Component 1: Safety Culture

Study Area 1: Development of a Positive and Proactive Organisational Culture

Question 1.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

An intelligent and effective organisational culture (is one which) is responsive to the hierarchical differences in an organisation. Differing functions and roles in an organisation have different views of risk, different risk disposition and they have different values and views about safety.

Concept of Safety:

Employees believe that safety goals will be achieved by complying with rules and regulations.

People, especially front line staff, are considered the principle cause of accidents and incidents.

Sanctions are applied by management when non-compliances are found.

Concept of Safety:

Employees contribute to safety by highlighting deficiencies in rules and procedures.

The organisation is developing processes to support employees’ ability to share safety lessons learned with other teams or groups.

Concept of Safety:

The organisation recognises that safe provision of services is something it can achieve through the expertise and experience of its staff, not simply by defining rules and procedures.

People focussed safety interventions and campaigns are recognised as having limitations and alternative strategies explored.

Concept of Safety:

Management systems acknowledge that change can indirectly impact an organisation’s safety performance, potentially causing instability within the organisation.

The organisation actively engages and prepares to avoid, or to manage this instability, including the need to prepare people for changes that may affect safety.

Safety Culture

Safety culture is informal and applied only in the operational parts of the organization.

Safety Culture

Safety culture is applied in both operational and support functions.

Safety Culture

The organisation acknowledges the need to consider safety culture and organisational culture together, but still maintains the two as separate concepts.

The value of safety in the organisation is recognised and promoted through engagement and consultation with staff.

Engagement and consultation values diverse views of safety and respects difficult and challenging questions

Safety culture

Safety is understood to be the responsibility of the organisation as a whole.

The organisation includes the potential contribution to safety by non-operational areas in its safety planning.

Organisational culture and safety culture are considered and managed as the same thing.

Safety Interventions and enablers

Rules and procedures are adapted based on lessons learned from occurrences.

Safety Interventions and enablers

In addition to adapting rules and procedures following safety occurrences, the organisation analyses its risks more strategically.

Safety Interventions and enablers

The organisation’s understanding of safety is built from multiple perspectives – that of employees in different roles in the organisation and especially involving front-line staff

Safety Interventions and enablers

The organisation actively seeks diverse views of safety as a means to drive safety interventions.

Processes are in place to ensure that a safety concern will be escalated following the issue being raised, explored and consensus reached on the need for action.

Safety resources are used in a flexible manner that is targeted and safety activities are resourced and managed within business planning and reporting processes.

The SMS

Only applied on an ad-hoc  basis

No SMS for non -certified organisations

The SMS

There is an awareness that the SMS is a tool to be used and the need for training some roles in safety is identified and begun.

Safety is managed in an ad-hoc manner.

The SMS

The limitations of the SMS are acknowledged and organisations embark on both, training that supports intelligent use of the SMS (not just applying it) and the evolution of the SMS through progressive change.

The organisation trains employees to fulfil their safety responsibilities through developing the capability of those engaged in safety and managers who have an accountability for safety.

The SMS

The Safety Management System (SMS) encourages employees to proactively question procedures, practices and people to improve safety performance.

Guidance — all levels

Organisational culture embraces ‘safety culture’. Organisational culture includes the organisation as a whole and embraces the way that business decisions cascade through an organisation as well as the existence of subcultures which have their own perspective of safety, values and ‘tribal knowledge’, for instance the ATCO and engineering communities.

Differing functions and roles in an organisation have different views of risk, different risk appetites and, therefore, different perspectives of safety — which is in keeping with the perspective that the organisational culture brings.

As a result, differing roles and functions see safety differently with respect to the way that they build safety into their work. The approach to these different values and views of safety, how they are recognised, reconciled and translated into actions provides an indication of the management’s approach and commitment to safety.  An intelligent and effective organisational culture will embrace diversity, using the perspectives that such views bring to build a richer and deeper understanding of how the organisation performs and delivers safe provision of services. The choices made in managing the business, including safety and safe production, involves trade-offs, the consequences of which influence an organisation’s culture.

Understanding the decision-making of managers who have both the accountability and the authority to deliver or facilitate the delivery of solutions to safety concerns is one way to explore organisational culture. This includes business decisions about the allocation of resources and budgets in an organisation. These trade-offs reflect policy and business choices made by the ANSP as well as those that are externally driven. For example, the business strategies that ANSPs adopt to meet the requirements for the SES RP3 targets in all Key Performance Areas (KPAs). 

Guidance for the Defined Level

Concept of Safety:

The key difference between Level A ‘Informal Arrangements’ and Level B ‘Defined’ is that whilst the organisation still ‘enforces’ safety through adherence to rules and procedures, there is a growing realisation that this approach has limitations. This may be because there are repeated behaviours by people that the organisation attempts to control with very limited effect. In practice, this means that the reliance and underlying belief that only rules and procedures ensure safety is fundamental as is the confidence in behaviour-based safety.

Rules and procedures cannot be expected to cover all possible operational eventualities. They are underspecified — they cannot cover all possible situations.  As a consequence of this, continuing to add procedures and rules can make an operation less safe. This notion of safety will be beginning to be understood by ANSPs at the ‘Defined’ level, but not acted upon.

Critical to facilitating this understanding is the way that safety departments undertake the investigation of reported occurrences. Arrangements need to be in place that recognise these ways of thinking about safety. 

Safety Culture

Organisational decisions around resources and efficiency lead to consequences which are all perceived as degrading safety such as:

·            insufficient operational resources to manage demand requiring the imposition of ATFCM measures (leading to delay performance worsening);

·            changes of watch rosters to adapt capacity to demand that are beyond agreed rostering guidelines;

·            an increase in additional attendances (overtime);

·            insufficient slack to enable secondary operational duties to be undertaken;

·            engineering service level agreements slipping;

·            training for new projects slipping;

·            fatigue is perceived as increasing.

These issues reinforce the reality that decisions that are made in the non-operational sections of an organisation influence the safe provision of services.

An ANSP at the Defined Level begins to listen to the others’ views but will have a reluctance to act upon what is heard. Therefore, concerns may be raised, but are rarely if ever pursued by those who the discussions take place with. As a result, the views of risk of those managing and those being managed grow ever greater apart. This will, therefore, shape the safety culture as well as organisational in-house employee surveys.

Indications that an organisation is at the ‘Defined’ level may also include:

·            safety culture is acknowledged as necessary and is implemented following the relevant regulatory guidelines and management system requirements;

·            there are no discussions around quality service delivery versus safe provision of services, because it is the perception that there is no point. It is not the place for employees to challenge management.

Signs that the organisation is not yet at the ‘Managed’ level may include:

·            senior management presence in operational spaces at times when there are delays, but never during safety events;

·            human error and deviation from rules and procedures is still the principal focus of safety investigations and interventions;

·            management does not involve the operational community in identifying ways of improving safety performance;

·            people may be stigmatised for repeatedly raising safety concerns that they have;

·            training is used as a corrective and disciplinary action;

Investigations seek to determine whether or not procedures were precisely followed as a means of establishing what happened and why, by placing undue emphasis on the procedures at the expense of the context.

Safety Interventions and Enablers

In addition to adapting rules and procedures following safety occurrences, the ANSP analyses its risks more strategically. Safety interventions, or safety mitigating actions, do not include systemic or structural solutions — instead, they just consider human actions or technical failures associated with specific occurrences.

The SMS

ANSPs at this level can be expected to have begun implementing a Safety Management System (SMS). As a result, the internal safety discussion begins to change with the ensuing safety measurement, and safety promotion becomes more visible. The safety discussion will be characterised by a lack of transparency — safety teams and managers, for example, leading the discussion with little structured or formal inclusivity of others in the organisation. Safety improvements are limited to what guidance is given by the SMS.  There is an overwhelming confidence that safety will be delivered by following the SMS.

Guidance for the Managed Level

Concept of Safety:

At the ‘Managed’ level, there is recognition that staff contribute to the safe provision of services through the way that the operational tasks are undertaken, including the way that trade-offs in the operation and beyond are taken. These rely on an intelligent use of strategies that are sensitive to operational risk and that achieve safe provision of services. For example, if ATFCM measures are needed, and it is known that if the need is there to do so, there will be no criticism around the consequences on service provision, but there may be enquiries to gain a broader appreciation of the context. The impact of this evolutionary shift is that there will be a gradual decrease in the use of disciplinary and behavioural means to sustain safety and a shift towards making changes in structural factors in the operational environment that shape safety events. There is a recognition that ‘people create safety’ in ways that cannot be encapsulated in rules and procedures alone.

More specific activities might include:

·            the use of traffic management techniques to allow those involved in an event and who have to file an occurrence report to have the time to do this, and to recover from the event;

·            where there are competing demands made for limited operational resources, then safety is an explicit part of decision-making where appropriate — the safe provision of services will be embedded in the trade-offs;

·            managers and supervisors develop a view of how the safe provision of services is by engagement with operational staff — leading to an informed discussion that develops confidence in organisational decision-making;

·            managers and supervisors actively seek the views of both the operational and non-operational community to gain an informed view about organisational safety, which may lead to a better understanding of how effective safe production* can be enhanced;

·            managers and supervisors make themselves available when staff wish to discuss safety concerns with them;

·            staff representative organisations meet regularly to discuss and engage about safety;

·            organisations accept that procedures and rules cannot fully describe every eventuality. As such, they do not rely on new or additional rules and procedures as the only safety intervention, because they know that this can introduce new risks and without addressing structural issues.

Safety Culture

Indications that an ANSP or organisation has reached Level C ‘Managed’ can be found in the way that the ANSP has transitioned from the organisation seeing safety culture as a distinct independent entity, towards viewing it as a part of the overall organisational culture. The emphasis in this change can be seen in that the ANSP engages with those who work within it.

At Level C, the value or benefit of safety in an organisation is recognised and promoted by managers and supervisors. Important indications are:

·            the use of organisational resources to develop safety education;

·            whether safety is integrated into business planning, including provisions for safety in the long-term investment planning;

·            the safe provision of services versus quality of services is discussed.

