What is 14 CFR Part 5?
14 CFR Part 5 is the FAA's Safety Management System (SMS) rule, finalized in 2015 and gradually expanded. It requires Part 121 air carriers, Part 135 operators with 10+ aircraft, and Part 142 training centers to operate a formal SMS — not as a binder on a shelf, but as a continuous-improvement program that integrates with daily operations.
The rule has four mandatory components: Safety Policy, Safety Risk Management (SRM), Safety Assurance (SA), and Safety Promotion (SP). Each is required and verifiable; the FAA Principal Operations Inspector reviews them quarterly to annually.
The four SMS components
Safety Policy is the executive commitment — written, signed by the accountable executive (DOT / CEO), and pushed down through the organization. It establishes safety objectives, accountability lines, emergency response, and SMS documentation requirements.
Safety Risk Management (SRM) is the proactive identification + assessment + mitigation of hazards. Every operational change — new aircraft type, new route, new training curriculum — runs through SRM. Hazards get logged in a register; risks get scored via a 5×5 matrix (likelihood × severity); mitigations are designed, implemented, and verified.
Safety Assurance (SA) is the reactive + continuous monitoring layer. Anonymous safety reports (ASAP), FOQA data analysis, internal audits, and management-review meetings all feed SA. The goal: catch hazards the SRM process missed.
Safety Promotion (SP) is the cultural layer — training, communications, recognition. Every employee should be able to articulate the safety policy and know how to file a hazard report. Just-culture investigations (consequence-free for honest mistakes; accountable for willful violations) are part of SP.
- •Safety Policy — written, executive-signed, organization-wide
- •Safety Risk Management — proactive hazard identification + 5×5 risk matrix
- •Safety Assurance — reactive monitoring + audits + ASAP reports + FOQA
- •Safety Promotion — training, communication, just-culture investigations
Implementation timeline (Part 121)
Part 121 SMS implementation follows a phased rollout that the FAA validates quarter by quarter:
- •Months 0-3: Gap analysis. Where are you today vs. each SMS component requirement?
- •Months 3-6: Safety Policy + Accountable Executive designation. Documentation in place.
- •Months 6-12: SRM process documented + tested. First hazards through the 5×5 matrix.
- •Months 12-18: SA monitoring online. FOQA data collection started; ASAP MOU signed with FAA.
- •Months 18-24: SP training rolled out across the org. Just-culture policy active.
- •Months 24+: Full operation. Quarterly POI reviews; annual SMS effectiveness assessment.
Hazard reporting workflow
Anonymous reporting is the heart of effective SMS. Pilots, mechanics, dispatchers, and instructors should be able to file a hazard report in under 2 minutes without identifying themselves. The report goes into a triage queue where a Safety Manager assigns severity + likelihood (5×5 grid), proposes mitigation, and tracks closure.
The 5×5 risk matrix scores risk as likelihood × severity, yielding a 1-25 cell. Cells 15+ require immediate executive notification; cells 10-14 require mitigation plan within 30 days; cells 5-9 are tracked; cells under 5 are acknowledged. The matrix is operator-tunable but the framework is FAA-standard.
FOQA (Flight Operations Quality Assurance) data feeds the reactive side. CSV ingestion from FOQA platforms (CEFA, GE Aerospace, Honeywell) creates hazard reports for trending — same severity classification, automated source. The Safety Manager reviews FOQA-trending reports weekly.
What SMS software actually needs
Most SMS tools on the market are pure-document-storage — binders with web search. They miss the workflow that actually drives effective SMS: hazard reports flowing into the triage queue, risk scoring with a live 5×5 grid, mitigation tracking from open to closed, FOQA CSV ingestion, anonymous reporter protection under Part 5.71, audit-grade log of every safety action.
AviationAlley's safety module ships these flows. The /app/safety surface is the Safety Manager's dashboard: anonymous reporting form, triage queue, 5×5 risk matrix, FOQA CSV ingestion, fatigue self-report integration (high-risk fatigue auto-creates HAZARD entries anonymously), corrective-action tracking, audit trail. Optional reveal-flow under Part 5.71 lets the Safety Officer follow up confidentially while keeping the public register anonymous.
Common implementation pitfalls
The #1 SMS implementation failure: treating it as documentation, not operations. Operators that build the binder + train once + walk away fail their first FAA SMS effectiveness assessment. SMS only works when hazard reports flow continuously and management reviews are quarterly, not annual.
The #2 failure: not protecting anonymity. Reports get filed anonymously, then the Safety Manager (with the best intentions) reveals the reporter to follow up. This kills the reporting culture. Part 5.71 has explicit confidentiality protections — use them, document the reveal-flow process, and only de-anonymize via formal request.
The #3 failure: weak just-culture. If pilots think a hazard report will get them disciplined, they won't file. The Safety Policy must explicitly distinguish honest mistakes from willful violations, and HR / Operations must honor that distinction in actual investigations.
Frequently asked questions
Are training centers (Part 142) required to have SMS?
Most newer Part 142 certificates require SMS as a condition of certification, even though Part 5 itself doesn't strictly mandate it. Best practice: implement SMS regardless of mandate — it's the standard FAA inspectors expect, and it's the same framework airline customers will ask about during vendor selection.
What's the difference between SMS and FAA SAS?
SAS (Safety Assurance System) is the FAA's own internal program for surveillance of operators. SMS is the operator's own program. SAS audits SMS; SMS does the day-to-day work. The two are complementary but distinct.
Can SMS reports be subpoenaed?
Generally protected under 49 USC 40123 (the safety-information protection statute). But protection isn't absolute — operators should consult legal counsel before relying on this in any specific investigation. AviationAlley's reveal-flow audit log captures every access to anonymous reports for legal defense if needed.
Does AviationAlley meet Part 5 SMS software requirements?
Yes for the operational workflow — hazard reporting, 5×5 matrix, FOQA ingestion, corrective action tracking, audit log. Operators still need their own written Safety Policy + Accountable Executive designation (we can't sign that for you). The PART_5 software ecosystem requires both the platform + the operator's organizational commitment.
Related guides
FAR Part 117 explained: pilot duty + rest rules for Part 121 air carriers
FAR 117 is the rule that caps how much a Part 121 pilot can fly in 24-hour, 7-day, 28-day, and annual windows. This is the practical guide for chief pilots, schedulers, and crew planners.
How to set up a 14 CFR Part 142 training center
Part 142 is the FAA certificate for sim-based training centers — separate from Part 141 schools and Part 121 airlines. This is the practical guide to setting one up, from the FSDO meeting to the first NSP evaluation.
Rolling out an Advanced Qualification Program (AQP)
AQP under 14 CFR Part 121 Appendix Y is the modern alternative to traditional Part 121 training. This is the practical rollout guide — when AQP makes sense, what it requires, and how to operationalize it.