02

From Quality Management

Systems to Safety
Management Systems
an enhancement guide
Civil Aviation Authority of New Zealand
BOOKLET TWO
Preface
The Civil Aviation Authority published Advisory Circular AC 00-4
‘Safety Management Systems’ in December 2012 to provide
comprehensive guidance material to support organisations
implementing a safety management system (SMS).

This booklet contains practical advice to organisations about

how to improve current systems and add additional tools and
processes to improve safety outcomes. It explains the steps that
can be taken to successfully, systematically and proactively

caa industry resource kit – booklet TWO

manage safety while complying with regulatory requirements.

This booklet may be read in conjunction with the other

QMS to sms: An Enhancement Guide

CAA Industry Resource Kit booklets:
• Booklet ONE – Safety Management Systems (SMS):
an introduction
• Booklet THREE – Implementing Safety Management
Systems: guidelines for small aviation organisations
• Booklet FOUR – Aviation Risk Management; an introduction.

03
 caa industry resource kit – booklet TWO

4
QMS to sms: An Enhancement Guide
Table of Contents
Preface03 Element 4 Hazard Identification 15

Definitions06 Element 5 Risk Management 16

Overview 06 Element 6 Safety Investigation 17

Key Points Of Difference07 Element 7 Monitoring and Measuring Performance 19

Benefits Of Enhancing Your Qms To Become Element 8 Management of Change 20

A Safety Management System08
Element 9 Continual Improvement of the SMS 21

caa industry resource kit – booklet TWO

Qms To Sms: A ‘Formula’08
Element 10 Internal Audit Programme 22

QMS to sms: An Enhancement Guide

Sms: A Journey, Not a Destination 10
Element 11 Management Review 23
Element 1 Safety Policy and Accountability 11
Element 12 Safety Training and Education Programme 25
Element 2 Coordinated Emergency Response Planning 13
Element 13 Communication of Safety Critical Information 26
Element 3 Development, Control and Maintenance
of Safety Management Documentation 14 Conclusion 27

05
 DEFINITIONS

CAA AC 00-3 defines a OVERVIEW

caa industry resource kit – booklet TWO

Quality Management System (QMS) as:

Many New Zealand aviation organisations already
‘The structure, responsibilities, processes and procedures
have an established QMS in place. What is the
QMS to sms: An Enhancement Guide

of an organisation that promote and establish an

difference between an SMS and a QMS?
environment and culture of continuing improvement
that will enhance the safety of the operations’. QMS and SMS have a number of similar processes; both
systems depend on measuring and monitoring, both strive for
CAA AC 00-4 defines a continual improvement and both use a number of the same
Safety Management System (SMS) as: tools, such as audits.
‘A systematic approach to managing safety, including
In short, an SMS may be thought of as an enhanced and
the necessary organisational structures, accountabilities,
expanded QMS.
policies and procedures’.
06
Whereas a QMS focuses on internal quality assurance to identify, assess and control all types of risk that could affect
procedures, an SMS expands on this by advocating a risk-based the safety of the operation.
approach to the structure, responsibilities, processes and
procedures of an organisation. A QMS will not ensure that your SMS facilitates a more proactive approach to
organisation is identifying, and eliminating where possible, managing safety risks
all safety risks. QMS focuses on the delivery of efficient functional processes
Moving from a QMS to an SMS will bring increased effectiveness and is reactive in its approach, whereas an SMS aims to
to your organisation and the assurance of high safety minimise all safety risks using a number of proactive methods.
performance standards. The systems share some common QMS aims at maintaining a good safety record; however while
elements, so an organisation with an established QMS is an organisation can have a good safety record; there may be
already part of the way there. unidentified and untreated risks. In other words, just because
you haven’t had an accident does not mean you are a low risk
or a ‘safe’ organisation.
KEY POINTS SMS takes a holistic approach to safety for all aspects of

caa industry resource kit – booklet TWO

OF DIFFERENCE your organisation and any contracting organisations that
you work with.

QMS to sms: An Enhancement Guide

Unlike QMS, SMS is inherently risk-based
QMS is structured on ISO 9000 Quality Management and quality
assurance standards, which are based on identifying and
correcting instances of non-conformance or non-compliance,
as laid out in CAA AC 00-3 Internal Quality Assurance.