Safety Interventions and Enablers

ANSPs at the ‘Managed’ level have evolved processes and mechanisms that use means other than occurrence reporting to assess, understand and manage risks. These processes and mechanisms have evolved beyond relying solely upon the use of the attribution of causal-factor taxonomies from occurrence reporting alone as it is recognised that this alone is limited and provides an incomplete understanding of an organisation’s safety because:

·            it may not reflect the actual frequency of such events; the processes and mechanisms need evolving to encourage people to report because there is little seen to happen once a report has been filed;

·            there might be inconsistencies between incident investigators that lead to a lack of confidence in the causal-factor attribution;

·            safety interventions derived solely from causal attribution are seen to yield limited effectiveness or not to be able to find suitable solutions.

The organisation’s understanding of safety should be considered from multiple perspectives – that of employees in different roles in the organisation and especially those staff providing the operational service.

As a result, complementary techniques are identified, examined, and experimented with and begin to be used in occurrence reporting, although incrementally at first. Some examples of techniques that may be used are:

·            the inclusion of human factors investigation narratives;

·            the use of ‘second stories’ to gain an understanding of not just ‘what’ happened but ‘how’ the event occurred; 

·            exploring ‘why did it make sense to them’;

·            the scope of the occurrence and incident investigation is broad and encompasses a larger sample of accounts including those outside the ANSP;

·            the use of aircraft operator narratives and flight data;

·            an explicit recognition that the operational context is complex and, therefore, what happened can be better understood by exploring the interactions between actors and system components as well as the multiple views that are used to produce a composite view of the event;

·            using the understanding of the operation that comes from observing safe production* in practice to develop an understanding of typical ATC operations;

·            the introduction of investigator competence training and inter-investigator consistency schemes along with continuing professional development to enhance investigation skills;

·            expanding the organisation’s understanding of safety by taking the views of the wider organisation and explore path dependency (history as cause).

The SMS

A move from strictly following the SMS to an intelligent application of the processes can be seen. This is about understanding the intent of the SMS and ensuring that this is realised rather than just blindly applying its processes. This change may be driven as a result of the experience in applying the SMS to a range of changes within the ANSP, for instance across a range of technical systems with increased complexity. Additionally, there will have been new stakeholders, e.g. engineering teams, change management, business risk, supply chain and software engineering that will contribute to different issues and perspectives.

ANSPs can elect to develop proportionate applications of the requirements of an SMS so that it is not applied uniformly across all projects or within the ANSP’s activities, i.e., a risk based approach to safety management. In so doing, progressive and intelligent application of the SMS provides evidence of an ANSP or organisation that is functioning at the ‘Managed’ level.

Guidance for the Assured Level

At Level D, ‘Assured’, safety should be considered as a property that is created within the organisation, not something that the organisation has. Safety is viewed as the domain of the organisation as a whole, not simply a component of operational departments and a selection of non-operational departments. The ability of the organisation to effectively manage change, whether large or small, is a defining feature at this level. The ANSP recognises that non-operational elements of an organisation contribute to the safe provision of services.

Concept of Safety:

Change brings with it numerous challenges and threats to sustaining performance, as well as to managing resources across the organisation as a whole. Such threats and challenges are necessarily organisation-wide and will involve third parties and many other actors.

At the ‘Assured’ level, the ANSP’s SMS is designed around the recognition of the influence, effects and consequences of change on the safe provision of services, including how they affect people. It will make provision for this in business and safety management systems, including assessments and mitigations of change as both business and safety risks. More specific characteristics include the following:

·            the ANSP is sensitive to the balance between design changes at a late stage and its impact on implementation, including training and user confidence;

·            accountable managers who have to accept the change draw from the widest group of actors and work with them to determine a perspective of how the change is being implemented, as well as the preparations for training and readiness for the change;

·            processes are used that assess the quality of transition training at all stages of its design and implementation and changes that flow from changes in the design;

·            the management of change processes extends beyond the actual implementation date and include post-implementation activities, including formal and informal verification of the design, the way that work has changed, review of performance, and adequacy of training;

·            sustaining an operational service throughout the transition steps will demonstrate preparedness to limit the scale of the operational task until it is agreed to increase the scale of the operational task beyond any restricted levels of service delivery.

Safety Culture

At this level, the ANSP recognises and implements safety as part of the overall organisational culture. In practice there are inevitable trade-offs between production–efficiency–safety–business planning. The ANSP will have evidence of formal and informal processes that accord an appropriate priority to safety. It is in the decisions that are made that balance and reconcile these conflicting demands, and reconcile the resource implications, that the value of safety can be seen. For example:

·            situations that are assessed to influence safety are seen as opportunities to develop a stronger and more effective safe service delivery process;

·            the need to pursue a strategy that is perceived as threatening safety by the operational community is managed in ways that are transparent and open to challenge;

·            it recognises the need to gather the knowledge behind fears, concerns and perceptions, and to meaningfully engage with the organisational view that this brings.

Safety Interventions and Enablers

Organisational approaches to learning lessons recognise that there are limitations to classic and current approaches to safety processes. An organisation that is sensitive to this recognises that there is a learning potential in examining the formal processes and system of lessons learned at each step of the life cycle of an occurrence report. For example:

·            initial filing of the occurrence report;

·            the way that the reporter and others involved in the event were managed and cared for;

·            the process of managing those people at the time of the event, i.e. release from an operational position;

·            the quality and value of the initial occurrence report;

·            formal investigation processes and systems;

·            recommendation generation;

·            feedback loops;

·            safety oversight and review committees;

·            safety data propagation.

To support learning from safety occurrences, investigators should be provided with dedicated continuous professional development to enhance both their understanding of safety and their investigation techniques. Investigators should be aware of the models of accident causation that they are using.

The SMS

The SMS will encourage challenge and critique as part of its contribution to a safer and more effective ANSP. Challenge and constructive critique are means of a feedback loop that can provide fundamental information about how the work system is behaving and ways to make structural changes. The SMS will emphasise the limitations of safety mechanisms and provide a clear evaluation of the strengths and weaknesses of the orthodox safety interventions.

Component 1: Safety Culture

Study Area 1: Development of a Positive and Proactive Organisational Culture

Question 1.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A just and open climate for reporting and investigating occurrences

Note: A thorough reporting and investigation process should begin with notification, data gathering, reconstruction, analysis, safety recommendation and implementation of remedial actions, resulting in final reporting, exchange of lessons learned and effective monitoring.

Just Culture

Management does not see the need for any activity or dialogue with the staff in this area.

Just Culture

Management and employees recognise the need to have Just Culture, in order to encourage reporting.

Management and employees enter internal dialogue including the union and the staff association.

It is common for human biases to be present in the investigation and interpretation of occurrences, in particular fundamental attribution error.

The difference between acceptable and unacceptable behaviour is misunderstood and misapplied.

Just Culture

The organisation has established policies and procedures to support Just Culture principles.

After initial training and education across the organisation, continuation training and education is provided.

Where decisions around ‘acceptable’ and ‘unacceptable’ behaviour are made, a process is in place that arbitrates such decisions with representatives, trained for the task.

Staff conditionally support Just Culture principles and management’s commitment towards it.

Just Culture

Just culture has evolved through several iterations of development of Just Culture policy, principles, processes and philosophy.

The organisation has learnt how to measure the acceptance of Just Culture principles and recognises the limitations of such measurement.

There is evidence that the application of Just Culture is unaffected by changes in the organisation.

Lessons from within the organisation and across different industry sectors are used to enhance the organisation’s approach to Just Culture.

The value of reporting

The value to individuals of reporting occurrences is seen as low, because the risk of consequences is high.

There is a perception that there is no contribution to safety by filing an occurrence.

The value of reporting

There is recognition that reporting occurrences has the potential to contribute to safety. However, this is limited to circumstances where:

·            an occurrence will not bring criticism or consequences upon the reporter, or

·            an occurrence is perceived as being of serious safety concern (to the reporter) or to the aggrieved party, who suffers consequences arising as a result of the reported event. 

The application of just culture is viewed by individuals as inconsistent and unreliable.

The value of reporting

The value of reporting is recognised, but the emphasis in undertaking Just Culture is on the consequences for individual actions in the most part.

Reporting and investigation principles and processes are predominantly human-centric in their attribution of causes of occurrences.

All levels of the organisation are aware and accept the difference between ‘acceptable’ and ‘unacceptable’ behaviours.

The value of reporting

Reporting is seen as one source of safety intelligence that contributes to a better understanding of how the operation and organisation functions.

The focus of occurrence reporting is around how safe and effective system performance can be sustained and enhanced. 

The focus of reporting and investigation is on safe service provision, not as a mechanism for social control that reinforces the need to comply with the rules].

The emphasis of reporting and investigations is on safety and not the consequences of unsafe events

The Reporting culture

The reporting culture is one of ‘blame and shame’.

Many events go unreported.

The Reporting culture

The reporting culture is one where there is an awareness of the need and benefits for reporting but that the trust in the organisation and processes are lacking.

Reporting and investigation processes, across the organisation are in the formative state of building a Just Culture.

Reporting events is common, but many are unreported.

The Reporting culture

An open reporting culture is present where reports are filed.

The value of reporting is devalued by the limitations of the reporting and investigation processes themselves e.g. feedback to reporters, quality of recommendations and recommendation tracking (which is not incorporated into ANSP Business Management processes).

The Reporting culture

Just culture is seen as in the service of safe service provision.

Open reporting is perceived by staff as a means of contributing to safe production* and shaping their future operational environment.

A competency scheme for investigators is applied.

Disclosure

Disclosure of occurrences is on an ad hoc basis.

Formal policies are not yet in place to address:

·            Protection of reporters of occurrences

·            Support to those subject to regulatory or judicial action.

Disclosure

Except as provided for in Regulation, disclosure of occurrences to external bodies is identified as a business risk as well as a deterrent to open reporting.

Internally, disclosure of occurrence reports and investigations is limited.

Policies have been developed defining protections and support to reporters, in line with Regulation (EU) 376/2014.

Disclosure

Within legal limits, the organisation's safety data are sufficiently protected from external interference.

Internally, occurrence data is shared widely and anonymously.

Policies defining protections and support to reporters have been tested and evaluated, based on feedback from those involved in occurrence reporting, investigation and follow-up.

