the safety vocabulary,defined for operators.

A structured framework for managing safety risks in aviation operations.

A Safety Management System (SMS) is the systematic approach to managing safety, including the necessary organisational structures, accountabilities, policies and procedures. ICAO Annex 19 mandates an SMS for service providers (airlines, ATOs, MROs, ANSPs, aerodromes). The four pillars are safety policy, safety risk management, safety assurance, and safety promotion.

A structured system for assuring quality of aviation processes against requirements.

A Quality Management System (QMS) ensures aviation activities meet specified requirements through planning, execution, monitoring, and improvement. In aviation, QMS typically owns audit programmes, finding closure, evidence management, and effectiveness verification. EASA Part-ORO uses the term "compliance monitoring" for the same function, and FAA Part 5 covers it under safety assurance.

A structured system for managing aviation security threats and protective measures.

A Security Management System (SeMS) is the security analogue of SMS, focused on intentional acts of unlawful interference. ICAO Annex 17 sets the international standards. SeMS covers threat assessment, asset exposure mapping, security occurrence reporting, and amendment tracking against Annex 17 changes.

The pre-defined plan an operator activates in response to a safety emergency.

An Emergency Response Plan (ERP) defines roles, communication trees, regulator notification protocols, and recovery procedures for aviation emergencies. ICAO Annex 19 requires every certified operator to maintain and exercise an ERP. The plan is activated by accountable manager (or designate) on declared emergency.

The UN specialised agency that sets international civil aviation standards.

ICAO is the United Nations specialised agency that codifies the principles and techniques of international air navigation. ICAO publishes 19 Annexes to the Chicago Convention covering everything from personnel licensing (Annex 1) to safety management (Annex 19). ICAO standards are not directly binding, each contracting state implements them through its national civil aviation authority.

The EU agency responsible for civil aviation safety in member states.

EASA is the European Union agency that drafts implementing rules, certification specifications, and acceptable means of compliance (AMC) for civil aviation across EU member states. EASA Part-ORO (Air Operations Organisation Requirements) is the SMS+QMS+CMS regulation for commercial air transport operators.

The US civil aviation authority, part of the Department of Transportation.

The Federal Aviation Administration regulates all aspects of civil aviation in the United States. 14 CFR Part 5 mandates SMS for Part 121 air carriers and is being extended to additional certificate holders. The FAA publishes Advisory Circulars (ACs), notably AC 120-92 for SMS implementation guidance.

The ICAO Standard establishing State Safety Programme and SMS requirements.

Annex 19 (Safety Management), first published 2013, consolidates SMS requirements that were previously scattered across ICAO Annexes 1, 6, 8, 11, 13, and 14. It defines the four pillars of SMS, mandates a State Safety Programme (SSP) at the contracting-state level, and harmonises safety reporting expectations.

The ICAO Standard for safeguarding civil aviation against acts of unlawful interference.

Annex 17 establishes security objectives and requirements for civil aviation, including aerodrome security, in-flight security, cargo screening, and contingency planning. Amendments are issued periodically; operators must run a change-impact analysis on each amendment to identify which policies, procedures, and training records need updating.

The ICAO Standard for aerodrome design and operations.

Annex 14 (in two volumes, Aerodromes and Heliports) defines physical characteristics, obstacle limitation surfaces, visual aids, equipment, services, and operational procedures for aerodromes. Operators with apron-side activities cross-reference Annex 14 in their hazard registers.

The ICAO Standard for international commercial air transport and general aviation operations.

Annex 6 governs operations of aircraft, in three parts: international commercial air transport (Part I), international general aviation aeroplanes (Part II), and international operations helicopters (Part III). It feeds into operations manuals (OM-A/B/C/D), training, and many SMS hazards.

The EASA Air Operations Organisation Requirements rule.

EASA Part-ORO (Annex III to Commission Regulation (EU) 965/2012) sets organisation-level requirements for commercial air transport operators in the EU: management system, accountable manager, compliance monitoring, training, and crew records. Subpart GEN.MLR covers manuals; Subpart MAN covers management.

The US federal regulation requiring SMS for Part 121 operators.

14 CFR Part 5 mandates a Safety Management System for Part 121 air carriers and is being extended to additional certificate holders. It defines SMS components (safety policy, safety risk management, safety assurance, safety promotion) consistent with ICAO Annex 19. AC 120-92B is the implementation guidance.

A risk visualisation method linking threats, barriers, top event, and consequences.

