Run the Part 5 gap analysis
in three weeks, not three months.

See the highlighted block above the contents list. The rest of this article gives you the week-by-week plan, a scoring method that does not lie to you, a way to sequence the closure work by risk instead of by manual order, and the reason a pre-built risk model is what keeps the whole thing to weeks rather than months.

The 2024 SMS final rule extended Part 5 well beyond the Part 121 airlines. All Part 135 certificate holders, 91.147 commercial air tour operators, and certain Part 21 certificate holders now have to build and run a safety management system. For Part 135 and 91.147 operators, implementation plans were due 2024-11-28, and the SMS must be fully implemented with a declaration of compliance submitted no later than 2027-05-28, regardless of size, down to single-pilot certificate holders. If you have not started, the Part 5 final rule and the Part 135 deadline are the two things to read next.

A gap analysis is the diagnostic you run before committing money and effort to building. It answers one question precisely: measured against what Part 5 requires, what do we already have, what exists only on paper, and what is missing. Skipping it feels faster and is not. Teams that jump straight to writing a manual tend to re-document things that already work, miss the requirements they never had, and arrive at the deadline with a thick binder and no evidence the system runs.

Scope it to the four components and no wider. Part 5 is scalable by design: the same four components apply to a single-aircraft operator and a regional carrier, at very different depth. The analysis is not an audit and not a project plan, it is a current-state map with a prioritised gap list attached. Keep that boundary and it stays a two-to-three week exercise.

The work divides cleanly into three phases. Give each roughly a week, and assign a single owner who keeps the map moving.

Week one, inventory. Catalogue what already exists, without judging it yet:

• Every existing procedure, policy, and manual section that touches safety.
• Every form, log, and register: hazard reports, occurrence records, audit findings, training records.
• Every reporting channel people actually use, formal or informal.
• The roles and accountabilities already in place, named.

Week two, map and score. Assign each inventoried item to one of the four components and the specific requirement it satisfies, then score its real state. This is the week that needs conversations, not just reading. The manual says a hazard-reporting process exists, the flight crews tell you whether anyone has ever filed one. Score against what the evidence shows, not what the document claims.

Week three, sequence. Turn the scored list into a closure plan. Separate the quick wins (a practice you already run that just needs writing up) from the genuine builds (a requirement with nothing behind it), attach an owner and a target date to each, and order the whole plan by risk. The deliverable at the end of week three is a single prioritised backlog that the accountable executive and the safety team both trust, not a polished report nobody acts on.

A single status label hides more than it shows. Use two axes instead: is the requirement documented, and is it implemented. That gives four honest cells, and each one calls for a different kind of work.

• Documented and implemented. Functioning, the target state. The practice runs and leaves records. Here the only remaining task is to keep the evidence tidy for export.
• Documented, not implemented. The dangerous cell. It looks finished because the procedure reads well, but it produces no records: a hazard-reporting process with zero reports, a risk method with no completed assessments. Put it into real use.
• Implemented, not documented. The recoverable cell. People already do the right thing, nothing is written down. This is often a quick win: capture the practice and its records.
• Neither. A genuine build. The requirement has no procedure and no practice behind it, and it needs both.

The reason to insist on evidence at this step is that the whole point of the exercise is to protect the eventual declaration. When the accountable executive attests that the SMS is functioning, that attestation is only as good as the scoring underneath it. A gap analysis that grades on optimism produces a confident declaration and a system that cannot show its work when asked. Grade on the populated log, the completed assessment, the training completion, and the declaration rests on something real.

The instinct is to close gaps in the order the requirements appear in the manual. Resist it. The manual's order reflects how the rule is written, not where your operation is exposed. Order the closure plan by two things: the risk the gap leaves open, and the effort to close it.

Risk comes first. A missing or unused hazard-reporting channel outranks a formatting inconsistency in the manual every time, because the reporting channel is how the operation sees the hazards it does not yet know about. Weight the gaps by what they expose, and a sensible order falls out on its own: the safety-critical builds lead, the cosmetic fixes trail.

Effort comes second, and it interacts with the calendar. Some gaps close in an afternoon, writing up a practice you already run. Others take months to close honestly, because they need records that only accumulate with time: a reporting culture that people actually use, a set of risk assessments built from real operations, a management of change process that has been through real changes. Those long-lead items have to start early even when they are not the loudest gap, or the declaration deadline arrives before the evidence does. Sequence so that the slow-to-generate evidence begins first, and the quick wins fill in around it. The endpoint of this whole process is the declaration of compliance, and every closure item should be traceable to the component and requirement it makes defensible.

There is one part of a gap analysis that reliably stalls, and it is Safety Risk Management. Scoring a policy or a training programme is straightforward, you either have it or you do not. Scoring your risk management means first knowing what you are managing risk against, and a blank tool gives you nothing to start from. Before you can score a single SRM gap, someone has to invent the operation's hazards, the scenarios that could develop, the barriers meant to stop them, and the indicators that would show them drifting. That is weeks of work that has nothing to do with your actual gaps, and it is where blank-page implementations lose their first month.

eAviora removes that starting cost by shipping the risk model in the box. There are 101 bow-tie models, 804 named barriers, 210 scenarios, and a 610-indicator SPI library present on day one, a pre-built aviation risk knowledge base. The SRM part of your gap analysis changes shape entirely: instead of what are our hazards, the question becomes which of these apply to us, and are we managing them. You assess against a real landscape rather than a blank canvas.

The rest of the platform is built to catch the output of the analysis rather than let it die in a spreadsheet. Every gap you find becomes a live requirement in one operational graph that connects occurrences, hazards, investigations, corrective actions, audits, findings, documents, training, and indicators. Closure gates mean a record cannot close over open risk, so a gap marked closed has the evidence to prove it. A computed Safety Risk Profile fuses eight components into a single four-level score aligned to the current edition of ICAO Doc 9859, and real statistical process control watches the indicators. Specialist AI agents can draft the first pass of a hazard analysis or a requirement mapping, but every proposal is human-gated (accept, modify, or reject) and audit-logged, metered in plain credits, and your data never trains any model. To run a gap analysis against your own operation, see the SMS module or talk to us.