Disclosure

The ANSP follows a clear and published policy on Just Culture matters that addresses the interfaces with both the judicial authority and the aviation safety regulatory authority.

Guidance for all levels

Just culture should not be seen as an isolated, separate phenomenon within the organisation. It is an outcome of open reporting (a prerequisite for a just culture) and it is part of the organisation’s overall culture, in much the same way as safety culture. Just culture is fundamentally concerned with safety, with the knowledge that is gained from disclosing information about a reporter’s experience and how this is used to derive safety interventions and improvements that lead to more effective system safety.

Evidence for a just and ‘open climate’ can be sought in a number of different ways that can assess just culture and its effectiveness. An organisation that has a just and ‘open climate’ will be one that:

·            emphasises that the purpose of just culture is to gain access to knowledge of the safe functioning of service provision, and does not place an undue emphasis on ‘gross negligence’;

·            embraces a reporting and investigation process that recognises the value of the reporter’s experience and the contribution and value that this knowledge brings to the safe and effective provision of services;

·            emphasises the value of knowledge gained from self-disclosure by those involved in an occurrence;

·            creates an environment where disclosure does not stigmatise individuals and works with peer groups as well as staff representatives to foster a climate of open discussion about experiences — reporters will share their experiences to increase the learning potential.

To achieve this level of confidence, trust is required within the organisation as a whole, but especially between the safety, supervision, managerial and operational actors. This is sustained by engagement, through an active discussion, and with a shared belief within and across organisational groups that fairness and the safe provision of services is the objective.

Guidance for the Managed Level

Just Culture

At the ‘Managed’ level, the just-culture principles in an ANSP will have been implemented. For implementation to have taken place, a number of enablers will need to have been established:

1.          A just-culture policy will have been developed and adopted. This policy will have evolved through the evolution of a just-culture discussion through engagement between the just-culture decision makers in an ANSP as well as others who can help create the just-culture dialog, e.g. staff associations, professional bodies, supervisory staff. This policy will reconcile how different functions and roles within an organisation understand safety. Understanding the issues and points of conflict between those inside and outside the Operations room and how differences are managed is one indication of the commitment to just culture within the ANSP by managers, safety teams, and staff associations.

2.          The deliberations around what is gross negligence, or, more importantly, what satisfies the provisions of Article 16 point 10 of Regulation (EUNo )    376/2014 with regard to wilful misconduct and manifest disregard of obvious risks will be explored and discussed with all internal stakeholders, e.g. staff associations. The interpretation of these provisions has consequences. An ANSP that is at the ‘Managed’ level will have developed positions and processes that manage the situations where an occurrence is considered to have breached the thresholds. The context and circumstances of each occurrence will be recognised as being potentially different and thus the different contexts need to be understood. Occurrences will be considered not solely in terms of what the people closest to the event did, but there will be evidence that wider systemic factors are or will be explored and examined, e.g. training, technical system limitations, procedure under-specification, supervisory decisions, the use of ATFCM, etc.

3.          A process will be in place that arbitrates and adjudicates decisions with regard to the determination of what is deemed as ‘acceptable’ and ‘unacceptable’ behaviour, especially with reference to Article 16 point 10 (a)      and (b) of Regulation (EU) No 376/2014.There follows another element of the process where these decisions are covered.

Training and preparation of staff is fundamental to implementing a just culture. The ANSP will have completed some form of initial training, and will then be engaged in delivering further training across the organisation to refresh the policy and process as well as to keep the concept of just culture alive. Attendance will have covered managers, supervisors and others involved with administering just culture.

Finally, an ANSP that has achieved the ‘Managed’ level will recognise that just culture is not a component that is ‘stand-alone’ or is, and of itself, the ‘end point’ of safety within an organisation. Just culture is in the service of safety and is an enabler or a necessary part of the evolution to another iteration of system safety. This will be observed in the ANSP’s or organisation’s dialogue around safety.

The value of reporting

Reporting of occurrences is recognised more as an activity that complies with EU legislation and with the SMS, and a means to enhance safety by deriving a risk landscape driven by a causal-factors scheme. The causal-factor scheme will emphasise an organisation’s understanding of safety that reflects the human as the cause of events. These will be derived by an investigation process that is predominantly focused on ‘what’ happened as opposed to ‘how’. ‘Why’ it happened is expressed in terms of human behaviour, i.e. human performance. Some events will be found to defy explanation in these terms and lead to some investigations being undertaken with an alternative perspective, but it is not widespread. Options may include: a view of what happened based on second stories; human error as the start of the investigation as human error is a symptom of a deeper problem within the system; a view of what happened from the local rationality of those involved (i.e. why did it make sense to them to do what they did?); and a system’s view of what happened: multiple perspectives from those involved including the wider organisational view.

What is ‘acceptable’ and ‘unacceptable behaviour’ will be something, at the ‘Managed’ level, that will still be inferred from the investigation. Examples are micro-matching what people did with the view of what should have been done as defined in rules, procedures, manuals; consequences of individual decisions and actions are emphasised, representing a narrative that is close to the proximity of the event; causal explanations will emphasise the human as cause despite some exploration of the context surrounding the event.

There is evidence, therefore, that the limitations of the human-centric approach are recognised and is evidenced in both the investigation narrative and recommendations.

The Reporting culture

An ANSP at the ‘Managed’ level will use the monthly counts of occurrence reports filed as an indication of open reporting, but will recognise that the nature of the reports filed or the quality of the process is contributing to a reluctance to report by those who are expected to report. In some cases, this may be directly related to the consequences of just culture. It is known that when consequences (e.g. disciplinary action, retraining, or the application of organisational justice) that result from an occurrence report being filed, there can be a marked reduction in the level of occurrences reported.

The ANSP or the organisation will have put in place occurrence-reporting mechanisms that will support the willingness to report. For example:

·            feedback to those who report that is timely and meaningful;

·            growing recognition that those who report have unique knowledge and understanding of the operational situation and event that can contribute to making the operational environment safer and/or more effective;

·            the reporting processes and methods, and the way that investigations are conducted are consistent with the just-culture policy and principles;

·            the value of reports is acknowledged and the safety interventions or improvements that flow from reporting are fed back to reporters;

·            recommendations for safety improvements have ‘owners’ who have the authority to enable the recommendations to be fulfilled.

Disclosure

Regulation 376/2014 requires that organisations shall not make available or use information on occurrences for any purpose other than the maintenance or improvement of aviation safety. Nevertheless, disclosure of safety data to external sources can expose those reporting as well as the organisation to, amongst other things, criticism, potential legal action and unwarranted interference. As a result, processes should be developed, tested and re-evaluated based on feedback from those involved in the occurrence reporting system. Such processes should protect both those who do disclose as well as facilitate the occasions where there is a legitimate reason for disclosure.  They should be clear to all those involved.

In some cases, ANSPs may have proactively engaged in discussions with external stakeholders, e.g. NSAs, to establish working arrangements to protect safety data that is disclosed to them or other external bodies that have a legitimate claim to safety data and received assurances through protocols or agreements to protect from unwarranted use of release into the public domain of such data. Note that Article 15 of 376/2014 “confidentiality and appropriate use of information” applies in all cases.

Guidance for the Assured level

Just Culture

An ANSP that has evolved to the assured level will have overcome many of the problems associated with the implementation of Just Culture.  This means that it has navigated its way through the tensions and conflicts that are a natural part of a change in the relationships between the many stakeholders with an interest in Just Culture. These tensions and conflicts are primarily involve the occurrence reporting and investigation process.

Evidence that an ANSP has matured or demonstrates that it has attained level D can be found in diverse ways:

·            Processes that support the development and implementation of Just Culture have evolved through experience which has in turn led to a base of knowledge that shapes solutions that support the ANSPs specific needs.

·            As a result, Just Culture is undertaken with a critical understanding that is accessible and used to explain the evolution of Just Culture within the ANSP. 

·            There is less variation in the interpretation and operationalisation of Just Culture by managers and the operational community do not misinterpret a “no blame culture” as being a Just culture

·            Underpinning these facets is the ANSP’s active and persistent commitment to arrangements surrounding disclosure of occurrence reports including, but not limited to, informal and formal cooperation with the judiciary and NCA.

The value of reporting

At the assured level, occurrence reporting can be expected to have evolved in ways that have developed confidence within the organisation’s commitment to the safety benefits that the underlying philosophy of Just Culture is intended to facilitate. As a result, there is a source of safety data from within the organisation that is multi-faceted as well as diverse.

It can therefore be expected that an ANSP manages safety occurrence reporting and investigation in a manner that values the understanding that discussing operational experiences brings.  This understanding leads to different questions, perspectives and lines of investigation that draw out safety interventions that will go beyond the usual scope of investigations e.g.

·            Managers and those who actively receive and use the output of investigations, acknowledge that an outcome of an investigation leads to new knowledge and questions to ask about how the work system undertakes its daily provision of services function. 

·            At the assured level, the ANSP’s occurrence report narratives and summaries explore and present findings about what and how events occurred, not who was responsible.  There will be evidence of investigators using investigation techniques such as second stories and narratives that make use of views of local rationality of actors.

·            This is enabled by the investigation and safety functions emphasis on structural features of the operational environment that shape safe provision of services

As a consequence, there will be demonstrable evidence that investigation narratives use language that is neutral and will include narratives from multiple perspectives that lead to a broader narrative.

The reporting culture

If a permissive reporting climate exists, reporters will submit occurrence reports that are more useful and insightful than that of a less permissive reporting climate.  Such a change may be enabled because fears or consequences of disclosure are reduced (not eliminated) which facilitates disclosure of events that would once have led to recriminations and stigmatisation.

·            The occurrence reporting and investigation process will have contributed to the confidence of operational and non-operation staff in the reporting and investigation process.

·            There will be qualified recognition by staff, but not a belief, that occurrence reporting and investigation is in the service of safety and a safe production* function.

·            The ANSP will demonstrate that the value of occurrence reporting from all staff is meaningful and this is reinforced and remains prominent in the day to day undertakings between management and staff;  dialogue around Just Culture is one that emphasises safety and not consequences

·            It is recognised that practitioners have a relevant and meaningful contribution in the understanding that is gained from occurrences and incidents.  This leads to a constructive involvement in occurrence reporting and consequential safety interventions for those who submit reports.

