Aviation safety glossary

Part 135 of Title 14 of the US Code of Federal Regulations governs commuter and on-demand operations: charter, air taxi and air ambulance among them. The 2024 FAA final rule extended the Part 5 safety management system requirement to Part 135 certificate holders, which must have their SMS implemented and a declaration of compliance submitted by 28 May 2027.

Reference: 14 CFR Part 135; 14 CFR Part 5 (as revised in 2024).

The 5-Why technique (developed at Toyota) is a simple investigation method: ask "why did this happen?" and follow each answer with another "why" until the systemic cause is uncovered (typically 5 iterations, sometimes more). Useful for relatively contained incidents; complemented by HFACS or Reason Model for complex events.

The accountable manager (AM) is the single individual designated to the regulator as having overall responsibility for the operation's compliance with applicable requirements and the establishment and maintenance of the management system. Typically the CEO, COO, or postholder with corporate authority. The AM signs the safety policy and ERP activation.

Reference: EASA Part-ORO.GEN.210; FAA Part 5 5.21

ICAO Annex 19 requires that safety data collected for prevention be protected from inappropriate use, so reporters keep reporting. In practice that means tiering information by sensitivity (for example protected, restricted, and confidential) and gating access by clearance rather than leaving everything open. The protection has to hold not just in the interface but everywhere the data flows, including any automated processing.

Reference: ICAO Annex 19 (safety data protection)

An Approved Training Organisation is certified by a competent authority to deliver pilot, cabin crew, technician, or other aviation personnel training. EASA Part-ORA-ATO covers the requirements; FAA Part 141/142 covers the US equivalent. ATOs maintain training records, course materials, and instructor qualifications under document control + training modules.

ALARP is a risk-acceptance principle from UK Health and Safety Executive (HSE) that has crossed into aviation. A residual risk is ALARP when further reduction would require disproportionate effort, time, or cost. The "tolerable risk" region is bounded above by intolerable and below by broadly acceptable; ALARP applies in the middle band.

An audit is a planned examination of a process, area, or function against defined criteria (regulation, standard, manual, contract). Internal audits are run by the operator's compliance monitoring function; external audits are run by the regulator (oversight) or a third party (e.g. IOSA, IS-BAO). Findings flow into CAPA.

A barrier (preventive or recovery) is a control that interrupts the cause-to-consequence chain in bowtie analysis. Preventive barriers sit between threats and the top event; recovery barriers sit between the top event and consequences. Each barrier is rated for effectiveness, has an owner, and degrades over time without inspection.

Bowtie analysis displays a hazardous event ("top event") at the centre, with the threats that could cause it on the left, the consequences if it occurs on the right, and barriers (preventive and recovery) along the connecting paths. Each barrier is rated for effectiveness, owner, and degradation. Used heavily in oil + gas; increasingly mainstream in aviation safety.

Compliance Monitoring (formerly "quality system" in JAR-OPS) is the EASA-defined function that ensures the operator complies with applicable requirements and that the management system is effective. It owns the audit programme, finding management, and reporting to the accountable manager.

Most safety tooling stores each module (occurrences, hazards, audits, indicators) in its own silo, so a barrier on a bow-tie has no live relationship to the corrective action that should restore it, or to the indicator that should detect its decay. A connected operation is the opposite: one records model where occurrences, hazards, corrective actions, barriers and indicators are linked records that compute against each other. A degraded barrier can raise a corrective action; a finding can move a compliance posture; an indicator trend can surface a risk theme, without re-keying anything between tools.

A CAPA is the structured response to a finding from an audit, occurrence investigation, or hazard assessment. Each CAPA has an owner and a due date, and is verified by someone other than the owner. The lifecycle runs: assignment, execution, verification, effectiveness, closure.

E5X is the file format used to exchange occurrence reports with ECCAIRS, the European occurrence reporting platform. It is a compressed XML file whose content is coded against the ADREP taxonomy published by ICAO, so a report travels as structured attributes rather than free text. Organisations reporting under EU 376/2014 can transfer occurrences to their competent authority as E5X files.

Reference: EU Regulation 376/2014; ECCAIRS 2 documentation.

Part-145 (Annex II to Regulation (EU) No 1321/2014) sets the requirements for organisations approved to maintain aircraft and components. Since 2 December 2024 a Part-145 organisation must run a management system that includes hazard identification, safety risk management, internal occurrence reporting and compliance monitoring, in line with ICAO Annex 19.

Reference: Regulation (EU) No 1321/2014, Annex II (Part-145), as amended by Regulation (EU) 2021/1963.

EASA Part-ORO (Annex III to Commission Regulation (EU) 965/2012) sets organisation-level requirements for commercial air transport operators in the EU: management system, accountable manager, compliance monitoring, training, and crew records. Subpart GEN.MLR covers manuals; Subpart MAN covers management.

