Recommendation A16-13

Assesssment of the response to Aviation Safety Recommendation A16-13

Oversight of commercial aviation in Canada: Safety management system assessments

View document in PDF

You need a PDF reader to access this file. Find out more on our help page.

Background

On 31 May 2013, at approximately 0011 Eastern Daylight Time, the Sikorsky S-76A helicopter (registration C-GIMY, serial number 760055), operated as Lifeflight 8, departed at night from Runway 06 at the Moosonee Airport, Ontario, on a visual flight rules flight to the Attawapiskat Airport, Ontario, with 2 pilots and 2 paramedics on board. As the helicopter climbed through 300 feet above the ground toward its planned cruising altitude of 1000 feet above sea level, the pilot flying commenced a left-hand turn toward the Attawapiskat Airport, approximately 119 nautical miles to the northwest of the Moosonee Airport. Twenty-three seconds later, the helicopter impacted trees and then struck the ground in an area of dense bush and swampy terrain. The aircraft was destroyed by impact forces and the ensuing post-crash fire. The helicopter's satellite tracking system reported a takeoff message and then went inactive. The search-and-rescue satellite system did not detect a signal from the emergency locator transmitter (ELT). At approximately 0543, a search-and-rescue aircraft located the crash site approximately 1 nautical mile northeast of Runway 06, and deployed search-and-rescue technicians. However, there were no survivors.

The Board concluded its investigation and released report A13H0001 on 15 June 2016.

TSB Recommendation A16-13 (June 2016)

Transportation companies have a responsibility to manage safety risks in their operations. Compliance with regulations can only provide a baseline level of safety for all operators in a given sector. Since regulatory requirements cannot address all risks associated with a specific operation, companies need to be able to identify and address the hazards specific to their operation.

In the traditional oversight model, companies are not required to have formalized systems in place to continuously manage safety at a systems level. Oversight is accomplished using an inspect-and-fix approach. In this approach, the regulator's role is focused on finding instances of regulatory non-compliance, which the operator must correct. The impact on safety of this approach is limited for 2 main reasons.

First, it is not possible for the regulator to examine continuously all aspects of an operation. Challenges in detecting non-conformances have been identified in a number of previous TSB investigations (e.g. A12W0031, A12C0154, and A13W0120). For example, in A13W0120, although Transport Canada (TC) had assessed the operator involved as high risk, and was conducting frequent surveillance activities, the focus had not shifted to verifying regulatory compliance, and remained at a systems level. As a result, TC's surveillance did not identify the unsafe operating practices that contributed to the severity of the occurrence.

Secondly, if the systemic causes of non-conformance are not identified and addressed, it is likely that unsafe conditions will persist. The TSB has also previously identified this pattern in a number of investigations (e.g. A10Q0098, A10Q0117, and A13H0002). For example, in A13H0002, the report identified weaknesses in the oversight of an operator with a transitioning safety management system (SMS). In that case, the operator experienced difficulty producing acceptable corrective action plans (CAP) and meeting its proposed implementation time frames. This resulted in repeated delays in addressing deficiencies. During this period, TC postponed any additional surveillance activities pending CAP implementation. The suspension of surveillance activities while waiting for the CAP process to run its course effectively reduced the frequency of oversight for an operator that was considered high risk and left the operator with less than the planned level of oversight for an extended period.

When implemented properly, SMS provide a framework for companies to manage risk effectively and make operations safer. Regulatory requirements for companies to implement SMS are the first step in ensuring that all operators are capable of meeting their safety responsibility. It is for this reason that the TSB has echoed calls from the International Civil Aviation Organization and the worldwide civil aviation industry emphasizing the advantages of SMS.

Still, even with SMS requirements, companies will vary in degrees of ability or commitment to effectively manage risk. Less frequent surveillance, focused on an operator's safety management processes, will be sufficient for some companies. However, the regulator must be able to vary the type, frequency, and focus of its surveillance activities to provide effective oversight to companies that are unwilling or unable to meet regulatory requirements or effectively manage risk. Further, the regulator must be able to take appropriate enforcement action in such cases.

Operators with a mature, effective SMS, along with a corresponding safety culture and abilities, may be the subject of less-frequent, systems-level oversight. In contrast, companies that have not demonstrated the capability to effectively manage risks at a systems level should be subject to more frequent surveillance, with a greater emphasis on ensuring compliance with regulations. As an operator's systems mature and become more effective, the frequency of oversight may be reduced and the balance of oversight can shift from the compliance-based model to more systems-level surveillance activities.

