Aero Sync
For SMS aviation small operator compliance, the clock is now running. A Safety Management System (SMS) is the organised way an operator finds hazards, judges the risk, puts controls in place and checks that those controls work. Airlines have had one for years. In the United States, the FAA's expanded Part 5 rule now requires Part 135 charter operators and § 91.147 air tour operators to have an SMS and declare compliance by 28 May 2027. Elsewhere, operators under EASA and other ICAO-based rules have had management-system requirements for years.
This guide is for the small operator: one to ten aircraft, a handful of pilots and nobody whose full-time job is safety. It explains what an SMS must contain, how to scale it without building a bureaucracy, how to design a risk matrix that people actually use, what safety assurance looks like in a small operation, and the mistakes inspectors see most often. The risk matrix builder lets you assess real hazards and watch mitigations move them across the matrix.
Scope: this article explains concepts and common practice. It is not legal advice. Your regulator, your operations specifications and the current rule text decide what applies to you.
What is an SMS in aviation?
Traditional safety relied on compliance: follow the regulations and the manuals and you are safe. An SMS adds a layer on top. It assumes that rules cannot foresee every hazard in your specific operation, your airports, aircraft, people and customers, so it gives you a repeatable process to find and manage those hazards before they cause an accident.
The international framework is ICAO's safety risk management methodology, set out in Annex 19 and the Safety Management Manual (Doc 9859). The US version is 14 CFR Part 5, with practical guidance in Advisory Circular 120-92D. In Europe, operators meet the management system requirement in ORO.GEN.200 of the EASA Air Operations rules. All of them share the same four components.
The four components, explained for small operators
1. Safety policy
A short signed document from the top: your commitment to safety, safety objectives, a commitment to provide resources, a reporting policy and the conditions under which disciplinary action would apply. Part 5 also requires you to designate an accountable executive (AE), the person with final authority over operations and resources, usually the owner or chief executive, and to define who is responsible for what. Operators that need an emergency response plan (ERP) must also coordinate it with the organisations they interface with.
2. Safety risk management (SRM)
The design process. You describe your system (what you fly, where, with whom and how), identify hazards in it, assess the risk of each one and decide on controls. You must do this whenever something significant changes: a new aircraft type, base, route, contractor or procedure. This is often called management of change (MoC).
3. Safety assurance (SA)
The checking process. You collect safety data (reports, flight data, audits, investigations), monitor safety performance indicators (SPIs), check that controls work and fix what doesn't. Part 5 requires a confidential employee reporting system in which people can report without concern of reprisal, and since the 2024 update it also requires you to investigate hazards reported by external sources.
4. Safety promotion
Training so people can do their safety jobs, and communication so everyone knows about hazards, the actions taken and why. In a small operator this can be a short monthly safety briefing and a shared hazard log.
SMS aviation small operator rules: what changed in Part 5?
The FAA published the expanded rule on 26 April 2024. The key points for small operators:
- Who: Part 135 certificate holders and § 91.147 air tour operators join Part 121 airlines, along with certain manufacturers.
- When: develop and implement an SMS and submit a declaration of compliance by 28 May 2027. Business aviation media such as GlobalAir report that inspectors are already checking progress.
- Declaration, not approval: operators submit a declaration of compliance under § 5.9 rather than wait for FAA acceptance. Inspectors then oversee it in surveillance.
- Single-pilot relief: § 5.9(e) lists some requirements that do not apply to single-pilot, sole-individual operators, but the core of SRM and SA still applies.
- Hazard notification: under § 5.57, if you identify a hazard that another organisation could address, such as an airport, a fuel supplier or a maintenance provider, you must tell them. The FAA's summary of significant Part 5 changes lists these updates.
- Records: keep SRM outputs for as long as the control is relevant, safety assurance outputs for five years, and training and communication records for 24 months. Records of hazard notifications under § 5.57 must also be kept for at least 24 months.
The NBAA's practical guide to Part 5 for small operators stresses that the framework works even for a single-pilot operation with one aircraft.
How to scale an SMS to a small operation
The biggest risk in a small operator is not that the SMS is too simple. It is that it becomes a binder nobody opens. Scale it to your size:
- Documentation: a 15 to 30 page SMS manual is normal for a small operator. Write it for your pilots, not for the inspector.