Effectiveness verification is the post-implementation check that confirms a corrective or preventive action achieved its intended risk reduction, not just that it was implemented. EASA Part-ORO and FAA Part 5 both require effectiveness verification before an action can close. It is the gate that distinguishes "we did something" from "the risk is actually lower".

An Emergency Response Plan (ERP) defines roles, communication trees, regulator notification protocols, and recovery procedures for aviation emergencies. ICAO Annex 19 requires every certified operator to maintain and exercise an ERP. The plan is activated by accountable manager (or designate) on declared emergency.

Reference: ICAO Annex 19, Appendix 2

Regulation (EU) No 376/2014 sets the rules for occurrence reporting across European civil aviation. It runs a mandatory and a voluntary reporting stream, asks a person to report within 72 hours of becoming aware of an occurrence, requires the organisation to analyse and follow up each report and transfer it to its competent authority, requires storage compatible with ECCAIRS and coded with ADREP, and protects reporters under Article 16.

Reference: Regulation (EU) No 376/2014, Articles 4, 5, 13 and 16.

EASA is the European Union agency that drafts implementing rules, certification specifications, and acceptable means of compliance (AMC) for civil aviation across EU member states. EASA Part-ORO (Air Operations Organisation Requirements) is the SMS+QMS+CMS regulation for commercial air transport operators.

14 CFR Part 5 mandates a Safety Management System for Part 121 air carriers and is being extended to additional certificate holders. It defines SMS components (safety policy, safety risk management, safety assurance, safety promotion) consistent with ICAO Annex 19. AC 120-92B is the implementation guidance.

The Federal Aviation Administration regulates all aspects of civil aviation in the United States. 14 CFR Part 5 mandates SMS for Part 121 air carriers and is being extended to additional certificate holders. The FAA publishes Advisory Circulars (ACs), notably AC 120-92 for SMS implementation guidance.

A finding is a recorded deviation from a regulatory requirement, internal procedure, or standard. Severity is enumerated (typically Level 1: significant non-compliance, Level 2: minor non-compliance, Observation: recommendation). Each finding has an owner, a due date, an evidence chain, and a closure workflow tied to a CAPA.

Flight Data Monitoring (FDM), also called Flight Operations Quality Assurance (FOQA) in the United States, downloads recorded flight parameters after each flight and analyses them against event thresholds (an unstable approach, a hard landing, an exceedance). It is run under an agreement that protects the crew: events are investigated through a trusted contact, not used for discipline. ICAO Annex 6 requires an FDM programme for larger aeroplanes.

Reference: ICAO Annex 6, Part I; EASA ORO.AOC.130.

A Flight Risk Assessment Tool (FRAT) asks the crew or dispatcher a fixed set of questions before a flight (weather, crew rest and experience, aircraft status, airport and route factors) and sums weighted answers into one score. Bands set what the score means: go, go with mitigation or approval, or no-go. A FRAT is a safety risk management tool for one flight; the trends across many FRATs feed safety assurance.

Reference: FAA AC 120-92B; FAA InFO 07015 (Flight Risk Assessment Tool).

A hazard is a condition, object, or activity with the potential to cause harm: injury, damage to equipment or property, loss of capability. Hazards are catalogued in a hazard register, scored for likelihood × severity on a risk matrix, and linked to barriers that mitigate them. Hazard identification is continuous in mature SMS.

The Hierarchy of Controls ranks risk mitigations by inherent effectiveness: elimination, substitution, engineering controls, administrative controls, and finally personal protective equipment or procedure. The principle is that a control higher in the hierarchy is more reliable than one that depends on a human doing the right thing every time. Recording the control tier of a corrective action exposes operations that lean too heavily on the weakest tiers.

HFACS (developed by Wiegmann and Shappell, US Navy/FAA) extends the Reason Model into four levels of failure: unsafe acts of operators, preconditions for unsafe acts, unsafe supervision, and organisational influences. It provides a structured taxonomy that investigators map contributing factors against, enabling cross-investigation pattern detection.

IOSA (IATA Operational Safety Audit) is an internationally recognised evaluation of an airline's operational management and control systems, mandatory for IATA membership. The standards an airline is audited against are published in the IOSA Standards Manual (ISM). An IOSA registration signals to code-share partners, lessors, and authorities that the operator meets a common safety baseline.

Reference: IATA IOSA Standards Manual (ISM)

Annex 13 sets out the international protocol for investigating aircraft accidents and serious incidents: who leads, how states participate, what gets reported, and how the sole objective stays prevention rather than apportioning blame. Its event-type definitions (accident, serious incident, incident) anchor how operators classify the most severe occurrences and stand up their emergency response.