SMS is structured on ISO 31000-2009 Risk Management –

Principles and Guidelines and ICAO Doc 9859 Safety
Management Systems Manual, which encourage organisations
07
 BENEFITS OF ENHANCING QMS
YOUR QMS TO BECOME A SAFETY
MANAGEMENT SYSTEM +
Risk Management
Implementing an SMS will allow your organisation to take
a risk-based approach to managing the:
Emergency
• Identification of hazards that pose safety risks Response Plan
• Benefits of an effective reporting system
• Organisational, operational and physical changes to Hazard Identification
your organisation
• Accident and incident investigative processes Safety Investigation
• Emergency response preparedness.
caa industry resource kit – booklet TWO

The diagram on the right illustrates the road from QMS to SMS. SAFETY TRAINING
AND EDUCATION
QMS to sms: An Enhancement Guide

Change Management

safety performance

= SMS
08
QMS TO SMS: A ‘FORMULA’
QMS already has established elements of
an SMS which include:
• Safety policy
• A document control process
• Processes to monitor and measure
compliance-based performance
• A continual improvement process
• An internal compliance audit programme “Safety is a verb, and
• A management review process. an active one at that”
To implement your SMS you will need to – Alan J Stolzer

caa industry resource kit – booklet TWO

develop or enhance:

QMS to sms: An Enhancement Guide

• A risk management process
• An Emergency Response Plan
• A hazard identification process
• A safety investigation process
• A safety training and education programme
• A change management process
• Safety performance measures.

09
 SMS – A JOURNEY
NOT A DESTINATION
Establishing an SMS involves creating interconnected systems A gap analysis (discussed in further detail in Booklet Three)
throughout your organisation. Safety will ideally develop as an is an ideal tool to identify what practices and processes are
integral component of the culture of your staff (and third party already in place in your organisation, and compare them with
employees) and will influence everyone’s daily conduct. SMS is the 13 elements of an SMS that are required (see CAA AC 00-4
a way of doing business that places safety at the core of your Safety Management Systems). Any gaps identified will
organisation’s commercial practices. determine the actions required to meet the SMS objectives.
Your QMS processes and practices will continue to assist you
to supervise compliance and process competence. It will
complement the overall approach to safety that SMS establishes
relating to the organisation structures, accountabilities, policies
and procedures underpinned by risk management processes.
caa industry resource kit – booklet TWO

SMS will apply to all the staff in your organisation and

QMS to sms: An Enhancement Guide

importantly to the staff of all the organisations who provide

services to your business.

As you plan how to implement the SMS you will need to look
at the systems and processes your organisation already has
in place.

10
ELEMENT 1:
SAFETY POLICY AND ACCOUNTABILITY Establish top level support for SMS
Senior management must champion the SMS and resource
Commitment to the SMS has to start at the top of your organisation it appropriately.
to ensure that safety risks are systematically managed.
The Chief Executive (CE) is accountable for safety management
and this accountability cannot be delegated. The CE must make
an unequivocal statement of the organisations’ commitment to
+ safety. This statement should be given to all staff.

SMS ‘Senior Safety Appoint a ‘senior person’ for safety

Person’ Responsibility Meeting the SMS safety policy requirements will require
Appointment expansion of your existing quality/safety policy and the
+ + appointment of a senior person (eg, safety systems manager)
to implement and maintain the SMS. This new senior person

caa industry resource kit – booklet TWO

ELEMENT 1 could be what was previously the QA Manager, or a new selection.
SMS The safety systems manager cannot have conflicting

QMS to sms: An Enhancement Guide

Top level Goals and
Support Objectives responsibilities and must have direct access to the CE.

Integrate safety responsibilities

into your organisation
All safety positions should be documented in your organisational
+ QMS + chart with clear lines of authority and responsibility.

Set safety goals and objectives

Safety goals and objectives must be established.
11
 caa industry resource kit – booklet TWO

12
QMS to sms: An Enhancement Guide

Photo courtesy of ‘Above Ground Level’

ELEMENT 2:
COORDINATED EMERGENCY Prepare a plan
Be prepared for emergencies by developing, integrating and
RESPONSE PLANNING practicing your ERP. Your ERP should be simple and tailored
Emergency Response Plans (ERPs) enable your organisation to the size of your organisation. It should cover the basics
to deal with emergencies. outlined in the Advisory Circular such as defined
responsibilities and actions, a practice plan and a training
plan for staff. Third party contractors should be included.
+
Define roles and responsibilities
It is important that roles and responsibilities are clearly
Emergency Regular Testing
Response Plan defined so that all staff understand who has the authority
in an emergency and who is responsible for what.