·            There will be evidence that safety interventions have been informed by those involved in the events or by groups closely involved in operations relating to particular events.

·            Many of those (but not all) subject to investigation as well as the wider organisation have the prevailing view that occurrence reporting leads to accurate and meaningful reports and that the ANSP uses this to implement relevant safety improvement.  The use of safety promotion is constrained internally in favour of safety interventions or further exploration of the event from different perspectives e.g. second stories

Disclosure

At the assured level, an ANSP has developed diverse relationships with a variety of actors with legitimate interests in the disclosure.

·            ANSPs will expect that there will be circumstances where organisational culture will be tested, when events invoke consideration of Just Culture and have been disclosed.

·            ANSPs at the assured level will be able to demonstrate  with confidence that all stakeholders (internal and external) see that a just and open climate for reporting rarely leads to consequences involving or behavioural or social control.

·            Staff have confidence in the arrangements surrounding the disclosure of information, which are within the constraints of Article 15 of 376/2014 “confidentiality and appropriate use of information.”

·            There will be evidence of confidence in the organisation’s ability to protect the legitimate interests of employees, but also a recognition that there are vested interests that can have an influence outside and beyond that of the ANSP. There will be evidence that an ANSP at the assured level will be aware and have made some preparations for these eventualities. The associated policies will be clearly understood and published.

Component 1: Safety Culture

Study Area 1: Development of a Positive and Proactive Organisational Culture

Question 1.3

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Regular assessment of safety culture and an improvement programme.

The organisation does not see the need to have a safety culture assessment mechanism in place.

No improvement programme is necessary as there is no belief that safety culture makes a contribution to safe production*

At a given moment, the organisation evaluates or learns how employees understand safety, in the belief that this is an assessment of safety culture.

The safety culture assessment method is limited to simple binary questions (such as yes/ no). 

The organisation is treated as a single group of respondents; it does not recognise sub-cultures.

The assessment (preparation, collection, data analysis) is conducted in an informal manner.

Analysis of the results is limited to simple statistical measurements.

The organisation undertakes periodic assessments of safety culture, based on the organisation’s need.

The assessment method is questionnaire based.

The questionnaire is developed using the body of knowledge from safety culture studies and includes stratified samples where different groups are identified and sampled.

Preparation for the assessment is made formally including a commitment and endorsement from the executive.

Analysis of the results is undertaken using structured approaches that are able to contrast the views of different organisational groups and sub-cultures.

The results are communicated to the wider organisation.

The output of the assessment is used by management in improvement programmes.

The organisation undertakes assessments of safety culture, keeping in mind the risk of staff disengagement if these assessments are carried out too frequently.

The assessment methodology is multi-faceted.

·            Questionnaires are designed around areas of interest for the executive/management as well as what matters to staff.

·            The design of the questionnaire is trialled and involves staff associations.

·            The limitations of questionnaire-based assessments are resolved by using focus groups or other such mechanisms.

·            This provides an understanding of the results as well as meaningfully and purposefully engaging with staff.

Analysis of results is structured and explores the differences between different sub-groups/cultures of the organisation.

Analysis is designed to explore the underlying meaning of responses.

The emphasis in assessments is to engage and understand what staff have to say. Focus groups are undertaken that use mixed groups of personnel.

The results are communicated widely around the organisation, and are discussed with informants, for example through briefings.

The output of the assessment is used by management in improvement programmes developed from the results in a collaborative manner with staff and staff associations.

The results are benchmarked with external organisations.

Guidance for all levels

Measuring and assessing safety culture is a practice that allows organisations, if undertaken in a systematic and structured way, to gauge the state and strength of their safety culture and to identify the stressors that are influencing it. There are numerous and varied ways to assess and measure safety culture.  All have strengths, weaknesses and limitations. Therefore, organisations that undertake measurement and assessment of the safety culture will need to demonstrate an understanding of these and explain how:

·            the choice of the assessment method was influenced by consideration of strengths, weaknesses and limitations;

·            these were considered when analysing and reviewing result data;

·            these were used to determine the safety culture.

One of the most popular instruments for assessing and measuring safety culture is through a ‘Safety Culture’ questionnaire. A safety-culture questionnaire can be defined as a means to conduct a survey that aims to elicit the views and attitudes of respondents about safety in an organisation. These can include values (said and done), beliefs, assumptions, and attitudes towards others. These views and attitudes can be grouped into themes that can be drawn from models of organisational safety culture.

There are significant caveats around the use of methods such as questionnaires:

·            They have been described as ‘quick and dirty’ thus not capturing respondents’ views on long-term safety culture but instead the current prevailing safety climate;

·            Questionnaires alone do not provide the depth required to assess culture;

·            Safety-culture questionnaire results cannot be reliably interpreted or used at a generic level.

·            Unwanted influences on questionnaire respondents cannot be controlled.

·            Safety climate and safety performance have been found to be weakly correlated.

·            No distinction between perceptions and attitudes can be undertaken thus obscuring results obtained from a safety-culture survey questionnaire.

·            The questionnaires may not recognise and measure the safety culture variations between operations, technical and support functions.

·            If the analysis is limited to simple statistical measures they will not provide tangible explanations of the questionnaire results.

Guidance for the Managed Level

For ANSPs at the ‘Managed’ level, a safety-culture assessment will be carried out consistent with the ‘quick and dirty’ administration of safety-culture surveys.  The frequency of such assessments will be compliant with ICAO Annex 19 and other documented processes (e.g. provisions of the SMS, included in unit safety plans, or as a follow-up to an earlier safety-culture assessment).

The development of the assessment tool for an ANSP will be questionnaire based using both closed and open questions. The questionnaire will be designed in a formal and structured way and will be piloted to calibrate the results as well as to assess the scope for misinterpretation of questions and checking the sense of questions. It will target specific groups of staff in the ANSP allowing different views from different groups across the organisation as the basis for understanding different concerns as well as perspectives of safety. The results are openly shared and provide the opportunity to discuss these with senior managers.

Before the administration of the questionnaire, there will have been engagement with staff associations for comments and subsequent agreement. The ANSP will have achieved senior management commitment to the safety-culture assessment prior to the administration. This commitment leads to an endorsement and promotion of the safety-culture assessment by managers at all levels.

ANSPs at the ‘Managed’ level can be expected to use structured approaches to analyse survey assessment data. The results will be descriptive and will be able to compare and contrast the views of different groups’ answers to the questions. Data from open questions will be found to be of particular use, but no provision will be made for following up the results within the assessment methodology. Where an ANSP has access to statisticians or operational research teams, more sophisticated statistical techniques may be used, for example, multi-variant techniques, non-discriminant statistics.

At this level, ANSPs will not use techniques such as focus groups for follow-up discussions initially preferring to accept the interpretation of the analysis and results, with its acknowledged limitations, by management teams. However, there may be use of meetings where the results are presented back to staff who provide managers with feedback on the results. 

There will be limited use made of what is learnt. Safety improvements and interventions are driven and constructed by managerial teams. However, the experience and what is learnt from the assessment is seen as a valuable source of knowledge of the state of the organisation. This is a catalyst for change in the safety dialogue as well as its acceptance as a tool for managerial action to improve efficiency of operations and safety. The nature of the resultant safety interventions and improvements will be naturally superficial and very few if any that lead to changes within the operational environment.

Results are published and fed back within the organisation but not shared externally.

Guidance for the Assured Level

At the ‘Assured’ level, the ANSP will be aware of the issue of staff disengagement if these assessments are too frequent and recognise that the frequent administration of the survey method does not allow interventions and improvements to have full effect such that it will change the respondents’ perceptions and attitudes.

Component 2: Safety Policy and Objectives

Study Area 2: Safety Policy

Question 2.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

The safety policy of the organisation presents the organisation’s commitment to both safety and its resourcing. The priority of safety within the organisation is also articulated.

The need for a safety policy has been recognised but one does not exist.

The organisation has drafted a safety policy.

The draft safety policy is available for review within the organisation.

The safety policy reflects the priority of safety in the organisation.

The safety policy has been signed by the most senior manager in the organisation (e.g. CEO) and has been formally published.

The organisation conducts reviews of its safety policy at least once every five years to ensure that it continues to be relevant and appropriate.

The organisation has sufficient staff and resources to implement its safety policy and related procedures.

The safety policy has been communicated to employees throughout the organisation.

The safety policy is subject to ongoing review and improvement (e.g., when a new executive becomes accountable for safety or when there are indications that the policy does not adequately address the adequate level of commitment to safety).

The organisation compares its safety policy to those of other ANSPs.

If changes are made to safety policy, the organisation has a process to ensure that the SMS is updated to meet the amended requirements of the policy.

Updates to the safety policy are communicated throughout the organisation.

Guidance for the Managed Level

The safety policy is formally published, either internally or externally, as appropriate and in accordance with the organisation’s SMS.

The concept of reviews is an ICAO requirement and good practice would be to publish internally, as a minimum, using local mechanisms and ensure that staff are aware of the policy and how to access it.

There is a defined period of review within the organisation’s safety policy.

Everyone understands the role they play in delivering operational safety performance and they have the capability to discharge their role.

Component 2: Safety Policy and Objectives

Study Area 2: Safety Policy

Question 2.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

The safety policy addresses key attributes of the organisation’s approach to safety. These attributes will most likely include culture, visible endorsement, communication and safety reporting.

The organisation is considering which key attributes of its approach to safety should be included in its safety policy.

The organisation's approach to safety is reflected in its developing safety policy or related procedures.

There is a clear relationship between the organisation's safety policy and its SMS.

The organisation's safety policy or related procedures determine how safety management is implemented throughout the organisation.

The organisation's safety policy or related procedures define the procedures for safety reporting, including the types of behaviours that are acceptable and the specific circumstances under which disciplinary action might apply.

The organisation conducts periodic reviews of its approach to safety management and, where necessary, updates its safety policy and related procedures.

Guidance for the Managed Level

Safety policy is used to set safety accountabilities for senior management. There is a clear relationship between the safety policy and the procedures in the SMS.

