7. Activity Review Examples. The following sections provide several examples of how an activity review may be completed.

Note: These examples are provided for guidance on how an activity review may be completed but are not intended to be used as a required process for an activity review. AIR personnel conducting activity reviews are expected to use discretion and critical thinking to determine the best way to perform the review.

3-2 8120.25 a. Failure Investigation. An ASE is meeting with an approval holder to investigate a failure report that was submitted under 14 CFR 21.3. The ASE conducts the activity review by asking the approval holder how they learned about the failure (system monitoring). Next, the approval holder is asked if the failure identified a new hazard, an ineffective risk control, or a safety performance deficiency (performance assessment). If a new hazard or ineffective risk control was identified, the approval holder is asked about the results from their application of safety risk management (risk analysis, risk assessment, risk acceptance, or risk mitigation). The approval holder may also be asked if interfacing persons were notified of the hazard (hazard notification). If a safety performance deficiency is identified, the approval holder is asked about the corrective action that has been implemented. The ASE documents observations in the DCT and shares feedback with the approval holder.

b. Certification Program Review. An AIR team is meeting with an approval holder to review an amended TC program. The team conducts the activity review by asking the approval holder if they have developed new or revised existing certification procedures (SRM triggers). If yes, the team asks about the results from SRM (hazard identification, risk analysis, risk acceptance, or risk mitigation). The team may also ask about the results from safety assurance monitoring of the certification program (audits, investigation of potential non-compliances, or confidential employee reports). The team may ask if any performance assessments were completed based on safety assurance monitoring and if SRM or corrective action was necessary.

The AIR team documents observations in the DCT and shares feedback with the approval holder.

c. Production Quality Escape. An ASI is meeting with an approval holder to investigate a non-conforming product that escaped from the approval holder’s quality system. The ASI conducts the activity review by asking the approval holder how they learned about the quality escape (system monitoring). Next, the approval holder is asked if the quality escape identified a new hazard, ineffective risk control, or safety performance deficiency (performance assessment).

If a new hazard or ineffective risk control was identified, the approval holder is asked about the results from safety risk management (risk analysis, risk assessment, risk acceptance, or risk mitigation). The approval holder may also be asked if interfacing persons were notified of the hazard (hazard notification). If a safety performance deficiency was identified, the approval holder is asked about the corrective action that has been implemented. The ASI documents observations in the DCT and shares feedback with the approval holder.

d. Significant Changes to Production Operations. An ASI team is meeting with an approval holder to review a plan to add a new manufacturing facility to the approval holder’s PC.

The team conducts the activity review by asking the approval holder if they have revised the production system, developed new production procedures or revised existing production procedures (SRM triggers). If yes, the team asks about the results from SRM (hazard identification, risk analysis, risk acceptance, or risk mitigation). As the production system changes are implemented, the team may also follow-up with the approval holder to ask about the results from safety assurance monitoring of the revised production system (audits, investigation of potential non-compliances, confidential employee reports). The team may ask if any performance assessments were completed based on safety assurance monitoring of the changes and if SRM or corrective action was necessary. The ASI team documents observations in the DCT and shares feedback with the approval holder.

e. Section 5.71(c) Confidential Employee Report Summary Review. A PI receives a § 5.71(c) confidential employee report summary from an approval holder. The PI engages with 3-3 8120.25 the approval holder to evaluate how employee reports were processed through the SMS. The PI selects one or more of the employee reports provided in the summary for a detailed review. The approval holder is asked if the report identified a new hazard, ineffective risk control, or safety performance deficiency (performance assessment). If a new hazard or ineffective risk control was identified, the approval holder is asked about the results from safety risk management (risk analysis, risk assessment, risk acceptance, or risk mitigation). If a safety performance deficiency was identified, the approval holder is asked about the corrective action that has been implemented. The PI documents observations in the DCT and shares feedback with the approval holder.

8. Activity Review Data Collection Tool. A DCT is available to facilitate the activity review.

The AIR personnel who are assigned to the activity record results in the DCT during the activity review. Refer to quality management system (QMS) document AIR-002-600-005-F11 for the activity review DCT.

9. Providing Feedback to the Approval Holder. Feedback is provided to the approval holder during the activity review. This feedback focuses on helping the approval holder improve the operational performance of their SMS. Feedback provided to the approval holder is documented in a summary block on the DCT.

