1 Background and Introduction

Research has shown that the environment and values of an airline can create a “culture” that can have a profound impact on safety and the risk of an accident. This briefing note defines the components of a company safety culture and discusses how to measure and improve it through a safety management system (SMS). It is important for all aviation stakeholders (e.g., flight crews, cabin crews, management, maintenance personnel) to understand the concept of safety culture and its importance for safe and efficient aviation operations.

Major airline accidents are a rare occurrence in part because of continuing safety efforts by the aviation industry. Less severe accidents and incidents, however, occur with greater frequency. These can result in significant economic loss and may be the precursors of future, more serious events. In addition to the actual safety performance of the industry, the traveling public’s perceived view of safety is an important factor in the success of air transportation. Thus, achieving safety is an important factor in the operation of not only a safe and efficient airline but also a successful one.

International Civil Aviation Organization (ICAO) requirements for the management of safety differentiate between safety programs and SMS as follows:

• A safety program is an integrated set of regulations and activities aimed at improving safety.
• An SMS is an organized approach to managing safety, including the necessary organizational structures, accountabilities, policies and procedures.

In other words, a safety program is a set of rules, while an SMS is an orderly process for controlling and minimizing risk. The rules and the process working together lead to the safest possible airline operations.

In order to keep safety risk at an acceptable level in an environment of increasing flight activity, safety management practices are shifting from purely reactive to a more proactive mode. In addition to legislation and regulations, other factors have emerged that are beneficial to the efficient management of safety within an airline organization. These include:

• Adoption of scientifically-based risk-management methods.
• Systematic monitoring of safety performance.
• Creation of a nonpunitive work environment to encourage hazard and error reporting.
• A commitment by senior management to pursue safety with a vigor equivalent to that focused on financial results.
• Adoption of safe practices and safety lessons learned.
• Use of checklists and briefings.
• Integration of human factors in the safety training for operational personnel.

When combined into an integrated approach, the elements cited above, together with other local, national and global initiatives, will continue to be successful in increasing the resistance of the aviation system to unsafe acts and conditions and thereby reducing the risk of accidents.

2 Company Safety Culture Defined

The ICAO Safety Management Manual says:

Safety is the state in which the risk of harm to persons or damage to property is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and risk management.

This definition is consistent with recent trends in aviation and other industries in which safety has become synonymous with the management of risk. As part of this management, acceptable levels of risk must be defined based on the actual operating environment, conditions and available resources.

Effective safety management requires more than just an organizational structure and a set of rules and procedures. It has roots in a strong and visible commitment to safety by top management. The priority given to safety is continually demonstrated by management attitudes, decisions and methods, as well as by a clearly stated safety policy and objectives. When management places safety ahead of financial gain, a clear message is sent to everyone in the organization, and a positive company safety culture is created.

There are no absolute measures of company safety culture, but there are some key indicators that are almost always associated with a positive safety culture. One is the adequacy of the allocation of budget and personnel to the safety function. Another is whether a safety position is considered a prize or a dead-end job. Still another positive indicator is when senior management not only reviews financial performance but also openly and objectively assesses the company’s safety performance.

A productive company safety culture encompasses both individuals and the organization, and thus must effectively address both attitudes and structure.

A successful safety culture needs clearly defined duties and well-understood procedures together with clear reporting lines. The characteristics of a good company safety culture include:

• Informed managers who know what is really going on.
• An empowered work force comprising individuals who are willing to report their own errors and near misses and do not fear sanctions.
• A “just” culture with a clear line between the acceptable and the unacceptable.
• Wary operators who are ready to deal with the unexpected.
• Flexibility to operate according to actual needs.
• Adaptability and the willingness to learn and implement necessary reforms.

A company’s safety culture is an intrinsic characteristic of the company itself. It is an inherent part of the operation of the organization and must be based on high levels of information sharing and trust between management and the work force. P. Hudson (2001) has developed a model of the evolution of the safety culture in an organization as a function of increasing levels of information and trust. The model, shown in Figure 1, has five stages that proceed from almost a total disregard for safety to a culture in which safety is the preeminent company value.

Figure 1: Evolution of Safety Culture, P. Hudson.

Presentation to the Airbus 15th Human Factors Symposium, Dubai, 2002.

3 Institutional Resilience

Professor James Reason (1993, 1997) defined the concept of institutional resilience. Simply stated, institutional resilience describes the qualities and characteristics of an organization that generate resistance to the hazards that it faces. The term resilience is also used in the context of high reliability organizations such as the nuclear power industry, where a resilient organization is one that is able to cope with unexpected events and dangers and to bounce back after untoward events.