With respect to disciplinary actions, organisations need to consider the impact of such disciplinary actions on establishing and maintaining a just and open reporting culture. They should consider the protections afforded by Regulation (EU) No 376/2014, and specifically Article 16, points 9 and 10. Organisations need to clearly state in their safety policy the circumstances and reasons why actions might be considered to fall within the scope of point 10.

Component 2: Safety Policy and Objectives

Study Area 3: Safety Accountabilities

Question 3.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

An approved, clearly documented, and recognised system for the management of safety. Management structure, responsibilities, accountabilities and authorities are clearly defined and documented.

No formal designation of responsibilities, accountabilities or authorities for the management of safety exists.

The organisation has identified its safety responsibilities, accountabilities and authorities.

Line managers accept responsibility for management of safety.

The organisation has defined and documented authorities, responsibilities and accountabilities for safety management.

The organisation has an accountable executive who has ultimate responsibility for the management of the SMS.

The wider leadership team takes responsibility for the application of the SMS.

The organisation reviews safety responsibilities after significant organisational changes.

The organisation reviews safety authorities, responsibilities and accountabilities at least once every five years to determine whether they are suitable and effective.

Guidance for the Defined Level

Line management is usually responsible for the implementation of procedures or practices which are required by the SMS, with specific responsibility for the development and application of the SMS. These responsibilities are not yet formally defined.

Guidance for the Managed Level

The wider leadership team is the team of people who report directly to the accountable executive.

Component 2: Safety Policy and Objectives

Study Area 3: Safety Accountabilities

Question 3.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A clearly defined safety management function / safety manager that is independent of line management.

A safety management function within the organisation has not yet been formed to develop the SMS.

The organisation has a safety management function or safety management position responsible for developing and maintaining the SMS.

The safety management function or position is independent of operational line management.

The safety management function or position has the authority to develop and maintain an effective SMS.

The safety management function or position has access to the resources required for the proper development and maintenance of the SMS.

Leadership, at the highest level, recognises its role in the SMS and actively supports its development, implementation, maintenance and promotion throughout the organisation (including support departments).

Guidance for the Managed Level

The safety management function or position independence of operational line management means that it reports and is accountable directly to the highest organisational level.

Guidance for the Assured Level

Safety leadership — the head of the organisation and senior management have made a commitment to safety and its application by fostering a just culture throughout the organisation. Air traffic service providers (ATSPs) should determine their own safety responsibility set as appropriate to their individual organisations. Individual job titles may differ from one organisation to another, an example of this follows: The head of the organisation might be termed the ‘Chief Executive’, and the safety manager might be called the ‘Safety Director’.

Support departments are intrinsic parts of an organisation; while not directly being part of the ATS provider, are involved in day-to-day operations in providing safe operations, e.g. CNS, MET, AIS.

The SMS is an effective management system which assists decision-making at the very highest levels.

The executive board is actively involved into safety-promotion activities.

Component 2: Safety Policy and Objectives

Study Area 3: Safety Accountabilities

Question 3.3

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Safety management accountabilities and responsibilities are understood clearly and accepted by all relevant staff and contracted staff.

Knowledge of the principles underpinning SMS among all staff and contractors is negligible.

Relevant staff and contractors apply rules and procedures to their tasks.

Relevant staff and contractors are at least partially aware of their roles and accountabilities in the SMS.

Relevant staff and contractors are aware of how their actions affect the safety of the wider operation.

Relevant staff and contractors are aware of how the actions of others affect safety.

Accountability for safety in the organisation is understood by all relevant staff and contractors.

Relevant staff and contractors throughout the organisation have responsibility for promoting and improving safety.

The organisation reviews and assesses documented safety management responsibilities at least once every five years.

Relevant staff and contractors take proactive, day-to-day action to have rules and procedures changed where they identify a potential safety benefit.

Guidance for the Defined Level

Relevant staff and contractors are those whose activities can impact on the safety of operations. Relevant contractors are those who are required to apply the organisation’s SMS.

For example, in the case of contracted staff that clean the OPS room, the supervisor would have accountability for ensuring the staff are appropriately briefed. The staff themselves would not have the accountability.

Guidance for the Assured Level

Staff and contractors believe that it is their responsibility to take action to have rules and procedures changed where they identify a potential safety benefit.

The documented safety management responsibilities are the responsibility of the safety manager and probably need to be endorsed by a safety review board (SRB). The internal SRB provides internal governance for the organisation. The members of the SRB are typically the senior managers accountable for the safety of the organisation. This SRB will, for example:

·            assure that safety risks and safety issues are proactively identified and effectively managed;

·            measure safety performance against safety targets and assure that appropriate action is taken;

·            assure that safety improvement actions across the organisation are prioritised and coordinated effectively, and that responsibility for follow-up action is allocated;

·            own and support SMS development; specifically, review safety policy at least once every 5years, taking into account best safety practices in similar industries;

·            provide direction for the continuous improvement of safety, including the recognition of best practices and implementation of lessons learned from internal and external sources;

·            assure that the safety accountability and responsibilities of the head of the organisation are reviewed regularly and maintained;

·            coordinate and track actions and recommendations arising from the Safety Oversight.

Component 2: Safety Policy and Objectives

Study Area 4: Coordination Emergency Response Plan

Question 4.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Emergency response procedures and an emergency response plan that documents the orderly and efficient transition from normal to emergency operations and the return to normal operations.

The organisation has sound primary air traffic management systems but does not have redundant capabilities or back-up systems

The organisation has procedures and at least some redundant capabilities and resources to manage some abnormal and unexpected situations.

 Emergency response procedures have been developed, documented and distributed to the appropriate staff.

The organisation both rehearses and updates emergency response procedures at least once per year.

The organisation's emergency response plan has been properly coordinated with the emergency response plans of other organisations that it must interface with during the provision of services (ICAO Annex 11 – 1.4).

The organisation's emergency response procedures and emergency response plan have been rehearsed through live or simulated exercises at least once in the past three years.

The organisation uses indicators to assess the effectiveness of its emergency response procedures, as tested during the regular exercises and rehearsals.

Guidance for the Defined Level

There are procedures and resources to cope with abnormal and unexpected situations.

Guidance for the Managed Level

The organisation ensures that emergency response procedures are updated at least once per year, e.g. contact information.

To achieve the managed process, organisations should have a defined and documented process that has been shown to work.

Emergencies include sudden system failures or other abnormal or unexpected situations, such as:

·            the loss of major air traffic systems, (e.g. radar display picture, electronic flight progress strip system, standby and emergency communications on multiple frequencies due to external interference);

·            the loss or failure in support facilities (e.g. power, air conditioning, building integrity);

·            aircraft emergencies (e.g. emergency descent, hijack, air defence security);

·            disruption of air traffic services (e.g. emergency dispersal of traffic, closure of an adjacent air traffic centre, runway closure leading to mass diversion).

The ‘plan’ should encompass what is to be done, including the interactions with other organisations (e.g. police, emergency services) and the ‘procedure’ should describe how it is to be done.

See requirement ATS.OR.200(1)(iv).

For example, Letters of Agreement or any other form of service agreement are in place with organisations and support the emergency response plan.

Guidance for the Assured Level

To reach the ‘Assured’ level, the organisation should be able to measure the output by running a simulation assessed by a combination of qualitative and quantitative indicators. The simulated exercise may include, for example, aircraft accident, hijacking events, environmental disaster, access to the OPS room, bomb threat, etc.

Component 2: Safety Policy and Objectives

Study Area 5: SMS Documentation

Question 5.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A formal SMS that meets all applicable safety and regulatory requirements.

There is no SMS in place. There may be deviations from safety regulatory requirements. 

The need for an SMS implementation plan is recognised.

The organisation has started to implement its SMS.

The organisation has developed an implementation plan to ensure that its SMS will meet regulatory requirements.

The organisation's SMS meets all safety regulatory requirements.

The organisation has completed all work required in implementing the SMS and meets all safety regulatory requirements.

The organisation exceeds minimum compliance requirements by operating at a higher standard of safety management.

Guidance for the Managed Level

There is a defined function responsible for ensuring that the SMS continues to meet regulatory requirements. There is a document in the SMS that maps the SMS against current regulatory requirements and shows that those requirements have been satisfied.

Component 2: Safety Policy and Objectives

Study Area 5: SMS Documentation

Question 5.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Clearly defined and documented safety standards and processes.

Operations manuals do not contain specific safety management procedures.

The SMS implementation plan includes requirements for:

·            Safety policy and objectives

·            SMS requirements

·            SMS processes and procedures

·            Accountabilities, responsibilities and authorities

·            Outputs such as investigation reports, performance trend reports and safety documentation to support changes to service delivery

SMS is implemented.

Safety management documentation is readily available to appropriate staff.

The organisation monitors its SMS processes and outputs regularly to identify any problems employees may have in applying the SMS.

Measures are taken without delay where there is a safety impact.

Guidance for the Managed Level

The organisation has published the necessary procedures, processes (e.g. SMS policy/framework) and tools (e.g. collecting hazards/deficiencies, feedback, lesson dissemination).

Guidance for the Assured Level

There should be evidence to show that relevant SMS processes and outputs (at least safety policy, SMM, occurrence reporting and investigation procedures) are reviewed on an annual basis (e.g. internal audits, peer review, safety board meetings), and measures are taken without delay when a safety relevant impact from the investigation processes or performance reports have been identified.

Component 2: Safety Policy and Objectives

Study Area 5: SMS Documentation

Question 5.3

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Safety management documents are regularly reviewed, assessed and maintained.

There is no formal process that maintains the SMS, nor is there an identified authority (or authorities) responsible for the updates.

The organisation has an informal process to address amendments to its SMS.

Someone within the organisation is responsible for updating the SMS.

The organisation has a formal process for maintaining all safety management processes and procedures.

The organisation's SMS is regularly reviewed and updated.

The organisation conducts formal reviews of any organisational changes that could affect safety and/or the safety management framework.

The organisation assesses the usability and accessibility of its SMS processes and documents.

Guidance for the Managed Level

‘Formal process’ means that the description of the responsibilities, input, output, activities, etc., put in place by the organisation for maintaining its safety management processes and procedures is formalised (documented) in the SMS documentation and is up to date.