- Hazard register: one spreadsheet or database with each hazard, its risk before and after controls, the owner and the review date. The builder below exports a starter register.
- Reporting: a simple form or app, available on the phone, with the option to report confidentially. Thank every reporter and tell them what was done.
- Meetings: a monthly safety review of 30 to 60 minutes with the AE present at least quarterly.
- Independence: when the safety manager is also the chief pilot, they end up checking their own decisions. Use a peer review from another operator or an external audit at least once a year.
Many business aviation operators also align with IS-BAO, the International Standard for Business Aircraft Operations, which is built around an SMS and gives a staged path from basic to mature.
How the risk matrix works
The risk matrix turns judgement into a consistent decision. SKYbrary's overview of aviation risk assessment describes the same idea: rate each hazard, then compare it with agreed tolerability regions. Each hazard is rated on two scales:
- Likelihood: how often the outcome could happen. ICAO's example uses five levels: frequent (5), occasional (4), remote (3), improbable (2) and extremely improbable (1).
- Severity: how bad the worst credible outcome would be. ICAO's example uses catastrophic (A), hazardous (B), major (C), minor (D) and negligible (E).
The combination gives a risk index such as 4B. Each cell of the matrix sits in one of three regions:
| Region | Example cells | What it means |
|---|---|---|
| Intolerable | 5A, 5B, 5C, 4A, 4B, 3A | Stop or do not start the operation until the risk is reduced. |
| Tolerable | 5D, 4C, 3B, 2A, 1A and others | Acceptable only with controls that reduce risk as low as reasonably practicable (ALARP), and accepted at the right level. |
| Acceptable | 3E, 2D, 2E, 1B to 1E | Acceptable as is; keep monitoring. |
Two technical points that professionals often miss:
- Assess the worst credible outcome, not the worst possible one. Almost any hazard could theoretically end in a fatal accident. Assess the outcome that is realistic given your existing defences, otherwise everything lands in column A and the matrix stops helping you prioritise.
- Most controls reduce likelihood, not severity. Training and a stabilised-approach policy make an approach accident less likely, but if it happens it is still catastrophic. That is why the Lugano example in the builder moves down the A column but never leaves it. Severity changes only with controls that contain the outcome, such as a fire containment bag for lithium batteries.
A risk matrix is not a calculator. It is a shared language that forces the same question every time: how likely, how bad, and who accepts it?
Risk matrix builder for SMS aviation small operators
The builder loads six example hazards from a small business-jet operation. Click a hazard to see its initial and residual risk, tick or untick mitigations to see the residual move, or add your own. Switch between the ICAO 5×5, a scored 5×5, 4×4 and 3×3 matrix, and use paint mode to define your own tolerability regions. When you are done, copy the register as CSV and paste it into a spreadsheet.
Try this: select the fatigue hazard and untick "two-pilot crew after 22:00". The residual risk moves from 2B back to 3B. Then switch to the 3×3 matrix and notice how much detail is lost: a small matrix is easier to use but groups very different risks together.
Safety risk management in practice
A working SRM process in a small operator looks like this:
- Describe the system. Fleet, bases, typical airports, crew pairing, contractors, customers. Hazards hide in the interfaces.
- Identify hazards. From reports, audits, flight data, near misses, manufacturer bulletins, industry accidents and every planned change. A new destination such as Calvi (LFKC), with terrain and a one-way approach, is a classic trigger.
- Assess the risk with the matrix, using people who do the work, not the safety manager alone.
- Design controls in a hierarchy: eliminate the hazard, then engineer it out, then procedures and training, and finally personal vigilance. Controls higher up are stronger.
- Accept the residual risk at the level your SMS defines, and record who accepted it and why.
For day-to-day flights, many small operators use a flight risk assessment tool (FRAT): a short scored checklist completed before each flight that flags combinations such as night, single pilot, unfamiliar airport and poor weather. The FRAT applies the SRM controls at flight level.
Safety assurance: proving it works
Safety assurance is where many small operators are weakest, because it needs data. Practical sources include:
- Safety reports and their trends. Few reports usually means low trust, not high safety.
- Safety performance indicators (SPIs) such as unstable approaches per 100 sectors, go-arounds, FRAT scores above threshold, duty extensions and maintenance deferrals.
- Flight data monitoring where the aircraft can record it.