Bowtie analysis displays a hazardous event ("top event") at the centre, with the threats that could cause it on the left, the consequences if it occurs on the right, and barriers (preventive and recovery) along the connecting paths. Each barrier is rated for effectiveness, owner, and degradation. Used heavily in oil + gas; increasingly mainstream in aviation safety.

James Reason's accident causation model where defences are layers with holes.

James Reason's Swiss Cheese Model represents organisational defences as slices of cheese, each with holes (latent failures + active failures). An accident occurs when holes momentarily align. The model underpins much of modern aviation safety thinking, including HFACS and the latent-vs-active failure distinction in investigation.

A taxonomy for classifying human-factor contributors to accidents and incidents.

HFACS (developed by Wiegmann and Shappell, US Navy/FAA) extends the Reason Model into four levels of failure: unsafe acts of operators, preconditions for unsafe acts, unsafe supervision, and organisational influences. It provides a structured taxonomy that investigators map contributing factors against, enabling cross-investigation pattern detection.

A root-cause technique that asks "why" iteratively until reaching a systemic cause.

The 5-Why technique (developed at Toyota) is a simple investigation method: ask "why did this happen?" and follow each answer with another "why" until the systemic cause is uncovered (typically 5 iterations, sometimes more). Useful for relatively contained incidents; complemented by HFACS or Reason Model for complex events.

A systematic process for identifying the underlying causes of an event, not just symptoms.

Root Cause Analysis is the umbrella discipline of going beyond proximate causes to identify the systemic conditions that allowed an event to occur. Methods include 5-Why, fishbone (Ishikawa), Reason Model, HFACS, and fault-tree analysis. ICAO Annex 13 (Aircraft Accident Investigation) and ICAO Annex 19 both expect RCA in occurrence investigations.

A risk-acceptance criterion: residual risk reduced as low as is reasonably practicable.

ALARP is a risk-acceptance principle from UK Health and Safety Executive (HSE) that has crossed into aviation. A residual risk is ALARP when further reduction would require disproportionate effort, time, or cost. The "tolerable risk" region is bounded above by intolerable and below by broadly acceptable; ALARP applies in the middle band.

The structured check that a corrective action actually reduced the risk it targeted.

Effectiveness verification is the post-implementation check that confirms a corrective or preventive action achieved its intended risk reduction, not just that it was implemented. EASA Part-ORO and FAA Part 5 both require effectiveness verification before an action can close. It is the gate that distinguishes "we did something" from "the risk is actually lower".

A measurable parameter used to monitor and assess safety performance.

A Safety Performance Indicator (SPI) is a quantifiable measure of an aspect of safety, for example "unstable approaches per 1000 sectors" or "go-around rate per 1000 landings". Each SPI has an alert threshold and a target. ICAO Annex 19 requires SMS to define and monitor SPIs; trend changes (often via Statistical Process Control) trigger investigation before they become incidents.

The desired performance level for an SPI, expressed as a numeric target.

A Safety Performance Target (SPT) is the numeric goal an organisation sets for an SPI over a defined period. Targets must be realistic, time-bound, and reviewed at safety review board cadence. SPT progress reporting feeds into the State Safety Performance dialogue under ICAO's State Safety Programme.

Actions to address an identified deficiency (corrective) or prevent recurrence (preventive).

A CAPA is the structured response to a finding from an audit, occurrence investigation, or hazard assessment. Each CAPA has a typed owner, a due date, and a named verifier. The pipeline runs: open, in progress, verify, closed. Closure cannot happen until effectiveness verification is signed.

A culture where reporters are treated fairly based on intent, not outcome.

Just Culture (per James Reason and Sidney Dekker) is the principle that frontline reporters should be treated fairly based on intent and behaviour, not on the consequences of their actions. Errors are reported and learned from; reckless behaviour is sanctioned. Just Culture is the social precondition for an effective voluntary reporting system, which is in turn the lifeblood of an SMS.

A condition or object with the potential to cause harm to aviation operations.

A hazard is a condition, object, or activity with the potential to cause harm: injury, damage to equipment or property, loss of capability. Hazards are catalogued in a hazard register, scored for likelihood × severity on a risk matrix, and linked to barriers that mitigate them. Hazard identification is continuous in mature SMS.

In security context, an intentional act of unlawful interference.

In aviation security (SeMS), a threat is an intentional act or capability with potential to cause harm: bombing, hijacking, sabotage, cyber intrusion. Distinct from "hazard" (which is unintentional). Threat assessment maps threats against assets (terminal, ramp, aircraft, perimeter, control room) to produce an exposure matrix.