In the investigation of the Ornge RW accident at Moosonee, the TSB found that TC's approach to surveillance activities did not lead to the timely rectification of non-conformances. It also found that TC inspectors believed that tools other than a CAP to guide the operator back into compliance were either unavailable or inappropriate for use with a willing operator. As a result, the operator's willingness to address surveillance findings superseded concerns about the operator's capability to address the deficiencies in post-surveillance decision making. In addition, the investigation found that the training and guidance that was provided to TC inspectors contributed to uncertainty, which led to inconsistent and ineffective surveillance of Ornge. Ultimately, although TC was conducting frequent and detailed surveillance, the approach to returning the operator to a state of compliance was not well matched to the capabilities of the operator.

The investigation also noted that although TC was relying heavily on the CAP process, the operator was not required to have an SMS and, as a result, had not demonstrated to TC that it had the processes in place to manage safety effectively.

The TSB has previously identified these issues: safety management and oversight is a multi-modal item on the TSB Watchlist, which identifies those issues posing the greatest risk to Canada's transportation system. The Watchlist proposes the following solutions in this area:

  • TC must implement regulations requiring all air operators to have formal safety management processes, and TC must oversee these processes.
  • Companies that do have an SMS must, in turn, demonstrate that it is working—that hazards are being identified and effective risk mitigation measures are being implemented.
  • Finally, when companies are unable to effectively manage safety, TC must not only intervene, but do so in a manner that succeeds in changing unsafe operating practices.

The investigations into the Ornge accident and other recent occurrences emphasize the need for operators to be able to manage safety effectively. More than 10 years after introducing the first SMS regulations for airline operators and the companies that perform maintenance on their aircraft, SMS implementation has stalled. While many companies, such as Ornge RW, have recognized the benefits of SMS and voluntarily begun implementing it within their organizations, approximately 90% of all Canadian aviation certificate holders are still not required by regulation to have an SMS. As a result, TC does not have assurance that these operators are able to manage safety effectively.

Therefore, the Board recommended that

The Department of Transport conduct regular SMS assessments to evaluate the capability of operators to effectively manage safety.
TSB Recommendation A16-13

Transport Canada's response to Recommendation A16-13 (September 2016)

Transport Canada agrees in principle with this recommendation.

The suite of surveillance tools that TC uses, namely assessments, program validation inspections and process inspections, are effective in verifying compliance with the Canadian Aviation Regulations, including SMS requirements.

TC has adopted a systems-based approach to all its surveillance activities. In other words

TC has added management system principles and quality assurance techniques to surveillance activities across all sectors not just those subject to safety management system requirements. Under the systems-based approach, TC's civil aviation safety inspectors use the systems as an entry point and sample end products to verify that the system is working effectively and is in compliance with the Canadian Aviation Regulations.

While TC continually evaluates its tools to ensure they continue to be effective and makes updates, as required, the department is confident in its approach of using a combination of surveillance tools to verify regulatory compliance.

Board assessment of Transport Canada's response to Recommendation A16-13 (December 2016)

In its response, TC indicated that it adopted a systems-based approach to all its surveillance activities and that it is using a suite of surveillance tools to verify compliance with the Canadian Aviation Regulations, including SMS requirements. TC also indicated that it is confident in its systems-based approach to verifying regulatory compliance. The Board recognizes that TC has undertaken a number of change initiatives aimed at improving its oversight program, and that some progress has been made.

In a recent briefing to the Board, TC also reiterated its commitment to verifying regulatory compliance at appropriate intervals and effectively carrying out enforcement, as required. The Board is encouraged by the concrete enforcement actions recently taken by TC on issues that were identified through its surveillance activities. However, TC's response does not fully address the underlying safety deficiency that led to this recommendation. Achieving minimum regulatory compliance does not necessarily guarantee that all commercial aviation operators are capable of effectively managing safety within their organization. TC must also confirm that operators have a mature, effective SMS and are managing safety risks effectively.

The Board takes note that TC has recently undertaken a Program Evaluation and Update Project aimed at taking stock of the various transformation and improvement initiatives implemented to date. Once completed, this evaluation project will assist TC in refining the various elements of its surveillance program, including regular SMS assessments of the capability of operators to manage safety effectively. Although the numerous actions taken by TC may address the risk associated with this safety deficiency, more work remains to be done.

Therefore, the Board considers the response to the recommendation to be Satisfactory in Part.

Next TSB action

The TSB will continue to monitor the progress made by TC on the improvement of its SMS assessments within the overall surveillance program.

This deficiency file is Active.