Do As I Say And Not As I Do

Do as I say, and not as I do is a common management system within airlines and airport operators, and it is their definite purpose to set the stage for an accountable executive (AE) to use ultimate powers at their own discretion. 

The safety management system (SMS) regulations are set up for one person to make the final decision. This is not wrong, incorrect, or bad, but safety in aviation has not yet evolved into the concept of SMS but is still operating in the pre-SMS era where safety was used as an emotional tool to design corrective action plans. Cultural change is time-consuming, and it could take a generation before SMS has fully evolved. In the meantime, accountable executives will continue to make emotional safety decisions. The regulator is onboard with this, and it does not help the aviation industry to evolve into a successful SMS, that regulatory inspection focuses on other than SMS assessments. It was not long ago that the regulator admitted not to have fundings for full SMS assessments of operators. At one airport, the only inspection conducted by the regulator the last three years was a wildlife inspection, which only inspected if there was a perimeter wildlife fence, if birdstrike reported, and if the wildlife manual was reviewed within two years. Anyone can pass this inspection with flying colors.     

The role of accountable executive is to be accountable to safety and to lead an airport or airline in aviation safety for continuous safety improvements by maintaining a viable safety management system. An accountable executive is the final authority over operations authorized to be conducted under the certificate. An AE controls the financial resources required for the operations to be conducted under the certificates, and an AE controls the human resources required for the operations authorized to be conducted under the certificates. An AE is responsible for designating sufficient management personnel for acceptable safety performance, for effective operations under the SMS and to facilitate hazard identification and safety risk assessments. An AE is also the authority of definitions, and in the event of discrepancies within the text of the safety management system manual, the accountable executive is authority on interpretation. An AE regularly review the safety policy to ensure it remains relevant appropriate to the certificates, and an AE regularly review the safety performance assessment of the organization and direct actions necessary to address substandard safety performance in accordance with the regulations for continuous safety improvements.

Just as a CEO of a corporation may reject an accountant’s recommendation for tax-filing, an AE may reject a recommendation from the risk management expert, or the SMS manager. Rejecting an accountant’s recommendation has consequences, while rejecting an SMS manger’s recommendation does not. An AE may at anytime, and without cause, reject a recommendation and issue a directive of the accountable executive. When an accountable executive rejects a control action or reject the assigned risk level of a system analysis, it is not within their SMS authority to demand that it is the SMS manager who does the changes. An SMS manger is appointed by the certificate holder, and this would be intentional manipulation of a risk analysis if specific outcomes were demanded. On the other hand, there are often other operational tools available for an AE to intimidate the SMS manger to make changes. Intimidations are never documented and did therefore not happen. It is the prerogative of an AE to use the “Do as I say, and not as I do” principle. An acceptable method is for an AE to conduct their own risk analysis, or system analysis and sign their own assessment as the accepted control action or risk level of a system analysis. 

An AE directive is when, in the opinion of the AE, there is substandard safety performance. Public relations and customer service may be an integrated part of safety performance and the AE may apply different data inputs for an analysis. In organizations, being an airport or airline, the SMS manager is often the person responsible to maintain a positive customer relationship. A customer relationship may be terminated should an SMS manager oppose to comply with a third-party, or customer’s risk assessment opinions. An AE may assess the safety risk level from a different point of view than the SMS manager and issues an AE directive to satisfy their customers.    

When SMS was implemented with the four-year phase-in exemption, the expectation was that it would take 12-15 years before SMS was fully accepted and evolved into its definite purpose. Over the following years SMS was misunderstood with large groups of opposition. SMS was also assigned blame for accidents, and for future accidents that had not happened yet. 

A 2013 survey of Canada’s aviation inspectors shows they are increasingly concerned about aviation safety because of Transport Canada rules that leave responsibility for setting acceptable levels of risk up to the airlines. The survey, conducted by Abacus Data on behalf of the Canadian Federal Pilots Association (CFPA), indicates 67 per cent of Canadian aviation inspectors believe the current system increases the risk of a major aviation accident, up from 61 per cent in 2007. It should be noted at this point the CFPA, has had a record of opposing SMS for the start. They are the major critics of the SMS approach. A similar survey in 2007 found 74 per cent of inspectors expected a major aviation accident or incident in the near future. Now, 84 per cent of inspects expect such an accident. This survey was set up for the SMS to fail. Ten years later, there are zero reports that the safety management system was the root cause of any aviation accident.

