Your SMS manual describes a system.
Inspectors check the system.

See the highlighted block above the contents list. The rest of this article covers the six things an SMS manual must establish, a workable chapter skeleton, what inspectors actually check, the trap of copying an airline manual, and why the manual should describe your system of record rather than duplicate the data inside it.

Strip away the formatting and an SMS manual has to establish six things without ambiguity:

• Safety policy and accountabilities. The safety policy, the objectives, and the accountabilities, down to a named accountable executive who carries ultimate responsibility, plus the key safety personnel and any safety action group or review board.
• Safety risk management. How hazards are identified, how risk is assessed, and how controls are decided, applied and tracked.
• Safety assurance. How you monitor safety performance, run internal audit, manage change, and confirm the controls are working.
• Safety promotion. Training, competence and communication, the human side that keeps the system alive.
• The safety reporting system. How events are reported, including a confidential channel, and how reporters are protected under a just-culture posture.
• The emergency response plan interface. How the SMS coordinates with the emergency response plan when an event escalates.

These are not six inventions. They map directly onto the four components of an SMS, with the reporting system and the emergency response interface sitting as elements within them. For US operators, the FAA SMS final rule (published 26 April 2024, effective 28 May 2024) revised 14 CFR Part 5 around those four components and added a confidential employee reporting system and a declaration of compliance; our Part 5 explainer walks through what changed. For European operators the same management-system substance sits in the EASA implementing rules. The manual job is to establish all six clearly, whichever regime you fall under.

Structure follows the six things above. A skeleton that maps cleanly onto the four components and reads well to an inspector looks like this:

• Safety policy, objectives and management commitment.
• Safety accountabilities and key personnel: the accountable executive, the safety manager, and the safety action group or review board.
• Hazard identification and safety risk management.
• Safety reporting: routine and confidential reporting, and the just-culture protection that makes people use it.
• Safety assurance: performance monitoring and indicators, internal audit, and management of change.
• Safety promotion: training, competence and communication.
• Emergency response plan interface and coordination.
• Document control and records: how the manual itself, and the documents beneath it, are reviewed, approved and kept current.

Keep each chapter short. A chapter states the policy, names the roles, defines the triggers, and points to where the records live. It does not re-teach safety management theory, and it does not transcribe guidance material. If you want the reasoning behind each component before you write it, ICAO Doc 9859 is the design reference to work from; we summarise how to use it in the ICAO Doc 9859 guide. The skeleton is deliberately boring, because a predictable structure is exactly what an inspector wants to navigate.

Two questions drive an SMS review, and knowing them changes how you write. The first is whether practice matches the manual. An inspector reads the process you describe, then traces it in the operation. If the manual says hazards are risk-assessed within a defined time, the inspector pulls recent hazards and checks. If the manual says the safety review board meets on a cadence, the inspector asks for the minutes. A gap between description and practice is the most common finding there is, and it is entirely self-inflicted: the manual promised something the operation does not do.

The second question is whether records prove it. Safety management is evidenced, not asserted. That means reports raised and closed, risk assessments with a recorded rationale, indicators tracked with a defined action on breach, audits with findings driven through to closure, and document control that shows who reviewed and approved each controlled document. The manual points to where these records live. The records are the proof. When closure is actually enforced, rather than a status someone types, that proof is much harder to fake; we describe the mechanism in enforced closure gates.

Named roles are treated as real. The accountable executive is not a title on an org chart, and an inspector may expect to see that person demonstrably engaged: reviewing safety performance, chairing the right forum, owning the decisions the policy says they own. If the manual names a role, the operation has to be able to show the person in it doing the job.

The fastest way to produce an SMS manual is to copy a large operator manual and change the logo. It is also the fastest way to fail an audit. A borrowed manual describes a borrowed system: committee structures you do not have, processes sized for a fleet you do not fly, roles nobody in your operation holds. The document reads beautifully and describes someone else entirely.

It fails in two ways, and both surface as the same finding. Over-description is the first: the manual promises a process too heavy to run, so practice quietly diverges and the records stop matching. Mis-description is the second: the manual describes another operator operation, so the records never matched in the first place. Either way, the inspector reads the process, looks for it, and does not find it. Practice does not match the manual.

Scale is the fix. Annex 19 and its guidance are explicit that an SMS is scalable, and the FAA 2024 rule extends SMS to smaller operators precisely on that basis: it applies regardless of size, including single-aircraft and single-pilot certificate holders. A single-pilot operation implements the same four components at a proportionate weight, not a major carrier committee structure. Copying a large operator manual buries a small operator in process it cannot sustain, which is the opposite of a safety benefit. If you run a lean operation, start from an SMS scaled for small and single-pilot operators rather than from a borrowed airline manual.

The most useful shift is to stop treating the manual as the place where safety data lives. The manual describes the system. The system of record is where occurrences, risk assessments, indicators, audits and corrective actions actually exist. A manual that duplicates that data goes stale the moment the data changes, and every stale figure is a future finding waiting for an inspector to notice the mismatch.

eAviora is the operational graph the manual points to. Occurrences, hazards, investigations, corrective actions, audits, findings, documents, training, compliance and SPIs are one connected set of records, not a drawer of separate spreadsheets. The manual references the process, the platform holds the evidence, and the two do not drift because the evidence is live rather than transcribed. The manual gets to stay short and stable while the operation underneath it moves.

It is also where the manual promises become enforced rather than aspirational. The manual says risk is controlled before closure; the platform enforces it, because a record cannot close over open risk and a degraded barrier needs a linked corrective action proven effective first. The manual says documents are controlled; the platform runs a named reviewer, approver and publisher four-eyes route with read-acknowledgment and a review cadence. The manual says reporting is confidential; the platform runs a closed just-culture loop with de-identified bulletins and reporter feedback. See how controlled documents hold together in the Documents module, or talk to us to map your manual onto a live operation.