- Internal audits of the SMS itself and of key controls.
- Investigations of events, focused on causes and system fixes rather than blame.
Set safety performance targets (SPTs) for a few SPIs, review them in the monthly meeting and act when a trend moves the wrong way. That is continuous improvement in practice.
Just culture: people report only when they trust that honest mistakes won't be punished. Define in your safety policy which behaviour is unacceptable (recklessness, wilful violations) and protect everything else. Without reporting, there is no safety assurance.
Common SMS mistakes in small operators
- Buying a manual and filing it. Inspectors ask pilots how the SMS works; a manual nobody has read fails quickly.
- Only rating risk once. Hazards and controls change. Review the register at least annually and after every significant change.
- Everything in column A. Assessing worst possible rather than worst credible outcomes makes the matrix useless.
- Controls without owners. Every control needs a person responsible and a way to check it is working.
- No feedback to reporters. Reporting stops when nothing visibly happens.
- Ignoring interfaces. Fuel suppliers, handlers, maintenance providers and airports are part of your system; § 5.57 now requires you to tell them about hazards they can address.
Deadline planning: a working SMS needs months of operating history: reports, a populated hazard register, SPIs and meeting records. Starting a few weeks before the deadline leaves you with documents but no evidence that the system works.
Key takeaways
- An SMS has four components: safety policy, safety risk management, safety assurance and safety promotion.
- US Part 135 and § 91.147 operators must declare Part 5 compliance by 28 May 2027.
- For an SMS aviation small operator setup, scale the documents and meetings, not the thinking: two people can cover every role.
- Assess the worst credible outcome; most controls reduce likelihood, few reduce severity.
- Safety assurance needs data: reports, SPIs, audits and a just culture that encourages reporting.
Use your flight data for safety assurance
Safety assurance depends on knowing what your fleet is actually doing. Aero Sync Flight Operations brings schedules, crew, maintenance due dates and AOG periods into one view and warns when a trip exceeds a limit, giving your safety reviews a reliable picture of daily operations.
Frequently asked questions
What is an SMS in aviation?
A Safety Management System is a formal, organisation-wide approach to managing safety, made up of safety policy, safety risk management, safety assurance and safety promotion.
Do small Part 135 operators need an SMS?
Yes. Under the expanded 14 CFR Part 5, Part 135 operators must implement an SMS and submit a declaration of compliance by 28 May 2027. Some requirements do not apply to single-pilot, sole-individual operators.
What is a declaration of compliance?
A statement submitted to the FAA under § 5.9 that the operator's SMS meets Part 5. The FAA then oversees the SMS through normal surveillance.
Who is the accountable executive?
The person with final authority over operations and resources, usually the owner or chief executive. They are responsible for the SMS and for accepting the highest levels of risk.
What is a risk matrix?
A grid that combines likelihood and severity to rate a risk and decide whether it is acceptable, tolerable with controls or intolerable.
What does 4B mean on a risk matrix?
In the ICAO example, likelihood 4 (occasional) and severity B (hazardous). It falls in the intolerable region, so the operation should not continue until the risk is reduced.
What is ALARP?
As low as reasonably practicable: reducing risk until the cost or effort of further reduction is grossly disproportionate to the benefit.
What is the difference between SRM and safety assurance?
Safety risk management designs controls for identified hazards. Safety assurance checks with data that those controls work and finds new hazards.
What is a FRAT?
A flight risk assessment tool: a short scored checklist completed before each flight to flag risky combinations of factors and trigger extra controls or approval.
What are safety performance indicators?
Measurable data points, such as unstable approaches per 100 sectors or safety reports per month, used to monitor whether safety performance is improving.
How long must SMS records be kept under Part 5?
SRM outputs for as long as the control remains relevant, safety assurance outputs for five years, and training and communication records for 24 months.
Is IS-BAO the same as an SMS?
No. IS-BAO is an industry code of practice for business aviation that includes an SMS at its core, plus other operational standards. It can help structure a compliant SMS.
What is a just culture?
A culture in which people are not punished for honest mistakes, while reckless behaviour and wilful violations are not tolerated. It is essential for safety reporting.
How long does it take to implement an SMS?
For a small operator, typically several months to build the documents and train staff, plus enough operating time to show reports, risk assessments and reviews in action.