10. Documenting Results from the Activity Review. The team leader files the DCT, along with any feedback provided, in the project folder for the approval holder or the oversight information system.

3-4

8120.25 Chapter 4. SMS Compliance Audits 1. Purpose of This Chapter. This chapter describes the process to be followed for audits of an approval holder’s SMS to verify compliance with Part 5.

2. SMS Compliance Audits. SMS compliance audits verify that approval holders are complying with Part 5. The SMS compliance audits are integrated with existing PI audits and quality system audits (QSA) under Order 8120.23. SMS compliance audits are not conducted when performing supplier control audits. Results from SMS compliance audits provide input to the SMS maturity assessment and provide feedback to the approval holder on the operation and performance of their SMS.

3. Applicability. AIR conducts SMS compliance audits on holders of a PC that are required to meet Part 5, or on holders of a PMA, TSOA, or PC for parts only that have an accepted SMS under the VSMS program. AIR does not conduct SMS compliance audits for approval holders that are not required to meet Part 5 and are not in the VSMS program.

4. Responsibilities. AIR personnel complete SMS compliance audits concurrently when performing PI audits and QSAs under Order 8120.23.

5. SMS Compliance Audit Process. Process steps for completing SMS compliance audits are as follows: a. Integrated SMS / PI Audit. An audit of the approval holder’s SMS is completed for the manufacturing area that is the subject of the PI audit. The ASI audits the approval holder’s SMS for compliance with the following Part 5 subparts: • Subpart C: Safety Risk Management • Subpart D: Safety Assurance • Subpart E: Safety Promotion The SMS audit uses the PI / SMS audit DCT for the SMS subparts being audited. Refer to QMS document AIR-002-600-005-F12 for the PI / SMS audit DCT.

b. Integrated SMS / QSA. A comprehensive audit of the approval holder’s SMS is completed during the QSA. The SMS audit covers the sub-systems that are included in the approval holder’s organizational system description under § 5.17. These sub-systems typically include design and certification, production, and continued operational safety. The SMS audit covers all Part 5 subparts including: • Subpart A: General • Subpart B: Safety Policy • Subpart C: Safety Risk Management • Subpart D: Safety Assurance • Subpart E: Safety Promotion 4-1 8120.25 • Subpart F: SMS Documentation and Recordkeeping The SMS audit uses the QSA / SMS audit DCT for the Part 5 subparts being audited. Refer to QMS document AIR-002-600-005-F13 for the QSA / SMS audit DCT.

6. Providing Feedback to the Approval Holder. The ASI provides feedback from SMS audits to the approval holder. This feedback focuses on helping the approval holder improve the operational performance of their SMS.

7. Documenting Results from the Compliance Audits. The team leader files the DCT, along with any feedback provided, in the project folder for the approval holder or the oversight information system.

4-2

8120.25 Chapter 5. SMS Maturity Assessments 1. Purpose of This Chapter. This chapter describes the process to be followed to complete a maturity assessment of an approval holder’s SMS.

2. SMS Maturity Assessment. An SMS maturity assessment determines the maturity of the approval holder’s SMS by considering SRM, safety assurance, safety promotion, and safety policy. The maturity assessment is based on the results from available activity reviews and SMS compliance audits. The assessment results will be used to provide feedback to the approval holder on their SMS strengths, weaknesses, and opportunities for improvement. In addition, the assessment results will be used to guide FAA SMS oversight that will be completed over the following year.

Note: The maturity assessment is not intended to be used for compliance checks of the approval holder’s SMS.

3. Applicability. AIR conducts maturity assessments on all approval holders that are required to meet Part 5 or have an accepted SMS under the VSMS program. AIR does not conduct maturity assessments on approval holders that are not required to meet Part 5 and are not in the VSMS program.

4. Responsibilities. The PI completes the maturity assessment for approval holders that hold a production approval (PC, PMA, TSOA). AIR-500 or AIR-700 assigns a maturity assessment leader, typically an ASE, for approval holders that do not hold a production approval (TC only or STC only).

5. Maturity Assessment Process. Maturity assessments occur every 12 months and are completed in time to provide input into the risk assessment conducted under FAA Order 8120.23 for production approval holders (PC, PMA, TSOA). The maturity assessment is completed using data obtained from available activity reviews and SMS compliance audits.

a. Each of the four SMS components are rated to assess the following: • Safety Policy. The maturity of the approval holder’s management commitment to the successful safety performance of the organization.