A control that prevents a threat from reaching the top event, or limits consequences.

A barrier (preventive or recovery) is a control that interrupts the cause-to-consequence chain in bowtie analysis. Preventive barriers sit between threats and the top event; recovery barriers sit between the top event and consequences. Each barrier is rated for effectiveness, has an owner, and degrades over time without inspection.

The central hazardous event in a bowtie diagram, the loss of control of the hazard.

The top event in bowtie analysis is the moment the hazard is no longer controlled, for example "loss of separation between aircraft" or "runway incursion". To the left are the threats that could cause it; to the right are the consequences if it propagates. The top event is the conceptual anchor of the diagram.

Any safety-related event that disrupts or could have disrupted safe operations.

An occurrence is any safety-related event, accident, serious incident, incident, or any condition that has potential to affect safety. Occurrences are classified as Mandatory (regulator-required), Voluntary (encouraged), or Confidential (anonymised). EU Regulation 376/2014 mandates occurrence reporting and protects reporters.

A documented deviation from a requirement, identified during an audit or investigation.

A finding is a recorded deviation from a regulatory requirement, internal procedure, or standard. Severity is enumerated (typically Level 1: significant non-compliance, Level 2: minor non-compliance, Observation: recommendation). Each finding has an owner, a due date, an evidence chain, and a closure workflow tied to a CAPA.

A 2-D matrix scoring risk by combining likelihood and severity.

A risk matrix scores risks by crossing likelihood (frequent to improbable) with severity (catastrophic to negligible) into cells coloured by acceptability (red intolerable, yellow ALARP, green broadly acceptable). ICAO Doc 9859 illustrates the standard 5×5 matrix; operators tailor the cell labels and acceptance criteria to their operation.

EASA term for the QMS function that audits and monitors regulatory compliance.

Compliance Monitoring (formerly "quality system" in JAR-OPS) is the EASA-defined function that ensures the operator complies with applicable requirements and that the management system is effective. It owns the audit programme, finding management, and reporting to the accountable manager.

A systematic, independent, documented examination against defined criteria.

An audit is a planned examination of a process, area, or function against defined criteria (regulation, standard, manual, contract). Internal audits are run by the operator's compliance monitoring function; external audits are run by the regulator (oversight) or a third party (e.g. IOSA, IS-BAO). Findings flow into CAPA.

The single named person ultimately responsible for the safety of the operation.

The accountable manager (AM) is the single individual designated to the regulator as having overall responsibility for the operation's compliance with applicable requirements and the establishment and maintenance of the management system. Typically the CEO, COO, or postholder with corporate authority. The AM signs the safety policy and ERP activation.

The person responsible for the day-to-day operation of the SMS.

The Safety Manager (sometimes Head of Safety or Director of Safety) is the postholder responsible for the implementation and day-to-day functioning of the SMS. Reports functionally to the accountable manager. Owns the hazard register, the SPI dashboard, the safety review board, and the safety promotion programme.

The four-part operations manual required for commercial air transport.

The Operations Manual (OM) under EASA Part-ORO and ICAO Annex 6 is structured in four parts: OM-A General/Basic (organisation, policies, procedures), OM-B Aircraft Operating (aircraft-specific operating procedures), OM-C Route and Aerodrome (routes, airports, special procedures), OM-D Training (training and checking syllabi). Each part is version-controlled; revisions trigger crew read-and-sign distribution.

The list of equipment that may be inoperative for a flight to be dispatched.

The MEL is the operator-specific document derived from the Master MEL (issued by the aircraft type certificate holder) listing equipment that may be inoperative under defined conditions for a flight to be dispatched. MELs include time limits (Categories A/B/C/D), procedures, and limitations. MEL revisions are version-controlled and tracked in document control.

A documented step-by-step procedure for a recurring operational task.

Standard Operating Procedures define how a routine task is performed, who performs it, and under what conditions. SOPs are referenced from manuals (typically OM-B/C), trained against, and audited for adherence. SOP non-adherence is a common causal factor in safety occurrences and feeds back into training.

An organisation authorised to deliver aviation personnel training.

An Approved Training Organisation is certified by a competent authority to deliver pilot, cabin crew, technician, or other aviation personnel training. EASA Part-ORA-ATO covers the requirements; FAA Part 141/142 covers the US equivalent. ATOs maintain training records, course materials, and instructor qualifications under document control + training modules.