+ + Communicate internally and externally

caa industry resource kit – booklet TWO

Once the ERP is documented, consider how you will
ELEMENT 2 communicate it. Train your staff and practice the plan.

QMS to sms: An Enhancement Guide

SMS Roles and
There may be external stakeholders (in addition to contractors)
Communication that you can consult during this process. For example, many
Responsibilities
airports have their own ERPs and it would be useful to
coordinate with your local airport.

+ QMS +

13
 ELEMENT 3:
DEVELOPMENT, CONTROL AND Document your processes and practices
Ensure all steps of the implementation and maintenance of the
MAINTENANCE OF SAFETY SMS are documented in your existing policies and procedures.
MANAGEMENT DOCUMENTATION These should be done in practical and actionable terms,
including newer elements such as:
Robust safety documentation is integral to the SMS.
• Hazard identification and risk management
• ERP
• Change management
• Any SMS specific references within existing documentation.
+ Appointed
Responsibility +
Establish control and accessibility
To manage SMS documentation it is vital to appoint one person
caa industry resource kit – booklet TWO

to control versions and updates.

Ensure safety documentation is easily accessible and staff

ELEMENT 3
QMS to sms: An Enhancement Guide

know where information can be located.

Access
SMS Document
Encourage your staff to take part in the development of the
documents that describe the safety activities they conduct.

+ QMS +

14
ELEMENT 4:
HAZARD IDENTIFICATION Establish a risk-focused reporting system
Establishing an effective reporting system will allow not only
A hazard is defined as ‘an object or condition with the potential hazards to be managed but also risks, incidents and accidents.
to cause injuries to personnel, damage to equipment or
structures, loss of material, or reduction of ability to perform Hazard identification training
a prescribed function’. Report, collect, record, analyse, treat and Ensure that your staff and those of third party organisations
communicate hazards identified in operational activities. are trained to identify hazards and are willing to report them
as well as all occurrences. This willingness is a cultural
+ component that requires vigorous encouragement.

Establish a non-punitive reporting policy

Goal and Risk-based This will provide positive results by protecting occurrence
Objectives Reporting
reporters from disciplinary action (except in cases of reports
outlining reckless, criminal or negligent actions). In turn, this

caa industry resource kit – booklet TWO

+ + allows for a positive reporting culture to develop.

QMS to sms: An Enhancement Guide

ELEMENT 4 Make reporting as easy as possible

Non-punitive
SMS Hazard ID
Simple forms and methods for reporting are very important.
Encourage your third party contractors to follow your lead.
Reporting Training
You will already be collecting quality-related information which
can be fed into your formal reporting system, as well as other
reliable sources of hazard information such as surveys, your
+ QMS + existing audit programme, discussion groups, ’brainstorming’
and safety meetings.

15
 ELEMENT 5:
RISK MANAGEMENT The identification of safety risks (and other risks to your
business) will enable you to proactively control the potential
The CAA defines risk as ‘the effect of uncertainty on outcome of these risks.
objectives’ and risk management as ‘ensuring that risk
remains at an acceptable level through consistent and Adopt Risk Standard philosophies
proactive framework’. ISO 31000:2009 outlines risk management principles that
provide guidance on how to develop a risk management process.

+ Implement risk activities and tools

Risk assessments need to be conducted as part of change-based
Measure Adopt Risk projects. Regular ways to assess risk in operational activities are
Outcomes Philosophies also required (consider ‘Operational Risk Profiles’).

A risk register is a fundamental tool for documenting all current

+ +
caa industry resource kit – booklet TWO

and emergent risks, and the treatments being applied.

ELEMENT 5 Document your risk management processes

QMS to sms: An Enhancement Guide

SMS Implement
A documented risk management process provides a structured
Document basis to risk management. Without a documented process,
Risk Tools
different people will use different methods resulting in
inconsistent results.

Measure positive outcomes

+ QMS + Risks properly managed and minimised will improve safety
performance and can lead to better profits and often positive
outcomes overall.
16
ELEMENT 6:
SAFETY INVESTIGATION Train your investigators
Investigations must be carried out by an independent qualified
Safety investigations provide invaluable details about the factors investigator in a fair and equitable manner to promote an
contributing to incidents or accidents. Analysis will provide atmosphere of trust and bolster your safety culture.
your organisation with valuable learning’s and outcomes.
Outline when (and why) to investigate
Interweave the risk assessment process into the safety
investigation process; it will help to have a set of risk- based
criteria (or trigger points). Carry out a risk assessment on
incident occurrence reports. For example, an incident rated by
+ Train Investigators + the matrix as moderate or high level may automatically trigger
an investigation and the requirement to escalate the matter to
management.

caa industry resource kit – booklet TWO

Establish and document a process
Establish ELEMENT 6 Conduct
The process should be underpinned by a non-punitive approach

QMS to sms: An Enhancement Guide

a Process SMS Investigations and in accordance with regulatory investigation requirements.
The aim of an investigation is to seek the causes and system
failures that may have contributed to the accident or incident in
order to improve operations.