• Safety Risk Management. The approval holder’s maturity at identifying hazards and managing safety risk to an acceptable level.

• Safety Assurance. The approval holder’s maturity at monitoring, analyzing, assessing, and continually improving the safety performance of the organization.

• Safety Promotion. The approval holder’s maturity at ensuring employees know their role in the SMS and have the competencies necessary for the successful operation and performance of the SMS.

b. Maturity assessment rating levels are broadly defined as follows: • Present. The SMS is defined and documented.

5-1 8120.25 • Suitable. The present SMS is appropriate to the size, scope, and complexity of the organization.

• Operating. The suitable SMS has been implemented and is functioning across the organization as defined in the organizational system description.

• Effective. The operating SMS has demonstrated continued improvement that has been reflected in the organization’s safety performance.

6. Maturity Assessment Data Collection Tool. A DCT is available to facilitate the maturity assessment. The DCT covers the four SMS components and provides information that guides the assessment process. The team leader records the maturity assessment results in the DCT. Refer to QMS document AIR-002-600-005-F14 for the maturity assessment DCT.

7. Providing Feedback to the Approval Holder. Following the maturity assessment, feedback is provided to the approval holder including identified strengths, weaknesses, and opportunities for improvement. Approval holders with maturity assessment rating levels of present, suitable, or operating are encouraged to improve their SMS over the next rating period. The maturity assessment leader documents the feedback provided to the approval holder in a summary block on the DCT.

8. Documenting Results from the SMS Maturity Assessment. The team leader files the DCT, along with any feedback provided, in the project folder for the approval holder or the oversight information system.

.

5-2

8120.25 Chapter 6. Oversight of a Corporate SMS 1. Purpose of This Chapter. This chapter describes the process to be followed for oversight of a corporate SMS.

2. Corporate SMS Definition. An SMS developed with standardized policies, processes, and procedures to be utilized throughout an aviation organization that holds multiple certificates, approvals, or authorizations. A corporate SMS may be overseen by AIR alone or may be overseen by both AIR and FS. A common example of a corporate SMS with only AIR oversight is a single SMS for a holder of TC and PC that also holds STC, PMA, or TSOA in the VSMS program. A common example of a corporate SMS having both AIR and FS oversight is a single SMS that covers all activities for a holder of TC and PC that also holds a 14 CFR part 145 repair station certificate.

3. Oversight of a Corporate SMS. AIR personnel follow the guidance in this order for oversight of a corporate SMS. AIR oversight is focused on the service office area of responsibility (e.g., Part 21) of the corporate SMS and FS oversight is focused on the service office area of responsibility (e.g., Part 121, Part 135, Part 145, etc.) of the corporate SMS. As an example, for a TC and PC holder with a repair station, AIR oversight covers the TC and PC holder, and FS oversight covers the repair station.

4. Coordination Across AIR for a Corporate SMS with Only AIR Oversight. AIR personnel coordinate oversight findings and SMS maturity assessments for a corporate SMS (e.g., a single SMS for holder of TC and PC that is required to meet Part 5 that includes STC, PMA, or TSOA in the VSMS program). AIR-8X7 (the applicable AIR-800 program management section), East (AIR-857), Central (AIR-867), or West (AIR-877) facilitates the coordination and communication between the AIR personnel conducting the oversight. A single SMS maturity assessment is completed for the corporate SMS. AIR personnel notify AIR-8X7 if an approval holder provides notification that they are withdrawing from the corporate SMS.

5. Coordination with FS for a Corporate SMS with both AIR and FS Oversight. AIR personnel coordinate with FS during oversight of a corporate SMS as follows: a. Monitoring of SMS Mailbox. AIR-8X7 monitors the SMS email inbox 9-AVS-AIR- SMS@faa.gov for communications from FS. These communications may include noncompliance notifications, annual planning and coordination meeting invitations, and corporate SMS withdrawal notifications. AIR-8X7 forwards communications from FS to the applicable AIR- 500, AIR-700, and AIR-800 personnel.

b. Communication of a Systemic Noncompliance. AIR personnel notify FS when a systemic noncompliance is identified during AIR oversight of a corporate SMS. For the purposes of this order, a systemic noncompliance is identified when oversight determines that a corporate SMS policy, procedure, or process does not meet Part 5. A noncompliance that is not systemic, meaning that it has been determined to not affect a corporate SMS policy, process, or procedure, does not require communication to FS. The communication may occur directly to the FS ASI (if known) or to 9-NATL-SMS-ProgramOffice@faa.gov if the FS ASI is not known. The 6-1 8120.25 notification includes a description of the systemic noncompliance and a summary of the corrective action requested of the approval holder.

c. Completion of SMS Maturity Assessment. When completing a maturity assessment for a corporate SMS, the maturity assessment team leader may invite FS personnel to participate.

d. Annual Planning and Coordination Meeting. AIR personnel attend and support an annual oversight planning and coordination meeting with FS for each organization that implements a corporate SMS. The meeting will be scheduled by FS and will address the following items: • Review the organization’s SMS performance.