Reference: ICAO Annex 13

Annex 14 (in two volumes, Aerodromes and Heliports) defines physical characteristics, obstacle limitation surfaces, visual aids, equipment, services, and operational procedures for aerodromes. Operators with apron-side activities cross-reference Annex 14 in their hazard registers.

Annex 17 establishes security objectives and requirements for civil aviation, including aerodrome security, in-flight security, cargo screening, and contingency planning. Amendments are issued periodically; operators must run a change-impact analysis on each amendment to identify which policies, procedures, and training records need updating.

Annex 19 (Safety Management), first published 2013, consolidates SMS requirements that were previously scattered across ICAO Annexes 1, 6, 8, 11, 13, and 14. It defines the four pillars of SMS, mandates a State Safety Programme (SSP) at the contracting-state level, and harmonises safety reporting expectations.

Reference: ICAO Doc 9859 (Safety Management Manual) is the companion guidance.

Annex 6 governs operations of aircraft, in three parts: international commercial air transport (Part I), international general aviation aeroplanes (Part II), and international operations helicopters (Part III). It feeds into operations manuals (OM-A/B/C/D), training, and many SMS hazards.

ICAO is the United Nations specialised agency that codifies the principles and techniques of international air navigation. ICAO publishes 19 Annexes to the Chicago Convention covering everything from personnel licensing (Annex 1) to safety management (Annex 19). ICAO standards are not directly binding, each contracting state implements them through its national civil aviation authority.

An ISARP is one IOSA Standard (mandatory) or Recommended Practice (advisory), the individual, numbered requirement an auditor assesses conformity against. The ISM is built from hundreds of ISARPs across organisation, flight, dispatch, maintenance, cabin, ground, cargo and security disciplines. Conformity to each ISARP is recorded with evidence and a verdict during an IOSA audit.

Reference: IATA IOSA Standards Manual (ISM)

Just Culture (per James Reason and Sidney Dekker) is the principle that frontline reporters should be treated fairly based on intent and behaviour, not on the consequences of their actions. Errors are reported and learned from; reckless behaviour is sanctioned. Just Culture is the social precondition for an effective voluntary reporting system, which is in turn the lifeblood of an SMS.

Reference: EASA Regulation (EU) 376/2014, Article 16 protects reporters in EU states.

Loss of Control In-flight (LOC-I) is the CAST/ICAO common taxonomy category for an aircraft that departs from controlled flight, whether through an upset, a stall, a spatial disorientation or a system failure. It is among the categories with the most fatalities in commercial aviation, which is why upset prevention and recovery training and the barriers around it receive particular attention.

Reference: CAST/ICAO Common Taxonomy Team, occurrence category LOC-I.

A Maintenance, Repair and Overhaul organisation is certified to perform maintenance, repair, and overhaul on aircraft and components. EASA Part-145 + Part-CAMO and FAA Part 145 + Part 43 govern MRO activities. MROs operate their own SMS + QMS + document control + training systems, often integrating with operator-side records.

Management of Change (MoC) is the safety risk management activity that looks at a planned change (a new route, aircraft type, supplier, procedure or reorganisation) before it happens: which hazards it introduces or alters, what the risk is, which controls are needed, and who accepts the residual risk. ICAO Annex 19 lists the management of change as an element of safety assurance.

Reference: ICAO Annex 19, Appendix 2, element 3.2.

The MEL is the operator-specific document derived from the Master MEL (issued by the aircraft type certificate holder) listing equipment that may be inoperative under defined conditions for a flight to be dispatched. MELs include time limits (Categories A/B/C/D), procedures, and limitations. MEL revisions are version-controlled and tracked in document control.

An occurrence is any safety-related event, accident, serious incident, incident, or any condition that has potential to affect safety. Occurrences are classified as Mandatory (regulator-required), Voluntary (encouraged), or Confidential (anonymised). EU Regulation 376/2014 mandates occurrence reporting and protects reporters.

The Operations Manual (OM) under EASA Part-ORO and ICAO Annex 6 is structured in four parts: OM-A General/Basic (organisation, policies, procedures), OM-B Aircraft Operating (aircraft-specific operating procedures), OM-C Route and Aerodrome (routes, airports, special procedures), OM-D Training (training and checking syllabi). Each part is version-controlled; revisions trigger crew read-and-sign distribution.

Reference: EASA Part-ORO.MLR.100; ICAO Annex 6 Part I

A Quality Management System (QMS) ensures aviation activities meet specified requirements through planning, execution, monitoring, and improvement. In aviation, QMS typically owns audit programmes, finding closure, evidence management, and effectiveness verification. EASA Part-ORO uses the term "compliance monitoring" for the same function, and FAA Part 5 covers it under safety assurance.

Reference: EASA Part-ORO · ISO 9001 (informative)

James Reason's Swiss Cheese Model represents organisational defences as slices of cheese, each with holes (latent failures + active failures). An accident occurs when holes momentarily align. The model underpins much of modern aviation safety thinking, including HFACS and the latent-vs-active failure distinction in investigation.