+ QMS +

17
 caa industry resource kit – booklet TWO

18
QMS to sms: An Enhancement Guide
ELEMENT 7:
MONITORING AND Set risk-based safety performance
targets and indicators
MEASURING PERFORMANCE Set risk-based safety performance targets that define the
level of safety performance of your organisation. For example,
Monitoring all safety related systems and performance will
you may wish to reduce serious incidents within the next
allow your organisation to continuously improve upon them.
12 months by 10 per cent. You can determine if this has been
achieved by using safety performance indicators.
It is important to ensure that targets aren’t set that actually
damage your safety culture. For example, aiming for a reducing
Risk-based volume of reports could lead to a negative reporting culture
+ Performance Targets + where staff hide hazards or occurrences rather than report them.

Measure performance through safety data

The safety performance of an organisation can be measured

caa industry resource kit – booklet TWO

against its safety goals through:
ELEMENT 7 • Hazard and occurrence reports
Document Measure

QMS to sms: An Enhancement Guide

the Process SMS Performance • Reporting rates
• Information extracted from investigations
• Audit reports
• Risk registers
• Safety meeting minutes
+ QMS + • Surveys and reviews.

Establish a documented process

It is important that SMS monitoring and measurement occurs in
a consistent manner, hence the need to document your methods. 19
 ELEMENT 8:
MANAGEMENT OF CHANGE By developing and managing risk-management plans, and
tracking them until completion, your organisation will gain
Changes that affect your organisation can introduce many operational strength.
potential risks to the operation. Formal change management
Develop ‘change risk management’ processes
(or venture risk management) helps to identify, assess and
Typical changes in an aviation environment include:
control change-based risks.
• Organisational change (eg a new executive,
a company restructure)
+ • Operational change (eg, a new fleet, new contract,
new systems)
• Physical change (eg, a new base, moving office).

Develop Change Document Document your activities and outcomes

caa industry resource kit – booklet TWO

RM Processes Processes Document how your organisation recognises and manages

current and upcoming changes, taking into account the:
QMS to sms: An Enhancement Guide

ELEMENT 8
• Identified risks
SMS • Importance of systems and activities
• Stability of the operational environments
+ + • Past performance and historical information
• Residual risk.
QMS
20
ELEMENT 9:
CONTINUAL IMPROVEMENT OF THE SMS Use SMS performance information
Internal and external audit, and management review, will reveal
Continuous improvement is just as important to SMS as it is to QMS. how your SMS is performing and whether you are reaching your
The processes of management review, performance monitoring organisation’s safety objectives. Processes that will facilitate
and internal audits undertaken within your quality system are continual improvement include:
also relevant and integral to SMS. However, they will require
expansion to accommodate the new processes required by SMS. • Review of safety performance targets and indicators
• Safety culture surveys to staff
• Ensuring that all effective practices are documented,
and then communicated as the new standard expected.
SMS Performance
+ Information + Document successes and areas of weakness
Ensure that the process of continuous improvement is
documented also, for the purposes of maintaining

caa industry resource kit – booklet TWO

‘corporate memory’.

QMS to sms: An Enhancement Guide

Document
Successes and ELEMENT 9 Improvement Formulate improvement plan
Opportunities for SMS Plan If improvement of any part of the SMS is required, use an action
Improvement plan to formalise the task.