• Review the resolution of SMS noncompliances that were identified and communicated over the past year.

• Review oversight plans for the coming year.

Note: Additional planning and coordination meetings may be conducted based on risk-based decision making.

e. Withdrawal from the Corporate SMS. AIR-8X7 provides a notification to FS at 9-NATL-SMS-ProgramOffice@faa.gov if an approval holder provides notification that they are withdrawing from the corporate SMS. AIR-8X7 acknowledges receipt of the withdrawal notification from the approval holder.

6-2

8120.25 Chapter 7. Administrative Information 1. Distribution. This order is distributed to all AIR and other interested offices, delegated organizations, and designees.

2. Authority to Change This Order. The issuance, revision, or cancellation of the material in this order is the responsibility of AIR-634.

3. Acronyms. See Appendix B.

4. Related Publications. See Appendix C.

5. Suggestions for Improvements. Please forward all comments on deficiencies, clarifications, or improvements regarding the contents of this order to the Directives Management Officer at 9- AVS-AIR-D irectives- M anagement- O fficer @faa.gov; please use FAA Form 1320-19, Directive Feedback Information, in Appendix D, Directive Feedback Information.

6. Records Management. Refer to FAA Order 0000.1, FAA Standard Subject Classification System; FAA Order 1350.14, Records Management; or your office Records Management Officer (RMO)/Directives Management Officer (DMO) for guidance regarding retention or disposition of records.

7-1

8120.25 Appendix A Appendix A. Safety Assurance and SRM Interaction Loop 1. Continuous Interaction Loop. The safety assurance and SRM processes (Figure A-1) operate in a continuous interaction loop through information sharing and decision making. The following sections provide details on these processes, along with how information is developed, and safety management decisions are made.

Figure A-1. Safety Assurance / SRM Interaction Loop A-1 8120.25 Appendix A 2. Safety Assurance. Safety assurance processes and systems under § 5.71(a) monitor the safety performance of the approval holder’s operations, products, and services. The approval holder uses a variety of sources including audits, investigations, and employee reporting to acquire data under § 5.71(a) during monitoring. Next, the acquired data is analyzed under § 5.71(b) in preparation for use in subsequent safety performance assessments.

Safety performance assessments completed under § 5.73(a) can have one of the following general outcomes: a. Performance is acceptable and objectives are being met. In this case, system monitoring, data acquisition, and data analysis continues in preparation for subsequent safety performance assessments.

b. Performance is not acceptable (substandard), and analysis suggests that the problem lies with compliance with risk controls, regulations, organizational policy and procedures, or the lack of necessary resources. In this case, corrective action under § 5.75 would be warranted.

c. Compliance with risk controls and regulations appears to be satisfactory; however, desired results are not being obtained (i.e., the risk control is ineffective). In this case, the SRM processes would be triggered under § 5.73(b).

d. New or uncontrolled hazards are discovered. This may be due to new hazards having arisen since the system was developed or the discovery of factors that were previously unknown.

In this case, the SRM processes are followed under § 5.73(b).

3. SRM. SRM is conducted for planned changes or when hazards or ineffective risk controls have been identified through safety assurance processes. SRM for planned changes is completed under § 5.51(a) - (c) when new systems are developed, existing systems are revised, or operational procedures are developed. SRM is completed under § 5.73(b) and § 5.51(d) when hazards or ineffective risk controls are identified through safety assurance.

The first SRM step, system analysis under § 5.53(a), is used to understand the operational system or procedure that is the subject of the SRM. The system analysis under § 5.53(b) needs to consider the operating environment, the personnel involved in the operation, the equipment being used, operational procedures, and interfaces with other processes or procedures. In most cases, hazard identification under § 5.53(c) flows from this system analysis. Hazard identification requires the approval holder to identify hazards for the operational system that is the subject of the SRM. Although Figure A-1 depicts these processes as distinctly defined components, they flow from one to the other in practice. For example, in a careful discussion of how a system currently works (system analysis), hazards will often become evident. The approval holder provides a hazard notification under § 5.57 to interfacing organizations that could address the hazard or mitigate its risk.