An organisation approved to perform aircraft maintenance.

A Maintenance, Repair and Overhaul organisation is certified to perform maintenance, repair, and overhaul on aircraft and components. EASA Part-145 + Part-CAMO and FAA Part 145 + Part 43 govern MRO activities. MROs operate their own SMS + QMS + document control + training systems, often integrating with operator-side records.

A computed, multi-component score that summarises how exposed a risk theme is right now.

A Safety Risk Profile (SRP) rolls many signals into one current view of a risk theme, rather than relying on a single static risk-matrix cell. ICAO Doc 9859 frames safety risk as something to be monitored continuously across the operation. An SRP fuses base risk, recent trend, the health of the barriers that protect against it, open corrective-action exposure, active signals, and how well the area is surveilled, so the question shifts from "what did we score this once" to "how is this risk doing today".

A working group that reviews safety issues and drives the actions arising from them.

A Safety Action Group (SAG) is the operational tier of the safety committee structure under ICAO Doc 9859: a cross-functional group, usually departmental, that reviews emerging hazards, occurrence trends, and the corrective actions in flight, then escalates what needs senior attention to the Safety Review Board. The SAG is where day-to-day safety issues get owners and dates rather than minutes.

The senior governance body that owns the organisation's safety performance.

A Safety Review Board (SRB) is the high-level, strategic safety committee chaired by the accountable manager. Under ICAO Doc 9859 it reviews overall safety performance, sets and revises safety performance targets, accepts or rejects significant residual risk, and directs resources. It sits above the Safety Action Group: the SAG runs the issues, the SRB owns the posture.

A statistical method for telling a real trend change from normal noise in a measure.

Statistical Process Control (SPC) uses control charts and decision rules, classically the Western Electric Rules, to distinguish genuine signal from random variation in a time series. Applied to safety performance indicators, it answers "has this metric actually shifted, or is this just month-to-month noise?" before an operator commits investigation effort. ICAO Doc 9859 points to control-chart techniques for SPI monitoring.

One records model where occurrences, hazards, CAPAs, barriers and indicators connect and compute against each other.

Most safety tooling stores each module (occurrences, hazards, audits, indicators) in its own silo, so a barrier on a bow-tie has no live relationship to the corrective action that should restore it, or to the indicator that should detect its decay. A connected operation is the opposite: one records model where occurrences, hazards, corrective actions, barriers and indicators are linked records that compute against each other. A degraded barrier can raise a corrective action; a finding can move a compliance posture; an indicator trend can surface a risk theme, without re-keying anything between tools.

IATA's globally recognised audit programme assessing an airline's operational management and control.

IOSA (IATA Operational Safety Audit) is an internationally recognised evaluation of an airline's operational management and control systems, mandatory for IATA membership. The standards an airline is audited against are published in the IOSA Standards Manual (ISM). An IOSA registration signals to code-share partners, lessors, and authorities that the operator meets a common safety baseline.

A single auditable requirement within the IOSA Standards Manual.

An ISARP is one IOSA Standard (mandatory) or Recommended Practice (advisory), the individual, numbered requirement an auditor assesses conformity against. The ISM is built from hundreds of ISARPs across organisation, flight, dispatch, maintenance, cabin, ground, cargo and security disciplines. Conformity to each ISARP is recorded with evidence and a verdict during an IOSA audit.

The ICAO Standard governing the investigation of aircraft accidents and serious incidents.

Annex 13 sets out the international protocol for investigating aircraft accidents and serious incidents: who leads, how states participate, what gets reported, and how the sole objective stays prevention rather than apportioning blame. Its event-type definitions (accident, serious incident, incident) anchor how operators classify the most severe occurrences and stand up their emergency response.

A ranking of mitigation types from most effective (elimination) to least (PPE or procedure).

The Hierarchy of Controls ranks risk mitigations by inherent effectiveness: elimination, substitution, engineering controls, administrative controls, and finally personal protective equipment or procedure. The principle is that a control higher in the hierarchy is more reliable than one that depends on a human doing the right thing every time. Recording the control tier of a corrective action exposes operations that lean too heavily on the weakest tiers.

The protection levels that govern who can see sensitive safety information.

ICAO Annex 19 requires that safety data collected for prevention be protected from inappropriate use, so reporters keep reporting. In practice that means tiering information by sensitivity (for example protected, restricted, and confidential) and gating access by clearance rather than leaving everything open. The protection has to hold not just in the interface but everywhere the data flows, including any automated processing.