Institutional resilience is the intrinsic capacity of an airline to continue safe operations in the face of unexpected threats or hazards, including the occurrence of human errors and violations.

Central to the concept of institutional resilience is a top management that is mindful of the dangers the organization faces as part of its operations. A mindful attitude by management suggests that a high level of vigilance permeates the entire organization. A mindful and vigilant organization acts to improve its system and the individuals in it, and thereby creates additional defenses against events.

4 Implementing an SMS

An SMS is the tool that allows an organization to monitor and improve its safety culture. ICAO recommends a sequential 10-step approach to implement an SMS to ensure that all necessary elements to build an efficient system are present.

4.1 Step 1: planning

Following a logical progression, the SMS process starts with careful planning. The creation of a planning group composed of the appropriate experience base within the company is an important part of planning. The formation of the group should include the designation of a safety manager, development of a realistic safety strategy and preparation of an implementation plan for the SMS.

4.2 Step 2: senior management’s commitment to safety

The ultimate responsibility for safety rests on the shoulders of senior management. The stage for a positive safety culture is set by the extent to which company leaders accept the importance of proactive risk management. Safety objectives must be practical, achievable, regularly reviewed and reassessed, and communicated to the staff with a clear endorsement by senior management. Safety plans and program documents should be signed and supported by the CEO. They should include a reasonable reporting chain for safety issues that goes through the safety manager and ends at the CEO, if necessary. Appropriate resources should be visibly allocated to support the safety manager and the operation of the safety program.

4.3 Step 3: organization

The resilience of a company is influenced by its way of conducting business and managing safety. In order to efficiently support the implementation of an SMS, the company safety manager should be appointed by and have direct access to the CEO. There should be a safety committee that is structured to support safety management, has a clear statement of responsibilities and accountabilities, and oversees training and competency.

4.4 Step 4: hazard identification

In a good safety culture, hazard identification is proactive rather than reactive and is nonpunitive. When humans operate in fear of punishment for normal mistakes, errors and unsafe actions will remain hidden, and opportunities for improvement and prevention will be lost. Proactive hazard identification processes such as the line operations safety audit (LOSA) provide a continuous commitment to safety. Management must provide these processes with adequate resources to systematically record and store, and competently analyze data on identified hazards.

4.5 Step 5: risk management

Following hazard identification, risk management serves to focus safety efforts on those hazards posing the greatest risks. This requires that all risks be critically assessed and ranked according to their accident potential. Both the likelihood of occurrence and the severity of consequences must be taken into account. If risks are deemed acceptable, the company’s operations may continue unchanged, at least for the present. However, even “acceptable” risks can be the focus of SMS efforts to reduce overall accident exposure. If risks are considered unacceptable, operations must be stopped or altered until steps can be taken to remove or avoid the identified hazards.

Risk management is a closed-loop process in which residual risks are assessed and cost-benefits analyzed after each risk-reduction step. This process is assisted by staff feedback on actions taken and the success of procedures put into place.

4.6 Step 6: safety investigation

Lessons learned about safety are more beneficial when they include a focus on root causes (“why”) rather than only on a description of the accident or incident (“what”). Identifying root causes requires trained investigators who look beyond the obvious causes at other possible contributing factors, including, but not limited to, organizational issues. Key operational staff must be properly trained to conduct safety investigations and have appropriate management support. Their output in terms of safety lessons learned should be disseminated throughout the organization. The regulatory authority must also be aware of causal findings so they can be transferred to other operators, as appropriate.

4.7 Step 7: safety analysis

In order to be accepted by all stakeholders, an SMS must encompass objective trend analyses, occurrence investigation, hazard identification, risk assessment, risk mitigation and monitoring of safety performance. Solid analytical capabilities provide compelling evidence to steer cultural change. Analytical tools and specialists support the risk-management process through the use of an up-to-date safety database. Safety recommendations should be proposed to senior management, and corrective measures must be taken and tracked to verify their effectiveness.

4.8 Step 8: safety promotion and training

Safety awareness within an organization is continuously improved by keeping staff informed of current safety issues. This can be accomplished using appropriate training, safety documents and participation in safety-related seminars. Training must be viewed as an investment in the future of the organization, rather than as an expense. All employees, regardless of their role and experience, can benefit from safety analysis feedback and lessons learned.

