What should be documented in the safety risk management process required by point 21.B.25(a)(5)?

The safety risk management process should be documented, including means for hazard identification and related data sources, risk management steps (analysis, assessment, control), responsibilities for hazard identification and risk management, responsibility for follow-up of risk mitigation actions, levels of management with authority to decide on risk tolerability, means to assess effectiveness of risk mitigation actions, and the link with the compliance monitoring function.

What are the three risk management steps that should be defined in the documentation?

The three risk management steps are: analysis (in terms of probability and severity of consequences of hazards and occurrences), assessment (in terms of tolerability), and control (in terms of mitigation) of risks to an acceptable level.

What evidence should a competent authority be able to provide to demonstrate that the safety risk management process is operational?

Competent authorities should be able to provide evidence that: persons involved in internal safety risk management activities are properly trained; hazards that could impact the authority's capabilities have been identified and the related risk assessment is documented; regular meetings take place at appropriate levels of management to discuss risks and decide on tolerability and mitigations; the risk management process is triggered whenever changes occur that may affect the authority's capability; a record of risk mitigation actions is maintained showing status and owner; there is follow-up on implementation of all risk mitigation actions; risk mitigation actions are assessed for effectiveness; and results of risk assessments are periodically reviewed for relevance.

What should be included in the record of actions taken to mitigate risks?

The record should show the status of each action and the owner of the action.

How should the effectiveness of risk mitigation actions be assessed?

The documentation should define means to assess the effectiveness of risk mitigation actions, and evidence should show that risk mitigation actions are assessed for their effectiveness.

What is the link between the safety risk management process and the compliance monitoring function?

The documentation should define the link with the compliance monitoring function.

What should be periodically reviewed to check whether risk assessments remain relevant?

The results of risk assessments should be periodically reviewed to check whether they remain relevant.

AMC1 21.B.25(a)(5) Management system

Q: Which data sources should be considered when identifying hazards in the safety risk management process?

Data that comes from other competent authorities with which the competent authority interfaces in the State, or from the competent authorities of other Member States, should be taken into account.

Q: Who should have the authority to make decisions regarding the tolerability of risks?

The levels of management who have the authority to make decisions regarding the tolerability of risks should be defined in the documentation.

Q: When should the risk management process be triggered in addition to the initial hazard identification exercise?

The risk management process should be triggered as a minimum whenever changes occur that may affect the competent authority's capability to perform any of the tasks required by Part 21.

Navigate / EASA

Ask question Discover more Add to collection

AMC1 21.B.25(a)(5) Management system

ED Decision 2023/014/R

SAFETY RISK MANAGEMENT PROCESS

(a) The safety risk management process required by point (a)(5) of point 21.B.25 should be documented. The following should be defined in the related documentation:

(1) means for hazard identification and the related data sources, taking into account data that comes from other competent authorities with which the competent authority interfaces in the State or from the competent authorities of other Member States;

(2) risk management steps including:

(i) analysis (in terms of the probability and the severity of the consequences of hazards and occurrences);

(ii) assessment (in terms of tolerability); and

(iii) control (in terms of mitigation) of risks to an acceptable level;

(3) who holds the responsibilities for hazard identification and risk management;

(4) who holds the responsibility for the follow-up of risk mitigation actions;

(5) the levels of management who have the authority to make decisions regarding the tolerability of risks;

(6) means to assess the effectiveness of risk mitigation actions; and

(7) the link with the compliance monitoring function.

(b) To demonstrate that the safety risk management process is operational, competent authorities should be able to provide evidence that:

(1) the persons involved in internal safety risk management activities are properly trained;

(2) hazards that could impact the authority’s capabilities to perform its tasks and discharge its responsibilities have been identified, and the related risk assessment is documented;

(3) regular meetings take place at appropriate levels of management of the competent authority to discuss the risks identified and to decide on the risk tolerability and possible risk mitigations;

(4) in addition to the initial hazard identification exercise, the risk management process is triggered as a minimum whenever changes occur that may affect the competent authority’s capability to perform any of the tasks required by Part 21;

(5) a record of the actions taken to mitigate risks is maintained, showing the status of each action and the owner of the action;

(6) there is follow-up on the implementation of all risk mitigation actions;

(7) risk mitigation actions are assessed for their effectiveness;

(8) the results of risk assessments are periodically reviewed to check whether they remain relevant.

Details

Source-Title: AMC1 21.B.25(a)(5) Management system View latest amendments

Erulesid: ERULES-1963177438-21910 Compare versions

Domain: Initial airworthiness

Amendedby: Issue 2, Amendment 16

Applicabilitydate: 21 October, 2023

Entryintoforcedate: 21 October, 2023

Regulatorysource: ED Decision 2023/014/R Navigate

Regulatorysubject: Part-21

Typeofcontent: AMC to IR (Acceptable means of compliance to implementing rule)

Parentir: 21.B.25 Management system

Origin: EASA

Category: EAR