+ QMS +

21
 ELEMENT 10:
INTERNAL AUDIT PROGRAMME Develop performance-based safety audit practices
The Advisory Circular provides a standard against which the
Your QMS already contains an audit programme. As the SMS is SMS can be audited in order to measure effectiveness. Audit
implemented the approach needs to change. Safety auditing findings should still be disseminated to the personnel
examines not only compliance and conformance but also responsible for the activity so that preventive or corrective
system effectiveness. Safety audits must also encompass any actions can be taken and tracked.
third party contractors.
Develop a risk-based audit programme
SMS auditing needs to be integrated into your current audit
programme. The frequency and scope of audits can be
Performance-based determined by using a risk-based audit programme.
+ Safety Auditing +
Ensure safety auditors are trained
SMS audits must be conducted by auditors who are both
caa industry resource kit – booklet TWO

trained and independent of the personnel being audited. It may

make sense to engage a third party for this function.
QMS to sms: An Enhancement Guide

Train Safety ELEMENT 10 Risk-based Audit

Auditors SMS Programme

+ QMS +

22
ELEMENT 11:
MANAGEMENT REVIEW You may have a management review process, this will require
enhancement to encompass all of your safety systems.
This step is about the management review of the SMS,
rather than referring to routine management activities. For Schedule management review opportunities
management to make and resource safety-critical decisions, You may already hold monthly review meetings which have a
they must have up-to-date information on the current state set agenda. Expand any existing regular meetings by
of safety management processes. introducing a safety and risk-based approach. Ensure that
relevant decision makers are present and records are kept.

Escalate safety information

Consider how to provide management with information about
Schedule Review
+ Opportunities + how the SMS is faring. The monitor and review process will
assist in giving management a more complete view of safety
risks and processes.

caa industry resource kit – booklet TWO

Review frequently

QMS to sms: An Enhancement Guide

ELEMENT 11 A formal management review should be conducted at least
Review Escalate Safety
Frequently SMS Information
once a year.

Additionally, any significant event requiring rapid safety-critical

decisions should trigger a management review.

+ QMS +

23
 caa industry resource kit – booklet TWO

24
QMS to sms: An Enhancement Guide
ELEMENT 12:
SAFETY TRAINING AND Education will create awareness of the SMS objectives and
the importance of developing a positive safety culture. Third
EDUCATION PROGRAMME party contractors must be considered in SMS training and
education plans.
It is important that staff are provided with the knowledge and
skills to develop safety competency. Build safety competency through qualifications
New competencies will be required by staff in key safety
related areas such as:
• Risk management
Build Safety
+ Competency through
Qualifications + • Safety investigation
• Safety evaluations and auditing
• Safety performance review.

caa industry resource kit – booklet TWO

Conduct a training needs analysis
Plan Training ELEMENT 12 Conduct a Training
It could be useful to conduct a training needs analysis to

QMS to sms: An Enhancement Guide

Activities SMS Needs Analysis determine who needs to be trained and to which level. For
example, it is essential that your CE is trained in SMS and risk
management, whereas general operational staff will require a
different level of understanding.

+ QMS + Plan training activities

Competency is critical to enable the consistent application of
these new skills. Timeframes for this training need to be
established and recurrent training may be required.
25
 ELEMENT 13:
COMMUNICATION OF SAFETY Select effective communication methods
Your organisation needs to promote active communication
CRITICAL INFORMATION methods as well as passive ones. For example:
The proactive communication of safety-critical information is • Regular safety meetings
crucial to an effective SMS. The continuous and free flow of
• Safety updates, memos and emails
safety communications keeps senior management and staff up
to date with safety issues and information. • Safety newsletters or magazines
• Safety posters or noticeboards
• Safety outcomes of investigations.

Promotion
+ of Safety + Promote, promote, promote!
Find ways to communicate safety information to your
workforce. Encourage them to reciprocate by conveying safety
caa industry resource kit – booklet TWO

information in return.

Ensure creativity is used

QMS to sms: An Enhancement Guide

Select ELEMENT 13 Use all possible platforms (written, spoken and electronic) to
Communication
Methods SMS Be Creative
promote and communicate safety information. Provide external
information sources to staff. Lessons learned by others provide
valuable safety insights.

+ QMS +

26
CONCLUSION
Expanding your QMS into an SMS will be an economically sound
and logical endeavour. SMS is not a substitute for compliance,
however compliance is an integral component of an SMS. Once
you have implemented an SMS, the safety performance of your
organisation will be greatly enhanced.
“Safety is a dynamic
non-event, we have
to work very hard
so that nothing
will happen”

caa industry resource kit – booklet TWO

– Professor James Reason

QMS to sms: An Enhancement Guide

This booklet is based upon CAA Advisory Circular AC 00-4,
Safety Management Systems, Version 1.0, 19 December 2012.

For more information contact CAA staff at

Email: sms@caa.govt.nz
Web site:  www.caa.govt.nz 27
 caa industry resource kit – booklet TWO

28
QMS to sms: An Enhancement Guide

02