4.9 Step 9: safety information management

A large amount of data are generated when operating an SMS. When the information is not properly recorded, stored and used, it can be a waste of time and money. A safety management manual is the vehicle to document how the SMS relates to other functions within the organization and how SMS data should flow and be used within the company. Appropriate approaches for the dissemination of safety information, including necessary technical support and equipment, must be implemented while simultaneously assuring the protection of sensitive safety and personal-identification information.

4.10 Step 10: safety oversight and performance monitoring

The last step “closes the loop.” Feedback to continuously improve the system is based on the following:

• Safety oversight through inspections and audits to document for staff and management that the safety actions are properly performed.
• Safety performance monitoring to assess if the efforts of the SMS remain effective and are meeting the organization’s safety objectives. This requires the identification of accepted performance indicators.
• Dissemination of findings and implementation of corrective actions to improve the system.

5 SMS and Flight Operations

As part of mandated operational safety programs, airlines are required to implement an acceptable SMS to integrate diverse safety efforts — such as hazard and incident reporting, flight data analysis, LOSA and cabin safety — into a coherent system.

5.1 Hazard and incident reporting system

A nonpunitive incident reporting system is an effective and visible example of an organization’s commitment to a positive safety culture. Not only does such a system improve flight safety, it also improves flight operations efficiency. Reporting can proactively identify hazards, especially latent (or dormant) hazards lurking in poor equipment design, ambiguous procedures, inappropriate management decisions or poor communication within the company. If hazards are not identified and remedied, they eventually will lead to incidents or accidents. Sometimes, these incidents and accidents can be delayed by coping mechanisms and “work-arounds” developed by line personnel. Even though these improvised countermeasures may be highly effective, their likelihood of being applied correctly is not maximized until they are institutionalized as part of a company’s work procedures.

When properly collected and analyzed, information on hazards and incidents helps safety professionals identify and understand operational problems and propose true system solutions rather than quick fixes that can actually hide the real problem.

A true test of the quality of an incident reporting system is the trust the company’s employees place in it. When employees feel free to share safety-related information openly and candidly, an incident reporting system will be a successful SMS cornerstone.

5.2 Flight data analysis

Sometimes known as flight data monitoring (FDM) or flight operational quality assurance (FOQA), flight data analysis complements an incident reporting system. It is required as of Jan. 1, 2005, for operators of airplanes with a certified takeoff weight in excess of 27 tons (54,000 lb).

ICAO (2005) defines flight data analysis as:

A proactive and nonpunitive program for gathering and analyzing data recorded during routine flights to improve flight crew performance, operating procedures, flight training, air traffic control procedures, air navigation services, or aircraft maintenance and design.

In order to have a successful flight data analysis program, an agreement should be reached between flight crews and management on the processes to be followed and, especially, on the nonpunitive use of the data.

Through the monitoring of flight profiles, exceeded flight parameters, nonstandard procedures and anomalies in aircraft performance, flight data analyses can highlight problem areas and look for recurring problems across the fleet. It is then possible to identify remedial changes in procedures and training.

5.3 LOSA

Line Operations Safety Audit (LOSA) supplements flight data analysis to monitor flight operations for safety purposes. While flight data analysis provides data on instances in which aircraft performance parameters are exceeded, LOSA focuses on human and system performance information. LOSA analyzes an airline’s resistance to operational risks and human errors, and can be used to minimize those risks and to propose actions to manage errors in day-to-day operations. LOSA observers must be specially trained and highly experienced professionals.

Benefits from LOSA include:

• Redefining operational philosophies and guidelines.
• Updating existing procedures and checklists and creating more appropriate ones.
• Implementing threat and error management training.
• Defining criteria for stabilized approaches.

6 Practical Considerations for Operating an SMS

The following paragraphs provide suggestions drawn from real life to help build and maintain a company safety culture, and to operate an efficient SMS (refer to the ICAO Safety Management Manual for more detail).

6.1 The safety office

Functions of the safety office include:

• Advising management on safety-related issues (e.g., safety policy definition, SMS establishment and operation, resource allocation).
• Assisting line managers in identifying risks and appropriate risk mitigation.
• Overseeing a hazard identification system (e.g., incident reporting, data analysis).
• Managing safety databases and conducting safety analyses.
• Providing training on safety management.
• Promoting safety by disseminating lessons learned both in-house and to external entities.
• Monitoring safety performance by conducting surveys.
• Participating in accident and incident investigation.