‘Regularly reviewed’ means that the SMS is reviewed and, if needed, updated at least at the following occasions:

·            whenever there is an organisational change or a change in the provision of services that can have in impact on the SMS;

·            when analysing the outcomes of the safety monitoring system and SMS audits;

and in any case every 5 years (in line with point 14.1).

Guidance for the Assured Level

The types of justifications include the following:

·            evidence and/or outputs stemming from the formal review process;

·            feedback on its SMS processes and documents from staff working within the SMS procedures.

Component 3: Safety Risk Management

Study Area 7: Risk Management Process

Question 7.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Hazards to operations are reported and assessed.

Hazards to operations are not highlighted by either managers or staff. However, risks to operations are recognised.

The organisation is developing processes to assist in the identification and reporting of hazards.

The organisation is developing processes to assess the risk that hazards pose to operations.

The organisation is developing processes to document the existence of hazards and their risk levels.

The organisation has a sufficient number of qualified employees to assist in identifying and assessing hazards.

The organisation has taken reasonable steps to identify all hazards affecting its operations.

The organisation's hazard identification process is based on a combination of reactive, proactive and predictive methods of safety data collection.

The organisation regularly includes stakeholders in its identification and assessment processes.

The organisation addresses identified hazards as part of its process to improve safety performance.

The organisation reviews and updates its hazard identification and analysis processes at least once every five years.

The organisation monitors whether the hazard identification process is appropriately applied.

Guidance for the Managed Level

To identify threats, an ANSP should present a range of risk/hazard identification techniques to assist staff in identifying potentially unsafe events. In simple terms, this means determining what events can happen and when, where and why. There are a range of techniques that can be used to determine these elements. The technique used will depend upon the scenario under development and the life cycle stage at which the risk management activity is being undertaken.

The organisation ensures that it dedicates sufficient resources to assist in the identification and assessment of hazards, and that these staff are adequately trained in efficient techniques to identify and assess hazards and their risks.

These techniques of hazard identification includes combination of reactive, proactive and predictive safety data collection and measurement.

Lagging indicators are reactive measures whereas leading indicators are proactive measures:

·            Reactive: mitigate severity of safety events and threats;

·            Proactive: identify safety concerns before safety events happen; and

·            Predictive: inputs to and outputs from the safety system are used to predict future outcomes, and anticipate future exposure based on past performance data.

See Regulation (EU) 2017/373, and GM1 ATS.OR.200(3)(i).

The organisation involves all relevant stakeholders in the hazard identification and assessment process, including internal (e.g. operational staff) and external stakeholders (e.g. users of its ATC services or providers of services used in the provision of ATC services) setting up multidisciplinary teams, when needed.

 Guidance for the Assured Level

Given the central role that risk management plays in an ANSP’s SMS, it is essential that practices, processes, tools and policy are monitored and improved or updated as necessary. Such continuous improvement is supported by an effective review and monitoring cycle that may include the following:

•   measure risk management performance against established indicators;

•   measure progress against the goals set in the Risk Management Implementation Plan;

•   review the framework in light of internal experience and external benchmarking;

•   expand risk techniques based on industry experience (e.g. adopt the barrier model);

•   test compliance with the requirements of the risk management process;

•   report on how effective the organisation has been in meeting the objectives described in its risk management and safety policies.

Emerging risks may include drone operations, commercial space launches, etc.

Component 3: Safety Risk Management

Study Area 7: Risk Management Process

Question 7.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Assessed risks are mitigated or controlled.

There is limited understanding of the need to mitigate or control risk, even when risks are recognised.

The organisation acknowledges the need to mitigate and control risks.

The organisation has proposed the level of risk that individual managers can approve.

The organisation is establishing processes to document how appropriate controls and mitigations should be selected.

The level of analysis, assessment, mitigation and control of risk being undertaken is proportionate to the risk.

The organisation documents and enforces the level of risk that its managers can accept.

The organisation reviews the level of risk it can accept at least once every five years on the basis of its performance.

The organisation reviews its level of risk to ensure it is in line with the risk tolerance level of its governing body (e.g., Board).

Guidance for the Defined Level

The organisation is establishing processes to document how appropriate controls and mitigations should be selected, for example, through the hazard identification process. Controls are preventative mitigations and/or recovery mitigations.

Guidance for the Managed Level

This level of risk that can be approved when it is documented. When an individual or organisation accepts a risk, it does not mean that the risk is eliminated (i.e. some level of risk always remains, called residual risk). Rather, the individual or organisation accepts that the residual risk is sufficiently low. There is a less demanding process for analysis, assessment, mitigation and control when the resulting risk is minor.

The organisation ensures that managers can only accept risk levels that have been determined and documented.

Guidance for the Assured Level

The organisation uses actual operational performance data to review its risk criteria, meaning the level of risk that the organisation can accept. To achieve this level, at least 5 years of performance data are required to be used in the review. This level of risk is ensured to be in line with the risk-tolerance level defined for the safety board of the organisation.

Component 3: Safety Risk Management

Study Area 7: Risk Management Process

Question 7.3

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Risk controls** are monitored for effectiveness, and remedial action is taken if controls are not working effectively.

There is little understanding of what constitutes a risk control** at either a system or local level.

The effectiveness of these controls is not evaluated.

There is a reasonable understanding of risk controls** in the organisation.

The organisation is developing processes to identify, assess and control operational risks.

The organisation has formally documented its risk control** processes.

The organisation is implementing risk control processes.

The organisation is identifying and documenting operational risk controls.

The organisation has implemented processes and practices that allow it to measure its operational risk baseline***.

The organisation regularly monitors the effectiveness of risk controls**.

Where deviations or deficiencies are identified, the organisation has proposed improvements to the risk control framework.

The organisation’s long-term investment programme provides for improvements in safety that address key risks (e.g., safety tools, additional staff, training).

The organisation identifies and manages performance deviations and deficiencies from its operational risk baseline***.

Guidance for the Defined Level

Risk control, also known as hazard control, is a part of the risk management process in which methods for neutralising or reducing identified risks are implemented. Controlled risks remain potential threats, but the probability of an associated incident or the consequences thereof have been significantly reduced.

Risk controls come in different types, such as procedures, technological (either software or hardware), or training. In other words, risk controls can be design changes to the functional system aiming to control safety risks (or hazards) that have been identified by the organisation. Sometimes, risk controls can be integrated into pre-existing parts of the systems, for example, risk-specific information can be added to pre-existing regular briefing sessions.

**Risk control framework is the combination of all reactive, proactive and predictive measures and actions within the ANSP to collectively and continuously manage identified risks/hazards. (from IR (EU) 2017/373 ATS.OR.200 (2))  

***Operational Risk Baseline relates to the top safety objective of an organisation “to ensure that its contribution to the risk of aircraft accidents is minimised as far as is reasonably practicable” (from IR (EU) 2017/373 ATS.OR.200 (2) (iii)).

Guidance for the Managed Level

The ATS organisation has to develop risk-control processes to identify, assess and control safety risks. These processes should be documented as part of its SMS processes, and the organisation will effectively apply them. These processes may be embedded in the wider processes of monitoring the behaviour of its functional system within its context of operation and the management of changes to the functional system of the ATS organisation. They will aim to identify, manage and mitigate associated risks to the behaviour of the ATS in the context where it is provided and to any change to the functional system that is proposed for implementation, to an acceptable level, as appropriate, by using specific and verifiable safety criteria.

The resulting risk controls need to be clearly identified and documented to allow a proper monitoring of their effectiveness.

 Guidance for the Assured Level

When these risk controls are monitored periodically, the level ‘Achieved’ will enable the ANSP to claim the ‘Assured’ level. The organisation should be able to demonstrate when was the last time that the review took place, and that it was in line with the stated periodicity.

Deviations or deficiencies identified in the monitoring should be part of the risk-control process, and it should trigger changes to the risk controls. This means that the risk-control process should include a process to develop corrective actions, e.g. Further changes to the functional system. There is a formal responsible within the organisation to ensure improvements in the risk-control framework.

There is a corrective-action procedure that monitors performance deviations and deficiencies from its operational risk baseline.

Component 4: Safety Assurance

Study Area 11: Safety Reporting

Question 11.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A continuing organisation-wide process to report and investigate safety occurrences and risks.

There is an informal system in place for reporting safety occurrences, but reports are not reviewed systematically.

The reporting system is not organisation-wide. 

Investigation is done on an ad hoc basis with little or no feedback.

The organisation investigates incidents, even if there is no formal investigation process.

The organisation provides feedback to staff on investigation findings.

The organisation has a formal reporting and investigation system.

The organisation keeps formal records of all incident and accident reports and related information.

Investigations result, if necessary, in corrective and preventive action.

Staff reporting safety occurrences can also suggest ways to solve problems identified in their occurrence reports.

The organisation provides feedback to those who report occurrences or hazards of any corrective actions taken as a result of their report.

The organisation checks to ensure that all required occurrences have been reported.

The organisation monitors the number of reports that require investigation but are yet to be investigated.

The organisation measures the quality and effectiveness of its investigations.

Guidance for the Defined Level

The feedback provided to staff in the ‘Defined’ level is of general nature and it is done on an ad hoc basis.

Guidance for the Managed Level

The organisation has a formal reporting and investigation system, including both mandatory and voluntary occurrences. The distinction between mandatory and voluntary reports is given in Regulation (EU) No 376/2014.

There is a formal process in place to ensure that corrective and preventive actions are monitored and managed.

The occurrences and related investigation information is recorded and personal data are secured. De-identified information can be disseminated within the organisation, as required. Personal details are protected and only used to investigate occurrences with a view to enhancing safety.

Staff are allowed, and even encouraged, to provide solutions either during the initial reporting or during the incident interview, as appropriate.

The occurrence-reporting system has formal ways to provide feedback to occurrence reporters, as a minimum, either with the result of investigations or corrective actions to be implemented.

Guidance for the Assured Level

The organisation actively reminds staff and promotes the reporting of occurrences, either by safety-promotion campaigns, surveys and/or audits that emphasise the importance of occurrence reporting.

