A formal process for systematic and proactive identification of hazards and of appropriate mitigation strategies and measures, to be applied to all changes concerning the safety of services provided by an aviation organisation.
The Need for Change Management
Aviation organisations experience permanent change due to expansion, contraction, changes to existing systems, equipment, programmes, products and services, and introduction of new equipment or procedures. Hazards may inadvertently be introduced into an operation whenever change occurs. Safety management practices require that hazards that are a by-product of change be systematically and proactively identified and appropriate measures to manage the safety risks of the consequences of hazards be identified, implemented and subsequently evaluated.
A change can introduce new hazards, impact the appropriateness of existing safety risk mitigation strategies and/or impact the effectiveness of existing safety risk mitigation means. Changes may be external to the organisation, or internal. Examples of external changes include changes in regulatory requirements and reorganisation of air traffic control. Examples of internal changes include management changes, new equipment and new procedures.
Change Management Considerations
A formal process for change management should take into account the following three considerations:
- Criticality of systems and activities. Criticality is closely related to safety risk. Criticality relates to the potential consequences of equipment being improperly operated or an activity being incorrectly executed — essentially answering the question, “how important is this equipment/activity to safe system operations?” While this is a consideration that should be made during the system design process, it becomes relevant during a situation of change. Clearly, some activities are more essential for safe delivery of services than others. Equipment and activities that have higher safety criticality should be reviewed following change to make sure that corrective actions can be taken to control potentially emerging safety risks.
- Stability of systems and operational environments. Changes may be the result of programmed change such as growth, operations to new destinations, changes in fleets, changes in contracted services, or other changes directly under the control of the organisation. Changes in the operational environment are also important, such as economic or financial status, changes in political or regulatory environments, or changes in the physical environment such as cyclical changes in weather patterns. While these factors are not under the direct control of the organisation, it must take action to respond to them.
- Past performance. Past performance of critical systems is a proven indicator of future performance. This is where the closed-loop nature of safety assurance comes into play. Trend analyses in the safety assurance process should be employed to track safety performance measures over time and to factor this information into the planning of future activities under situations of change. Moreover, where deficiencies have been found and corrected as a result of past audits, evaluations, investigations or reports, it is essential that such information is considered to assure the effectiveness of corrective actions.
Role of Change Management
A formal change management process should identify changes within the organisation which may affect established processes, procedures, products and services. All necessary arrangements to ensure safety performance should be identified and described prior to implementing changes. The result of this process is the reduction in the safety risks resulting from changes in the provision of services by the organisation to as low as reasonably practical (ALARP) level.
System description is one of the fundamental preliminary activities in the planning of an Safety Management System. The objective of the system description is to determine a baseline hazard analysis for the baseline system. As the system evolves, seemingly small, incremental changes in the system (or the environment which provides the context of operation) can accumulate over time, which will make the initial system description inaccurate. Therefore, as part of a formal process of the management of change, the system description and the baseline hazard analysis should be reviewed periodically, even if circumstances of change are not present, to determine their continued validity. When changes to the system are made, and periodically thereafter, an organisation should go over its system, its anticipated, and its actual operational environment, to make sure it continues to hold a clear picture of the circumstances under which the provision of service takes place.
Change Management in ATM
All air navigation services, including air traffic flow management and airspace management use functional systems that enable the management of air traffic. Therefore any changes to functional systems should be subject to formal evaluation and risk assessment. In Europe, Regulation 1035/2011 laying down common requirements for the provision of air navigation services (see further reading), requires that an traffic services provider conducts systematically hazard identification as well as risk assessment and mitigation for any changes to those parts of the ATM functional system and supporting arrangements within his managerial control. This formal process shall cover:
- the complete life cycle of the constituent part of the ATM functional system under consideration;
- the airborne, ground and, if appropriate, spatial components of the ATM functional system;
- the equipment, procedures and human resources of the ATM functional system, the interactions between these elements and the interactions between the constituent part under consideration and the remainder of the ATM functional system.
Any changes to ATM functional systems should be subject to a safety oversight by the national supervisory authorities.
(See also "Change Management in ATM Operations")