6.2 Training safety management

A key to the long-term success of an SMS is to ensure that all personnel understand the company’s safety philosophy, policies and procedures, as well as their own roles and responsibilities within the overall safety effort. This should include such components as:

• Initial safety management training designed to create awareness of the importance of developing a safety culture and of the objectives of the SMS. All staff should receive an introductory course covering, but not limited to, the basic principles of safety management.
• Training for senior staff and management that focuses on understanding and actively supporting the SMS. Training should ensure that everyone knows their responsibilities, accountabilities and even their potential legal liabilities.
• Training of safety specialists (safety manager and staff) involved in the day-to-day operation of the SMS. These specialists need to be proficient in techniques and methods such as monitoring safety performance and performing safety analyses and audits, as well as being familiar with most aspects of the company.
• Training for operational personnel on the hazards they face, on use of the incident and accident reporting system, and on programs used for monitoring safety (e.g., flight data analysis, LOSA).

7 Key Points

Safety is the state in which the risk of harm to persons or damage to property is reduced to, and maintained at or below, an acceptable level through a continuing process of hazard identification and risk management.

Effective safety management needs more than just an organizational structure and a set of rules and procedures. It starts with a strong commitment to safety from top management.

Characteristics of a good safety culture include:

• Informed managers who know what is really going on.
• An empowered work force whose members are willing to report their own errors and near misses and do not fear sanctions.
• A “just” culture with a clear line between the acceptable and the unacceptable.
• Wary operators who are ready to deal with the unexpected.
• Flexibility to operate according to actual needs.
• Adaptability and the willingness to learn and implement necessary reforms.

Institutional resilience is an organization’s intrinsic capacity to continue safe operations in the face of unexpected threats or hazards, including the occurrence of human errors and violations.

If hazards are not identified, incidents or accidents are bound to occur. “Work-arounds” developed by line personnel are no replacement for a properly designed and institutionalized procedures.

A company atmosphere encouraging employees to feel free to openly share safety-related information will foster the success of an incident reporting system.

Flight data analysis of routine data recorded during line flights and line operations safety audits of human/system performance are excellent risk management tools that should be part of every SMS.

All personnel have to understand their company’s safety philosophy, policies and procedures, as well as their own roles and responsibilities within the overall safety effort.

8 Associated OGHFA Material

Briefing Notes:

• Discipline
• Decision-Making
• Threat Management Training
• Organizational Threat Management
• Error Management

Visuals and Checklists:

• Checklist for Assessing Institutional Resilience Against Accidents
• Decide - Checklist

Situational Examples:

• De-icing and Latent Organisational Factors
• Food Poisoning

9 Additional Reading Material

• Flight Safety Foundation Approach-and-landing Accident Reduction (ALAR) Tool Kit.
• Helmreich, R.L. (1999). “Building Safety on the Three Cultures of Aviation.” In Proceeding of the IATA Human Factors Seminar (pp. 39-43). Bangkok, Thailand.
• Hudson, P.T.W. (2001). “Safety Management and Safety Culture: The Long, Hard and Winding Road.” In W. Pearse, C. Gallagher and L. Bluff (Eds.) Occupational Health and Safety Management Systems, pp. 3-32. Crown Content; Melbourne, Australia.
• Hudson, P.T.W. “Aviation Safety Culture: From Flight Operations to Maintenance.” Presentation to the Airbus 15th Human Factors Symposium, Dubai.
• ICAO (2005). ICAO Accident Prevention Programme. Doc 9422.
• ICAO (2006). Safety Management Manual (SMM). Doc 9859 AN/460, First Edition.
• Reason, J. Managing the Risks of Organizational Accidents. Ashgate; Aldershot, London, 1997.
• Reason, J. (1993). “Organization, Corporate Culture and Risk.” IATA: Montreal, Canada.
• Von Thaden, T.L.; Wiegmann, D.A.; Mitchell, A.A.; Sharma, G.; Zhang, H. (2003). “Safety Culture in a Regional Airline: Results From a Commercial Aviation Safety Survey.” In Proceedings of the 12th International Symposium on Aviation Psychology, Dayton, Ohio, USA.
• Wood, M.; Dannatt, R.; Marshall, V. (2006). “Assessing Institutional Resilience: A Useful Guide for Airline Safety Managers?” Australian Transport Safety Bureau Research and Analysis Report, Aviation Safety Research Grant B2004/0240. Canberra City, Australia.