On 4 March 2019, an aircraft was attempting to land off an ILS approach in procedure-minima weather conditions flew an unsuccessful first approach and a second in similar conditions which ended in a crash landing abeam the intended landing runway substantially damaging the aircraft. The accident was attributed to the crew decision to continue below the applicable minima without acquiring the required visual reference and noted that the ILS localiser had not been aligned with the runway extended centreline and that a recent crew report of this fault had not been promptly passed to the same Operator. Three days after the accident, a flight inspection of the runway ILS confirmed that the LOC signal was out of tolerance by about 200 feet to the right of course. The depth of accumulated snow around the LOC signal transmitter was estimated at between 2 feet and 5 feet in the area of the LOC signal transmitter. After this snow had been removed, another inspection found that both LOC and GS signals were within the required tolerances and the ILS was returned to service. With an airport SMS, the airport at a minimum had process tools available for snow removal. It is not the SMS causing accidents, it is the lack of using available tools. 

Safety accountability is a safety culture for personnel with roles or responsibilities under the safety management system. All personnel are accountable within their job function, job description, or job performance are accountable to safety and the safety management system. 

An airport operator needs to design and develop airside operations plans to establish operational processes. There might not be a regulatory requirement to clear snow by the ILS antenna, which then become the reason why an airport operator needs to take on that accountability. A precision approach path indicator (PAPI) is a visual guidance system to the runway. There is guidance material for PAPI maintenance, and there is a standard requirement for a preventive maintenance program in order to prevent a failure or degradation of` facilities and systems. A preventive maintenance program may not directly specify ILS antenna maintenance, but when reviewing one maintenance item, the airport also must review other facilities requiring maintenance. Airside operations of facilities without guidance material, is no different than developing a corrective action plan after an identified root cause. When conducting a root cause analysis, the problem must be defined, and assigned to a system, process, procedure or acceptable work practice within human factors, organizational factors, supervision factors or environmental factors. An airport operator must action airside facilities in the same way as a root cause analysis and develop a corrective action plan, or an airside operations plan for that facility. An AE may have reference statements in their SMS policy to the matter but excluding it from operational accountability. Airside operations plans are also designed corrective action plans for airside findings and may only require minor adjustment to make finding corrections.

A system analysis is required prior to changes affecting the SMS, operations, or acceptable work practices. A system analysis process is to establish the context. Establishing the context is to understand the safety performance objectives of the system, operations, or SMS. For system impacts, and to analyze risk controls developed under a safety risk management system (SRM) and review the system analysis conducted under SRM. Included in the system analysis is to identify the objective of the analysis. The objective is to analyze safety performance of a system, of an operation, and the SMS itself. Data must be secured appropriately. Securing data is the framework for data sources of internal reports, external reports, incidents and accidents reports prepared internally, or by TSB, daily occurrence reports, internal surveys, onsite observations, newspapers and other information sources or publicly available data information sources. Data needed may be already on hand, or additional data-gathering may be needed, such as conducting a special audit with focus on a specific problems. An appropriate data analysis method must be selected. Data is entered into a spreadsheet and processes analyzed in a Statistical Process Control (SPC) software. An effective SPC software is SPCforExcel. Data is compared to other data, including routine reporting data compared to unplanned event data. Data is collected from both airline or airport operations as it relates to the system analysis, including respective subdepartments or third-party contractors. Third-party contractors are included since they perform tasks on behalf of the AE and affect the perception of oversight by the accountable executive.  

The SMS manger conducts the system analysis in cooperation with associate departments and make recommendations to the accountable executive. An accountable executive should not be a part of the system analysis team since the AE is the final authority, and to preserve the integrity of the analysis. As the final authority the AE may accept or reject the analysis. Conventional wisdom and acceptable practices at the AE level, is to allocate errors to persons. The root cause may incorrectly be assigned to compliance failure, and as a tool to prevent further occurrences of error and omissions, enforcement statements directed to personnel are published. What is missing in this equation is that human errors are symptoms, or an incomplete level in the analysis, of human factors, organizational factors, supervision factors or environmental factors, which may be assigned as root cause.  

As a virtual example an accountable executive may issue statements to enforce compliance with “Do as I say, and not as I do”. Such statements may include that multiple requests have been sent to attain details regarding an accident, or a hazard, that the AE as attained no feedback or updates, nor has an SMS manager attempted to contact the AE and ignored messages. Such behavior is a deviation from expectations and portrays an image identifying that defining a root cause and mitigation are not important, and nor is safety within the safety department important. There is a significant lack in professional ethic and has only gotten worse.  

A safety policy, signed by the accountable executive may state that the safety commitment is to maintain a fully functional safety management system with continuous improvements of the level of safety throughout the organization and fulfill safety goals and objective. When intimidating statements are published an SMS enterprise is on a path drifting away from a fully functional SMS. However, since the regulator does not conduct complete SMS assessment inspections, and operators are accident-free, these enforcement statements are hidden within the bureaucracy of an SMS enterprise. Do as I say, [by actions and intimidation] and not as I do [by the text in the SMS policy] is an effective AE oversight tool. By random chance this type of oversight management does not lead to accidents. 

OffRoadPilots