The approval holder then conducts a risk analysis under § 5.55(a) of the potential consequences of operation in the presence of the identified hazards. This culminates in a risk A-2 8120.25 Appendix A assessment under § 5.55(b) to determine the acceptability of operating with these hazards. If the approval holder determines the risk is acceptable, the safety assurance monitoring processes are conducted. If the approval holder determines the risk is unacceptable, the approval holder develops risk controls under § 5.55(c). The approval holder completes an evaluation under § 5.55(d) to determine if the risk will be acceptable with the risk control implemented prior to implementation of the risk control.

A-3 8120.25 Appendix B Appendix B. Acronyms As used in this document, the following acronyms are defined.

• AC Advisory Circular • AIR Aircraft Certification Service • AIR-500 Integrated Certificate Management Division • AIR-600 Policy and Standards Division • AIR-700 Compliance and Airworthiness Division • AIR-800 System Oversight Division • AIR-8X7 The applicable AIR-800 program management section), East (AIR-857), Central (AIR-867), or West (AIR-877) • ASE Aviation Safety Engineer • ASI Aviation Safety Inspector • CFR Code of Federal Regulations • DCT Data Collection Tool • FAA Federal Aviation Administration • FS Flight Standards • NAS National Airspace System • PC Production Certificate • PI Principal Inspector • PMA Parts Manufacturer Approval • QMS Quality Management System • QSA Quality System Audit • SMS Safety Management System • SRM Safety Risk Management • STC Supplemental Type Certificate • TC Type Certificate • TSOA Technical Standard Order Authorization • VSMS Voluntary SMS B-1 8120.25 Appendix C Appendix C. Related Publications 1. Advisory Circulars (AC). Please refer to the most recent version of the following documents, they are available on the FAA website at FAA Regulations and Policies and on DRS.

• AC 21-58, Safety Management Systems for Part 21 Type and Production Certificate Holders.

• AC 120-92, Safety Management Systems for Aviation Service Providers .

2. Orders. Please refer to the most recent version of the following documents, they are available on the FAA website at FAA Regulations and Policies and on DRS.

• Order 2150.3, FAA Compliance and Enforcement Program.

• Order 8120.23, Certificate Management of Production Approval Holders.

• Order 8120.24, Implementation Plan Approval, Verification, and Evaluation of Safety Management Systems for Design and Production Approval Holders.

• Order VS 8000.367 AVS Safety Management System (AVSSMS) Requirements • Order 8000.373 Federal Aviation Administration Compliance Program • Order 8110.107 Monitor Safety / Analyze Data 3. Quality Management System Work Instructions: • AIR-002-035, Aircraft Certification Service (AIR) Compliance and Enforcement Process.

4. Quality Management System Data Collection Tools: • AIR-002-600-005-F11, AIR Oversight Data Collection Tool (DCT) – Activity Review • AIR-002-600-005-F12, AIR Oversight Data Collection Tool (DCT) – SMS / Principal Inspector Audit • AIR-002-600-005-F13, AIR Oversight Data Collection Tool (DCT) – SMS / Quality System Audit • AIR-002-600-005-F14, AIR Oversight Data Collection Tool (DCT) – SMS Maturity Assessment C-1 8120.25 Appendix D Appendix D. Directive Feedback Information Please submit any written comments or recommendations for improving this directive or suggest new items or subjects to be added to it. Also, if you find an error, please tell us about it.

Subject: FAA Order 8120.25, Oversight of Safety Management Systems for Design and Production Approval Holders To: AIR Directives Management Officer at (DMO) via email at 9-AVS-AIR-Directives- Management-Officer@faa.gov (Please mark all appropriate line items) ☐ An error (procedural or typographical) has been noted in paragraph on page .

☐ Recommend paragraph on page be changed as follows: (Attach separate sheet if necessary) ☐ In a future change to this order, please include coverage on the following subject: (Briefly describe what you want added): ☐ Other comments: ☐ I would like to discuss the above. Please contact me.

Submitted by: Date: Telephone Number: Routing Symbol: FAA Form 1320-19 (11/23) Supersedes Previous Edition D-1