A risk matrix scores risks by crossing likelihood (frequent to improbable) with severity (catastrophic to negligible) into cells coloured by acceptability (red intolerable, yellow ALARP, green broadly acceptable). ICAO Doc 9859 illustrates the standard 5×5 matrix; operators tailor the cell labels and acceptance criteria to their operation.

Root Cause Analysis is the umbrella discipline of going beyond proximate causes to identify the systemic conditions that allowed an event to occur. Methods include 5-Why, fishbone (Ishikawa), Reason Model, HFACS, and fault-tree analysis. ICAO Annex 13 (Aircraft Accident Investigation) and ICAO Annex 19 both expect RCA in occurrence investigations.

A Safety Action Group (SAG) is the operational tier of the safety committee structure under ICAO Doc 9859: a cross-functional group, usually departmental, that reviews emerging hazards, occurrence trends, and the corrective actions in flight, then escalates what needs senior attention to the Safety Review Board. The SAG is where day-to-day safety issues get owners and dates rather than minutes.

Reference: ICAO Doc 9859 (Safety Management Manual)

A Safety Management System (SMS) is the systematic approach to managing safety, including the necessary organisational structures, accountabilities, policies and procedures. ICAO Annex 19 mandates an SMS for service providers (airlines, ATOs, MROs, ANSPs, aerodromes). The four pillars are safety policy, safety risk management, safety assurance, and safety promotion.

Reference: ICAO Annex 19

The Safety Manager (sometimes Head of Safety or Director of Safety) is the postholder responsible for the implementation and day-to-day functioning of the SMS. Reports functionally to the accountable manager. Owns the hazard register, the SPI dashboard, the safety review board, and the safety promotion programme.

A Safety Performance Indicator (SPI) is a quantifiable measure of an aspect of safety, for example "unstable approaches per 1000 sectors" or "go-around rate per 1000 landings". Each SPI has an alert threshold and a target. ICAO Annex 19 requires SMS to define and monitor SPIs; trend changes (often via Statistical Process Control) trigger investigation before they become incidents.

A Safety Performance Target (SPT) is the numeric goal an organisation sets for an SPI over a defined period. Targets must be realistic, time-bound, and reviewed at safety review board cadence. SPT progress reporting feeds into the State Safety Performance dialogue under ICAO's State Safety Programme.

A Safety Review Board (SRB) is the high-level, strategic safety committee chaired by the accountable manager. Under ICAO Doc 9859 it reviews overall safety performance, sets and revises safety performance targets, accepts or rejects significant residual risk, and directs resources. It sits above the Safety Action Group: the SAG runs the issues, the SRB owns the posture.

Reference: ICAO Doc 9859 (Safety Management Manual)

A Safety Risk Profile (SRP) rolls many signals into one current view of a risk theme, rather than relying on a single static risk-matrix cell. ICAO Doc 9859 frames safety risk as something to be monitored continuously across the operation. An SRP fuses base risk, recent trend, the health of the barriers that protect against it, open corrective-action exposure, active signals, and how well the area is surveilled, so the question shifts from "what did we score this once" to "how is this risk doing today".

Reference: ICAO Doc 9859 (Safety Management Manual)

A Security Management System (SeMS) is the security analogue of SMS, focused on intentional acts of unlawful interference. ICAO Annex 17 sets the international standards. SeMS covers threat assessment, asset exposure mapping, security occurrence reporting, and amendment tracking against Annex 17 changes.

Reference: ICAO Annex 17

Standard Operating Procedures define how a routine task is performed, who performs it, and under what conditions. SOPs are referenced from manuals (typically OM-B/C), trained against, and audited for adherence. SOP non-adherence is a common causal factor in safety occurrences and feeds back into training.

Statistical Process Control (SPC) uses control charts and decision rules, classically the Western Electric Rules, to distinguish genuine signal from random variation in a time series. Applied to safety performance indicators, it answers "has this metric actually shifted, or is this just month-to-month noise?" before an operator commits investigation effort. ICAO Doc 9859 points to control-chart techniques for SPI monitoring.

Reference: Western Electric Rules · ICAO Doc 9859

In aviation security (SeMS), a threat is an intentional act or capability with potential to cause harm: bombing, hijacking, sabotage, cyber intrusion. Distinct from "hazard" (which is unintentional). Threat assessment maps threats against assets (terminal, ramp, aircraft, perimeter, control room) to produce an exposure matrix.

The top event in bowtie analysis is the moment the hazard is no longer controlled, for example "loss of separation between aircraft" or "runway incursion". To the left are the threats that could cause it; to the right are the consequences if it propagates. The top event is the conceptual anchor of the diagram.