Why mature SMS programs
still miss emerging risk.

See the highlighted block above. This article is the diagnosis, the five structural reasons. For the prescription, the practical methods for detecting emerging risk early are covered in how airlines detect emerging risk before incidents occur.

Picture a genuinely mature safety program. Reporting is strong because the culture is Just and people trust the process. Occurrences are classified consistently against a stable taxonomy. Investigations use structured methods. Actions are tracked to closure with effectiveness verification. Audits run on schedule and findings close on time. By every conventional measure, the SMS is working.

And it can still be surprised by an event whose ingredients, in hindsight, were already in its own data. This is the uncomfortable observation behind this article: processing events well is a different capability from seeing what is forming. The first is what maturity delivers. The second, foresight, is not produced automatically by doing the first more diligently, because the two depend on different things. Maturity depends on discipline within each step of the loop. Foresight depends on connection and interpretation across the whole operation, which the loop was never built to provide.

The gap between maturity and foresight has five recurring sources. Each is a property of how an SMS is normally built, not a flaw in how a particular team runs it.

1. Lagging bias. Most of what an SMS measures is a count of things that already happened, occurrences, findings, closed actions. These are real and necessary, but they describe the past. A program heavy on lagging indicators and light on leading ones is, structurally, watching the rear-view mirror.
2. Module silos. Occurrences live in one register, audits in another, training in a third, barriers in a fourth, indicators in a fifth. Each is internally tidy and externally isolated. Most emerging risk is a combination that only appears when signals from several modules are read together, and the silos make that read the exception, not the default.
3. The reactive loop. The core SMS workflow, capture, classify, investigate, action, close, is excellent and it only ever starts after an event. A system whose primary motion begins with an occurrence cannot, by construction, be the thing that sees risk before the occurrence.
4. Threshold blindness. Indicators are usually wired to fire when a line is crossed. That is sensible for control and useless for anticipation, because the dangerous period is often the long approach to the threshold, while the metric is still technically green. The trend toward the line carries more information than the moment it is crossed.
5. Normalisation of the unreported. Some of the most important risk never enters the SMS at all, because it takes the form of slow operational drift, small, reasonable deviations that become the new normal and so never feel report-worthy to anyone. An SMS fed by reports is blind to the risk that, by its nature, generates none.

Two of these blind spots have their own articles because they are concepts in their own right: the faint, scattered indicators that the silos hide are weak signals, and the unreported migration is operational drift. Here they are listed as causes; there they are examined in full.

The natural response to a missed risk is to ask the safety team to try harder, more reports, more reviews, more analysis. It rarely works, because the blind spots are not produced by insufficient effort. They are produced by architecture.

Consider the silo blind spot. The reason a weakening barrier, an expiring qualification and a cluster of minor occurrences on the same hazard are not seen together is not that nobody looked. It is that they live in different systems, and assembling the connection by hand is slow enough that it only happens for events already under investigation, which is to say, after the fact. Asking an analyst to do that cross-read continuously, for every hazard, by hand, is asking for something the working day does not contain. The constraint is structural; effort cannot dissolve it.

This is why “run the existing loop harder” is the wrong prescription. It intensifies the part of the system that already works, event processing, while leaving the missing capability, cross-operation interpretation, exactly as absent as before.

If the blind spots are architectural, the fix has to be architectural too. It is not a different SMS; it is a layer added on top of the one you have, with three properties that map directly onto the blind spots.

• Connection across modules dissolves the silos: the occurrence, barrier, finding and indicator touching one hazard become a single readable picture rather than four separate registers. In eAviora this is one connected operation where those records link and compute together, so the cross-read is the default, not a manual investigation.
• Interpretation in contextanswers the reactive-loop and threshold blind spots: the question moves from “what happened?” to “what is forming?”, and trends toward a line matter as much as the line itself. The bow-tie and barrier engine carries a live effectiveness state for each barrier, effective, partially effective, ineffective or missing, which feeds the computed Safety Risk Profile rather than sitting in a static diagram.
• Leading indicators and drift checks answer the lagging bias and the unreported risk: the program starts watching the conditions that precede events, including the ones that never generate a report. eAviora ships a curated library of 610 ICAO-aligned safety performance indicators with real control-chart analysis, so a trend turns into a flagged signal before any threshold is breached.

Those three properties are the definition of aviation safety intelligence. This article is the reason the shift exists: a mature SMS is necessary and it is not, on its own, foresight. The maturity ladder for getting from one to the other is laid out in the safety intelligence maturity model, and the practical detection methods in how airlines detect emerging risk before incidents occur.