The organisation measures the quality and effectiveness of its investigation process. This concerns more the quality of the process, and less to the effectiveness of the investigation output. In particular, the number of open occurrences that require investigation, thereby monitoring the time taken to close the investigation.

Good practices include, for example, to apply a moderation process to ensure consistency of the investigations and that the data are recorded, stored, and are of adequate quality and available for future analysis.

Notifications on relevant ATM/ANS-related occurrences that have been reported by other organisations (e.g. operators/pilots) are included in the investigation process of the ATS provider. They may also be used for random testing that these occurrences are reported internally by its staff. Where available, automated safety data recording systems are applied and information used in the identification and investigation of occurrences.

The quality of the investigation process is reviewed in the course of internal audits, surveys and peer-review meetings (e.g. safety experts from adjacent ANSPs). The results from external oversight activities are used in order to improve not only the quality but also the effectiveness of the investigation process.

Safety-promotion activities (e.g. briefings, safety days, leaflets in the OPS room) focusing on mandatory occurrences are conducted regularly.

Component 4: Safety Assurance

Element 12: Safety Surveys and Audits

Study Area 12.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Internal and independent (external) safety surveys and SMS audits.

There is no plan to conduct systematic safety surveys and SMS audits.

Safety surveys, SMS audits, and gap assessments are conducted on an ad hoc basis.

The organisation has a plan either in place or under development to formalise how SMS audits are conducted.

The organisation has carried out any SMS audits.

The organisation has a formal process describing how to conduct SMS audits.

The organisation conducts internal SMS audits at least annually.

SMS audits have resulted in the development and implementation of improvement plans.

The organisation carries out safety surveys in addition to SMS Audits.

The organisation's safety surveys are carried out systematically.

The organisation has established a process to analyse trends arising from safety surveys and SMS audits.

Where appropriate, the organisation conducts reassessments to confirm that any implemented recommendations arising from safety surveys and SMS audits have been successful.

The organisation commissions external surveys and SMS audits at least once every five years.

The outputs from safety surveys and SMS audits are incorporated (as appropriate) into operations or the SMS.

The organisation has established a process that requires external data (e.g., pilot non-conformance with ATC instruction trend information) to be considered when selecting topics for operational safety surveys and SMS audits.

Guidance for the Assured Level

Safety audits focus on the integrity/compliance of the entire SMS whereas safety surveys proactively concentrate on particular elements of the SMS or procedures of specific operations (e.g. problem areas, areas of confusion). The surveys are used to identify ‘what goes right’ and ‘what needs to improve’.

Safety surveys provide a systematic review to recommend improvements where needed, to provide assurance of the safety of current activities, and to confirm conformance with applicable parts of the SMS.

During safety surveys, auditors examine procedures or processes related to a specific operation to identify weaknesses and/or areas for safety improvement within the aviation service provider’s organisation.

Safety surveys are conducted on the basis of a safety survey plan.

The safety survey’s results are documented in a survey report that also includes the actions to be taken. 

Lessons learned from safety surveys are disseminated and the actions identified are carried out within the defined time frame. The follow-up is conducted in a systematic way; in addition, the organisation is aware to what extent the lessons learned drive changes into the SMS.  

External surveys and SMS audits are carried out by an independent body (e.g. EUROCONTROL, SMS experts, and competent personnel from other ANSPs).

The topics for safety surveys and SMS audits may be identified by means of safety performance (e.g. indicators, trends) as well as through suggestions from members of staff and occurrence notifications from different reporters/reporting entities (e.g. ATCOs, pilots, aerodrome personnel, operators). A risk-based approach can be applied if deemed necessary.

Data gathered in the course of meetings (e.g. between ANSPs and operators, international best-practice exchange) may also be used to trigger a safety survey or SMS audit. External data could also be gained from stakeholders’ ‘complaints’.

Component 4: Safety Assurance

Study Area 13: Safety Performance Monitoring

Question 13.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

An established and active monitoring system that uses and tracks suitable safety indicators and associated targets (e.g., lagging and leading indicators).

There are no indicators, thresholds or formal monitoring systems in place to measure safety achievements and trends.

The organisation has a plan in place or under development to implement a safety performance monitoring system.

The organisation has established safety indicators.

The organisation has implemented and formally documented a safety performance monitoring system.

The organisation's safety performance targets are meeting all applicable regulatory requirements.

The organisation has developed targets to reflect its safety policy and risk tolerance.

The organisation analyses trends for safety improvement purposes.

The organisation has safety indicators covering all aspects of the system or operation.

The organisation uses leading indicators to increase the range of safety metrics for measuring its performance.

Safety management processes require that any negative trends in safety performance indicators be addressed.

Guidance for the Managed Level

Targets should not be set arbitrarily. Consideration needs to be given to: (a) the variation and sensitivities in the data monitored thus far; (b) the potential impact of system changes; and (c) the forecast impact of planned safety improvements. Set a realistic target that is based on the organisation’s current performance with reference to previous performance, which results in a long-term view for the organisation.

Indicators and targets have been set limited to meeting the safety regulatory requirements to verify the safety performance of the organisation.

Statistical measures can be used to identify trends. Consideration also needs to be given to metrics that are not changing when they should be, or to risks that may be reducing but not quickly enough.

Safety indicators need to cover the full scope of the organisation’s operation and should consider all aspects of the SMS. Examples of safety indicators cover a range of metrics, such as safety incidents and associated risk monitoring, surveys, staff attendance and sickness, or implementation rates of safety policies, procedures and equipment.

Leading indicators are early-warning measures that detect a change in the risk levels. For example, falling staffing levels can for a time be absorbed by longer working hours, but eventually more tired controllers may be more error prone. Hence monitoring staffing levels can provide an indication of a change in the risk levels. Other examples include organisational finances and staff sickness rates. Safety improvements may also be forecast via implementation of new safety equipment — although care needs to be taken to include the risks associated with the change and to avoid being too optimistic. Either positive or negative, changes in the trends or outputs of performance indicators should be investigated and understood.

Examples of leading indicators of safety may include:

·            sickness levels,

·            staffing levels,

·            staff turnover,

·            critical incident SM,

·            workload measures,

·            failure to comply with regulations,

·            unmitigated high-level risks,

·            observational methods (normal operation safety surveys).

Guidance for the Assured Level

A mature safety performance monitoring system will contain the following elements: monitoring, filtering, trend identification, analysis, mitigation-measure development, dissemination, verification, document, and feedforward.

Note that ‘feedforward’ is meant to use leading indicators that put emphasis on anticipated or expected disturbances associated to risks as opposed to feedback that focuses, instead, on actual outcomes.

Component 4: Safety Assurance

Study Area 13: Safety Performance Monitoring

Question 13.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Methods to measure safety performance, which is compared within and across ANSPs.

Ad hoc safety performance data related to individual incidents is available, but there is no systematic approach for measuring safety performance.

At least some parts of the organisation have implemented safety performance measurement processes.

The organisation has implemented qualitative techniques to measure safety performance (e.g., opinion surveys, observational techniques, and overload reports).

The organisation has implemented quantitative techniques to measure and verify safety performance.

The organisation has implemented measures to validate the effectiveness of risk controls and mitigations.

The organisation conducts internal comparative analysis.

The organisation works with stakeholders to conduct external comparative analysis.

The results of the organisation's safety performance activities influence the operational safety survey and SMS auditing programme.

Guidance for the Managed Level

Quantitative techniques should cover more than the simple counting of events. They are used to establish genuine changes in the system performance and in implementing safety interventions, where appropriate.

The organisation uses occurrence reports and investigation reports when evaluating the effectiveness of risk controls and mitigations. Due consideration is given to the contributing factors identified in occurrences and investigation reports.

Guidance for the Assured Level

Both internal and external comparisons of safety performance should be carefully designed to ensure that differences in the nature and size of the operation, or the data-collection methodologies, are identified and accounted for. Organisations should be proactive in identifying partner organisations with which to conduct comparative analyses. In addition to high-level comparisons, these partnerships may include monitoring where a particular unit or type of operation has no internal equivalent and thus is compared with a unit or type of operation at the other organisation. The aim of such comparisons is to highlight differences that should be examined in more detail in order to understand their causes. The staff should have the opportunity to review the comparative performance analysis of their unit.

Component 4: Safety Assurance

Study Area 14: Management of Change

Question 14.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Documentation and reporting mechanisms are in place to ensure that internal and external stakeholders understand how safety risks introduced during and/or following implementation of change are managed and mitigated.

There are no change management processes in place even though the organisation recognises that impacts of change must be managed.

The organisation is developing change management processes to assess and quantify the risks of change.

The organisation is developing change management processes that require the involvement of stakeholders.

The organisation's change management processes determine whether a change should be authorised.

The organisation's stakeholders, including its regulator, are aware of these processes and their purpose.

The organisation assesses the safety impact of changes and associated mitigations before they are introduced.

The organisation's change management processes are reviewed and updated at least every five years (e.g., from internal experience, external lessons learnt).

The organisation assesses the performance of its risk controls and mitigations as part of its change management processes.

The organisation's change management processes define and report transitional risk.

The organisation's change management processes involve all relevant internal stakeholders.

The change management processes are tailored for the importance and the resources needed for the change.

Guidance for the Defined Level

The organisation does inform other organisations and, where feasible, stakeholders affected by the planned change. Furthermore, the organisation and these other organisations, in coordination, shall determine: (1) the dependencies with each other and, where feasible, with the affected stakeholders; and (2) the assumptions and risk mitigations that relate to more than one organisation or stakeholder.

Guidance for the Managed Level

The organisation’s change management processes consider the changes to functional systems, i.e. a combination of procedures, human resources and equipment, including hardware and software, organised to perform a function within the context of ATM/ANS and other ATM network functions.

The organisation should not start the implementation of any part of the change that has the potential to affect the safety of the services until a valid assessment for that part of the change exists and, if applicable, it has been authorised by the regulator.

Guidance for the Assured Level

A total system approach to the management of change is employed. The ATM system is considered as a whole rather than focusing on the human element.

