How Airlines Can Connect Occurrence Reporting, CAPA, SPI and Safety Risk Profiles

Occurrence reporting is foundational to a Safety Management System. ICAO Annex 19, EU Regulation 376/2014, EASA Part-ORO and FAA Part 5 all require it. Most airlines have it. None of them run a safety system on it alone.

An occurrence record captures discrete data: time, place, type, severity, reporter, classification. It answers what happened. It does not on its own answer four questions safety leaders need to act on weekly:

• Which barriers held and which failed?
• Is this event part of a pattern across the operation?
• What does the Safety Risk Profile look like this week?
• Are the corrective actions we have closed actually effective?

Each of these answers requires linking the occurrence to other artefacts. Without the linkage, the safety team is left with a queue. With the linkage, the team has a running safety system. The platform shape that ships the linkage as one model, rather than four databases connected by APIs, is the bar this article describes.

CAPA (Corrective and Preventive Action) is the action layer that closes the loop between detecting a safety issue and improving the system. The CAPA lifecycle runs assignment → execution → verification → effectiveness → closure. Verification is a second-person control, and the organisation's CAPA policy can make a completed effectiveness review a hard gate before an action closes.

Origin. A CAPA arises from an occurrence, often on a barrier its analyst rated short of effective; from an audit finding; from an SPI breach judged a true signal; or from an investigation, a compliance gap or a regulatory change. In a connected system, the origin is recorded as a link, not a free-text note.

Owner and verifier. A CAPA is owned by a named person, with the department kept as routing context, and verification is a second-person control: an assigned verifier must be someone other than the owner and is then the only person who may verify, and with none assigned, anyone but the owner may. The accountable manager's oversight role is the one exception.

Effectiveness review. The review that separates a CAPA from a checklist. The reviewer reads the evidence and whether the problem recurred, and records whether the action achieved its objective: effective, partially effective, ineffective or inconclusive. An effective result counts toward the health of the barrier the action was raised on. A partial or ineffective result owes a next step, a follow-up action or a written reason why none is needed, and an ineffective result on a high-risk occurrence reconvenes the Safety Action Group to re-plan.

Downstream propagation. When an effectiveness review completes, the indicators re-evaluate at once, the corrective-action effectiveness rate among them, and an effective result lifts the health of the barrier the action answers. The Safety Risk Profile reads the month's ratings, open actions and indicator states at its monthly roll-up, and the board safety pack is built from the same records, so nobody re-runs an export.

Safety Performance Indicators (SPIs) are the measurement layer that detects when the operation is moving outside the expected envelope. ICAO Doc 9859 Section 4 defines the discipline; an operator's SPI library applies it.

What an SPI looks like. Numeric. Time-bound. Tied to a hazard or top event. With an alert threshold (when investigation triggers) and a target (where the operation should be). “Unstable approaches per 1000 sectors” is an SPI. “Improve safety culture” is not.

Leading vs lagging. Most airlines run a mix. Lagging SPIs count realised events (occurrences, near-misses) and are easy to define. Leading SPIs count precursors (training expiries, audit findings, procedure deviations detected by FOQA) and are harder to define but more useful operationally. A balanced library has both.

Ownership. Every SPI needs a named owner. In eAviora an indicator cannot be activated without one, and each carries a periodic review due on its library review frequency. SPIs without owners drift, and an SPI that nobody owns is a metric, not an indicator.

How SPI connects upstream and downstream. Upstream: a classified occurrence counts toward the indicators of its risk family at the next daily evaluation, or at once when its residual risk is set above the tolerable level. Downstream: a breached period notifies the indicator's owner and gets a due date; the owner records whether it is a true signal, a data issue or an accepted variation, and a true signal is routed to a corrective action or a governance board review. Indicator states feed the Safety Risk Profile at its monthly roll-up. The SPI is the measurement layer between events and oversight.

The Safety Risk Profile (SRP) is the oversight layer the accountable manager reads. It is not a synonym for the risk register; it is the live operational picture rendered on top of all the other artefacts.

What the SRP holds. The whole operation, each risk theme and each risk family under watch, with a score fused from seven components: the assessed risk of the records in scope, the trend, the barrier ratings, the indicator states, the overdue corrective actions, the data confidence and the surveillance coverage, shown beside the worst ICAO risk level among those records. The SRP is computed, not a hand-curated document.

Cadence. Read by the accountable manager and the safety review board. eAviora rolls each month up on the second day of the next, an authorised user can recompute a period on demand, and an analyst reviews a snapshot before it is published as the official position. The drill-downs behind each score, the barrier health board and the open actions, read the current records.

What moves the SRP. Records in scope assessed at a higher risk. A barrier rated partially effective, ineffective or missing. An indicator in breach, and a worsening trend. Corrective actions running past their deadline. And a blind spot: a family with no active indicator and no classified occurrence in ninety days scores worse, not better.

Why this matters. The accountable manager exercises oversight through the SRP. An SRP nobody can trace back to its records is a story; one computed from the records, reviewed by an analyst and published as the official position is a system. The regulator audits the story; the operation runs on the system.