What a safety management
system actually is.

See the highlighted block above the contents list for the short definition. The rest of this article covers the four components one at a time, who is legally required to run an SMS, what an SMS is emphatically not, and the difference between a system that is filed and one that actually works.

Strip away the acronyms and a safety management system is a management system pointed at one thing: safety risk. Operators already run management systems for quality, for finance, for security. An SMS applies the same discipline, defined ownership, defined process, measurement and review, to the risk of hurting someone. ICAO describes it as a systematic approach to managing safety, including the organisational structures, accountabilities, policies and procedures that the approach needs.

The point of that structure is to replace good intentions and heroics with a repeatable loop. Someone identifies a hazard. The organisation assesses how much risk that hazard carries. It puts controls, barriers, in place to reduce the risk to a level it has decided is acceptable. Then it checks that those controls are present and effective, and it feeds what it learns back into training and communication. Do that continuously and you have an SMS. Skip the verification step and you have a wish.

Crucially, the same four components apply at any size. A single-aircraft charter operator and a large carrier run the identical framework, scaled to fit. The regulator does not expect a certain headcount or a certain thickness of manual, only that the four components are genuinely present and genuinely working.

Safety Policyis the foundation. It is the accountable executive's signed commitment to safety, the definition of who is responsible for what, the appointment of the key safety people, the coordination of emergency response planning, and the documentation that ties the system together. Policy is where the organisation states, in writing and with resources behind it, that safety is a core objective and that specific named people own it.

Safety Risk Management is the engine. It identifies hazards, from occurrence reports, audits, surveys and day-to-day observation, and it assesses the risk each hazard carries, usually on a severity-by-likelihood matrix, before applying controls to bring that risk down to an acceptable level. This is the component that produces the hazard register, the risk assessments and the barriers the operation actually relies on.

Safety Assurance is the check. Having put controls in place, the operator has to prove they work and keep working. Safety Assurance monitors safety performance through indicators and targets, audits the operation, investigates occurrences, assesses the risk of planned changes before they happen, and continuously improves the SMS itself. If Safety Risk Management builds the barriers, Safety Assurance is what confirms the barriers are still standing.

Safety Promotion is the fuel. It is the training that makes people competent in their safety duties and the communication that keeps safety visible and two-way. Promotion is what makes a frontline crew member comfortable filing a report and confident it will be handled fairly, and it is how the lesson from one event reaches the whole fleet. Without it the other three components slowly starve, because the reports that feed them dry up.

Those four components subdivide into twelve elements in the ICAO Annex 19 framework, the specific building blocks each component requires. We break the components and elements down one at a time in the four components of SMS.

The international baseline is ICAO Annex 19, Safety Management, which sets out the SMS framework of four components and twelve elements and requires operators in member states to implement it. States meet their side of the bargain through a State Safety Programme (SSP), and the detailed guidance lives in ICAO Doc 9859, the Safety Management Manual (current edition). Annex 19 is why the SMS looks broadly the same in every country: the national rules below are implementations of it.

In the United States the rule is 14 CFR Part 5, enforced by the FAA. A final rule published on 26 April 2024 and effective on 28 May 2024 revised Part 5 and, importantly, extended SMS well beyond the Part 121 airlines that already had it. The rule now reaches all Part 135 certificate holders, commercial air tour operators under 91.147 letters of authorisation, and certain Part 21 certificate holders. Part 121 carriers that already held an FAA-accepted SMS conform to the revised Part 5 by 28 May 2025. Part 135 and 91.147 operators had implementation plans due by 28 November 2024 and must have the SMS fully implemented, with a declaration of compliance submitted to the FAA, no later than 28 May 2027, and that applies regardless of size, down to single-aircraft, single-pilot certificate holders. Part 21 holders follow the same 28 November 2024 plan and 28 May 2027 implementation dates. The 2024 revisions also require a confidential employee reporting system and the declaration of compliance. The full breakdown is in the FAA Part 5 explainer.

In Europe, management-system (SMS) requirements are embedded directly in the EASA implementing rules rather than a single standalone regulation, for example ORO.GEN.200 for air operators. All EASA Part-145 approved maintenance organisations must have an SMS implemented following the end of the transition on 2 December 2024, and Part-CAMO continuing-airworthiness organisations already carry management-system requirements. The practical upshot across ICAO, the FAA and EASA is the same: for anyone running a commercial aviation operation, an SMS is no longer optional. See EASA Part-145 SMS requirements and Annex 19 in 90 days for the implementation view.

Because the words are generic, an SMS is easy to fake and easy to misunderstand. It helps to be blunt about what it is not:

• Not a manual.A binder titled “SMS Manual” describes the system; it is not the system. The system is the activity the manual describes actually happening.
• Not a reporting inbox. Collecting occurrence reports is one input to one element. An operation that gathers reports but never assesses, controls or verifies has a mailbox, not an SMS.
• Not a compliance checkbox. Passing an audit proves the paperwork exists on the day; it does not prove the four components run the other 364 days of the year.
• Not the safety department's private project. Safety Policy assigns accountability to line management and the accountable executive, not to a safety office in the corner.
• Not a guarantee of zero accidents. An SMS manages risk to an acceptable level; it does not promise perfection, and a system that claims to has stopped being honest about residual risk.

So what does a working SMS look like? Concretely, you can see it in how ordinary events move:

• Hazards get reported without fear, because just culture is real and reporters get feedback.
• Reports become assessed risk, not filed paper: each one is scored, linked to the hazard it exercised, and given an owner.
• Controls are verified, not assumed. Safety Assurance confirms each barrier is present and effective, and an enforced closure gate stops a record closing while the risk behind it is still open.
• Indicators show real performance, trended with statistical rigour rather than a green or red arrow, so a drift is visible before it becomes an event.
• The accountable executive sees a live, honest risk picture and resources the fixes, and changes are risk-assessed before they are made, not explained after.

There is one failure mode that passes audits and still leaves an operator exposed, and it is the most common one. The four components are all present, but only as separate piles of records. Occurrences live in one log. Hazards live in a register. Corrective actions live in a tracker. Audits live in a folder. Training lives in a matrix. Indicators live in a spreadsheet. Every box the regulator asks for is ticked, and nothing is connected.

That disconnection is where risk hides. The occurrence that should have reopened a hazard sits unlinked. The corrective action that was supposed to restore a barrier closes without anyone checking the barrier. The indicator that would have shown the drift is in a different file from the events driving it. An SMS built as disconnected records can be fully compliant and still blind.

An SMS actually works when the four components form a single connected model instead of parallel archives. In that model an occurrence links to the hazard it exercised, the barrier that failed, the corrective action that restores it, the indicator that watches for its return, and the risk profile it moves. That is the shift from records to connected intelligence, and it is the difference between a system that stores what happened and one that tells you what it means. We unpack it in what aviation safety intelligence is.

This is the problem eAviora is built to solve. The platform runs the whole SMS as one operational graph, occurrences, hazards, investigations, corrective actions, audits, indicators, the Safety Risk Profile and the governance around them, so the four components are genuinely wired together rather than merely all present. Enforced closure gates mean a record cannot close over open risk. The Safety Risk Profile is computed, eight components fused into a single ICAO Doc 9859 aligned four-level score, and indicators run on real statistical process control rather than coloured trend arrows. See how the pieces link in connect occurrence, CAPA, SPI and risk profile, or explore the SMS module.