There is a strong relationship between in-service monitoring and design. Change assessments employ a common set of operational hazards and they are monitored in service to confirm the effectiveness of the risk controls and mitigations. Besides, monitoring criteria tailored to the change implemented are part of the change management processes. These criteria are specific to each change and hence ensure that the change will remain acceptably safe for as long as it is in operation.

Transitional risks are risks linked to the transition from the current functional system to the changed functional system. These might be mitigated, e.g., by training depending on the nature of the change and the transitional risk associated to it.

Component 4: Safety Assurance

Study Area 15: Continual Improvement of the SMS

Question 15.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

An integrated planning process drives the continual improvement of the SMS.

An ad hoc or non-existent safety planning process is utilised by the organisation. Safety goals and objectives have not been identified or documented for the implementation of an SMS.

The organisation is preparing to develop a plan to show how it will improve the implementation and management of safety.

The organisation has established formal planning processes to drive improvement of its SMS.

The organisation regularly evaluates the effectiveness of these planning processes.

The organisation has a plan to improve the management of safety risks.

The organisation's plan to improve its SMS includes measurable safety management goals and targets.

Guidance for the Managed Level

The formal planning process to drive improvement of its SMS is aligned with other business planning processes. The organisation aligns its planning with the SSP and EPAS actions related to the improvement to its SMS, if any.

The results of the evaluation on the effectiveness of the planning processes are documented.

Guidance for the Assured Level

The improvement plan includes the key risks and high-level mitigations; trend analysis of safety data is used when identifying these key risks. 

Component 4: Safety Assurance

Study Area 15: Continual Improvement of the SMS

Question 15.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A structured approach to gather and share information on operational safety and SMS best practices from the industry.

There is no structured approach to gather best practices from the industry.  The organisation can identify and adopt industry best practices on an ad hoc basis. 

There are no plans to release and share best practices with industry stakeholders.

The organisation gathers information on operational safety and SMS.

The organisation gathers information on internal best practices to improve safety management.

The organisation has formal processes in place to identify best practices from throughout the industry that can be used to improve the SMS.

The organisation shares its best practices with industry stakeholders (e.g., ANSPs, airlines, regulators).

The organisation reviews, assesses, and adopts industry best practices.

The organisation has carried out an impact assessment to determine whether the best practices have been effective in improving safety.

Guidance for the Managed Level

A mechanism has been established on how to share best practices with industry stakeholders (not limited to aviation stakeholders), and it may include health care, nuclear, etc.

Guidance for the Assured Level

A best practice is one that proves to be more effective and efficient in producing positive results in terms of safety management. Best practices are determined through peer review by a number of organisations.

The organisation has established a formal process to review and assess industry best practices.

The impact assessment should be evidence based and adaptable to the organisation’s SMS. The results of the impact assessment are documented.

Component 5: Safety Promotion

Study Area 16: Training and Education

Question 16.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Staff, and contractors where appropriate, are educated and trained in safety and safety management, and where required, licensed.

Staff, and contractors where appropriate, are provided with training for safety and safety management activities on an ad hoc basis.

The organisation regularly provides staff and contractors with training and education in safety and safety management.

The organisation provides staff and contractors with training and education to help them apply required safety management practices and procedures.

The organisation has an annual planning process for safety management training.

The organisation's annual training plan ensures that appropriate staff are aware of all safety management practices and procedures that are applicable to their roles.

The organisation's annual training plan ensures that staff are aware of the organisation's approach to safety.

Those who receive training are given an opportunity to provide feedback on the effectiveness of the training.

The organisation's training programmes are updated on the basis of that feedback.

The organisation uses indicators to measure the effectiveness of its training programme.

The training is adapted to include identified risks and address shortcomings (highlighted through, for example, feedback from courses).

Guidance for all levels

This objective is primarily focused on ATC, engineering and senior staff who have the ability to affect the safety of the operational service.

Contractors should receive safety training when their activities have an impact on the provision of (provider’s) services.

The safety training should be appropriate to the safety responsibilities of the individual.

See requirement ATM/ANS.OR.B.005(a)(6) and ATS.OR.200(4)(i).

Component 5: Safety Promotion

Study Area 16: Training and Education

Question 16.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Staff are competent to conduct their obligations under the SMS.

There are no formal competency methods (including proficiency, licensing and training)

The organisation is developing competency methods.

Competency methods are designed and applied to ensure that staff, where appropriate, are educated, trained and competent to perform the specific duties required of them by the organisation's SMS.

Records of competence training are kept and maintained.

Additional training is delivered to address gaps in competence (e.g., for staff who change roles).

The means by which competency standards are determined is subject to review and improvement.

Guidance for all levels

This is applicable only to staff with SMS obligations.

Guidance for the Assured Level

An evaluation of the effectiveness of the SMS training is not necessarily linked to the competence in a licensed role (e.g. ATCO, ATSEPs).

Component 5: Safety Promotion

Study Area 17: Safety Communication

Question 17.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Staff are informed about the safety and safety management standards relevant to their positions.

Staff have limited knowledge of SMS processes and procedures.

Relevant staff are informed when safety actions or new safety management procedures are introduced.

The organisation issues internal staff communications that focus on safety and safety management.

Safety is a key focus of internal communications.

Staff are informed when procedures have changed.

The organisation tailors its safety communications to meet the recipients' needs.

The organisation regularly assesses the effectiveness of its communication, and addresses any deficiencies.

Guidance for the Assured Level

The organisation describes the process of how the assessment takes place and the corresponding reporting/correction process, including the date of the last review of the effectiveness of safety communication.

Component 5: Safety Promotion

Study Area 17: Safety Communication

Question 17.2

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Organisational-wide methods to record and disseminate lessons learned and time-critical safety information exist.

Safety lessons learned are known only to those who experience them.

The organisation intends to record and share lessons learned throughout the organisation.

The organisation has a formal process for systematically sharing operational safety lessons learned with appropriate staff.

The organisation disseminates safety-related information to all appropriate staff.

The organisation systematically shares all safety lessons learned throughout the organisation at all appropriate levels.

The organisation regularly reviews its lessons-learned dissemination process.

Staff are given the appropriate means to react to communications and alert the organisation of any perceived problems.  This is to be considered as outside of the regular occurrence reporting system.

Guidance for the Managed Level

Examples of safety-related information are:

·            supplementary instructions;

·            temporary operating instructions;

·            safety notices.

Guidance for the Assured Level

In order to establish a track record, at least two reviews of the lessons-learned dissemination process are required to meet the requirement of this question. Alternatively, there should be a continuous monitoring process in place. In addition, the process should be formal in nature to justify this level.

The regularity of the review should be agreed with the competent authority and be performed at least every 5 years. The results of the lessons-learned dissemination process should be used to drive improvement.

Component 5: Safety Promotion

Study Area 17: Safety Communication

Question 17.3

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Appropriate safety information and knowledge is shared with industry stakeholders.

Information disclosure complies with agreed publication and confidentiality policies / agreements.

Safety data and information are treated as confidential. There are no plans to disseminate it to any industry stakeholders.

The organisation shares safety data and information externally using informal processes.

When required by regulation, the organisation shares safety data and information nationally.

When required by regulation, the organisation shares safety data and information with international bodies.

The organisation encourages the proactive sharing of safety-related information with other parties (including industry stakeholders) to drive safety improvement.

The organisation actively shares safety data with international bodies to drive safety improvement.

The organisation has established a formal process to receive and act on safety data and information from external stakeholders.

Guidance for all levels

Information disclosure should be consistent with the requirements of Regulation (EU) No 376/2014.

Component 5: Safety Promotion

Study Area 17: Safety Communication

Question 17.4

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

A general public knowledgeable of the ANSP’s performance through routine publication of achieved safety levels and trends.

Safety-related performance information is not made available to the public under any circumstances.

The organisation makes safety-related performance information available to selected authorities.

The organisation makes high-level safety-related performance information available according to regulatory requirements.

The organisation makes safety performance information available to the general public beyond what is required by regulation.

Guidance for all levels

Information disclosure should be consistent with the requirements of Regulation (EU) No 376/2014.

Component 6: Interdependencies, Resilient system performance, buffers and trade-offs

Study Area 18 Managing the interdependencies of complex operational environments and competitive business models

Question 18.1

Level A

Level B

Level C

Level D

Informal

Arrangements

Defined

Managed

Assured

Mature ANSPs sustain safe provision of services through managing the organisation in a way that recognises that system safety is at risk from commercial and business models and targets. Such organisations embed safety in organisational processes

The ANSP assigns and distributes resources, both in terms of finances and personnel, to support safe provision of services through safety promotion, safety improvement, safety assurance and safety risk management.

Organisational business planning and strategy makes no formal allowance for safe provision of service.

Safety benefits are not systematically included in long-term investment decisions, although this may occur on an ad hoc basis.

Safety benefits are not systematically included in changes to the functional system (including airspace design changes) other than on an ad-hoc basis.

The emphasis in business planning is on cost-efficient service provision.

Organisational business planning and strategy formally takes account of all safety regulatory requirements.

The safety consequences of business strategies that emphasise efficiency at the expense of the ability to adapt or limit sources of resilience are not considered.

Safety is managed as an independent part of the wider organisation.

It is acknowledged that business decisions can influence safe provision of services.

The financial and personnel resources that are needed to support safe production* through safety promotion, safety improvement, safety assurance and safety risk management are reviewed annually.

Business plans are adjusted annually to ensure that these needs are met.

Resource allocation for safe provision of services is assimilated into corporate business planning for operational and selected non-operational departments.

Trade-offs and sacrifices in operational decision making involve managing resource shortfalls with reduced resources within the work system to draw upon to escalate and manage anomaly response.

Financial and personnel resources are provided to enable the release of staff for safety activities, such as training.

The organisation integrates safety fully into business planning making provision of safe production*, in a traceable way, accessible and subject to organisational governance.

Safety activities are resourced as a normal business activity.

Long term investment planning embeds provision of safety activities as a strategic corporate proposition.

The assessment of business models and/or business strategies on the dynamics and capability of the organisation to deliver a safe production* takes into account the buffers that are used in operational trade-offs and sacrifices attached to decision-making.

Operational trade-offs and sacrifices in decision making are modelled for effects and consequences.

The organisation identifies and manages eroded buffers and sources of resilience.