The Short Version

If your Part 135 operating authority predates May 28, 2024, you owe the FAA two things by May 28, 2027. You have to develop and implement a safety management system (SMS) that meets 14 CFR Part 5, and you have to submit a declaration of compliance saying you did. That's the entire obligation for the existing-operator population.

If you were certificated after May 28, 2024, or your application is pending, you're on a different track: your SMS is validated as part of the certification process rather than the 2027 deadline. Section 1 below explains this further and everything else on this page explains what's required, based on the regulation, section by section, with the citation next to it so you can go read it yourself.

If you operate only a few aircraft and have fewer than ten pilots and you haven't started, you aren't behind the industry. You're behind the calendar and the goal of this guide is to help you get back on timeline.

f you'd rather have someone independent tell you where you stand, that's the SMS gap analysis.

1. Who this applies to, and who it does not

On April 26, 2024, the FAA published a revision to 14 CFR Part 5 that took effect on May 28, 2024. Before that, Part 5 applied to the Part 121 airlines and nobody else. Now it applies to: anyone holding or applying for a Part 119 certificate authorizing Part 135 operations, anyone holding or applying for a §91.147 letter of authorization for commercial air tours, and certain Part 21 manufacturers. That's the entire list. It doesn't matter what size fleet you operate, how much revenue you generate, or how complex your operations is. One airplane and one certificate puts you in scope the same as thirty airplanes.

If you were authorized before May 28, 2024, your dates come from §5.9(a). Develop and implement by May 28, 2027. Submit the declaration of compliance by May 28, 2027.

If you applied for your certificate on or after May 28, 2024, §5.9(b) puts your SMS inside the certification process rather than on the 2027 clock. Your SMS gets validated as part of getting certificated.

If you hold an SMS Voluntary Program acceptance letter, your letter stays valid, but it does not get you off the hook. The FAA's position is that Part 135 holders with an SMSVP letter still have until May 28, 2027 to meet the new Part 5 requirements. If you built to the old voluntary standard, you have revision work to do, not nothing.

If you hold both a Part 135 certificate and §91.147 air tour LOAs, you build one SMS and submit one declaration covering both. You do not run two systems.

If you are a Part 91 subpart K fractional operator, this rule does not apply to you. Subpart K does not appear in §5.1. Fractionals are eligible to participate in the FAA's voluntary SMS program, which is a different thing. That program does carry dates of its own: participants not otherwise regulated under Part 5 had until May 28, 2025 to update an accepted SMS to the revised Part 5 standard in order to stay in the program.

If you are a Part 145 repair station, there is no FAA rule requiring you to have an SMS. If you are an EASA Part 145 certificated repair station located in the United States, a special condition under the FAA-EASA maintenance agreement requires an SMS meeting at least Part 5, and participating in the FAA voluntary program satisfies it. That is a bilateral agreement obligation, not a Part 5 mandate, and the two get conflated constantly.

If you are a Part 91 flight department or a Part 141 school, Part 5 does not reach you solely because you operate under those parts. Check for a §91.147 LOA before you conclude you are out, because an air tour authorization puts you in scope with no Part 135 certificate involved. Many operators in both categories are building voluntary programs anyway, usually because a customer or an insurer asked.

2. Three things almost every guide gets wrong

Before we get into what you have to build, I want to clear three things out of the way, because if you've been reading about this online you've probably absorbed at least one of these and each one will cost you either money or time.

First of all, there is no implementation plan requirement for Part 135. You'll find a lot of pages telling you that implementation plans were due to the FAA on November 28, 2024, and that the agency reviewed and approved them through November 2025. Some of those pages will then tell you what to put in yours. However, according to §5.9. there isn't any mention of an implementation plan.

If you want to get into the weeds, the implementation plan requirement is in §5.19, and §5.19 only gets invoked by §5.11, §5.13, and §5.15, which are the Part 21 manufacturer sections. November 28, 2024 is the date in §5.11(b) and §5.15(b)(2). It belongs to production certificate holders and type certificate holders, not to charter operators.

Second, nobody is going to approve your SMS. This is the part that I think surprises most operators on the existing-operator track. I'm not talking about new applicants, whose SMS is validated by the FAA during the certification process. This is for everyone already holding a certificate: the FAA has said plainly that they will not review your SMS before you implement it.

You develop it, you implement it, you validate your own compliance with Part 5, and then you submit the declaration. Your local office might contact you about this or it might not. The FAA's own guidance says the first communication you get about SMS might be your certificate management team asking for a copy of your processes and procedures ahead of surveillance.

After your declaration comes in, the FAA updates your organization's status in its internal tracking, and your SMS gets validated as part of scheduled surveillance using the oversight data collection tools. That means there isn't an inspector who is going to sit down with you, look at your program, and tell you that you're done. There is no approval letter from the FAA and that's the entire reason why it helps to have someone conduct an independent review for you.

Third, the declaration of compliance includes four pieces of information. (1) Your organization's name and certificate number, (2) your physical address, (3) a statement that you have developed and implemented an SMS meeting Part 5, and (4) the signature of your accountable executive or another senior member of management.

That's it. You don't file your SMS manual with it. You don't file your hazard log, your audit results, your training records, your corrective action log, or an org chart.

Under §5.9(d) you make that material available to the Administrator on request, which is a different obligation with a different trigger. I point this out because you could waste a lot of money and time if you think the declaration is a comprehensive submission package. The actual requirement is that the four sentences you sign are true, and everything else exists so that when someone asks, you can show them.

3. What "implemented" means at your size

Under §5.5(a), your SMS must be appropriate to the size, scope, and complexity of your organization, and it must include all four components: safety policy, safety risk management, safety assurance, and safety promotion.

Read that carefully, because it does two things at once. It gives you permission to be small but it doesn't give you permission to skip anything. Scalability governs depth. It doesn't govern existence. A three-aircraft operator and a regional airline both owe all four components, the difference is how much effort they need to satisfy them. So what does each of the four components actually ask for?

Safety policy. According to §5.21(a) your safety policy has to contain seven things: (1) Your safety objectives, (2) your commitment to meeting them, (3) a clear statement about providing the resources to implement the SMS, (4) a safety reporting policy defining how employees report hazards, (5) a policy defining unacceptable behavior and the conditions for disciplinary action, (6) an emergency response plan meeting §5.27, and (7) a code of ethics applying to all employees, including management and officers, stating that safety is the organization's highest priority.

Those last two items are the ones that I see missing most often, and the code of ethics is a new requirement that was added in the 2024 amendment. That means a template written for the old Part 5 won't have it. Also, if you buy a manual from someone, check for these items.

Additionally, §5.21(b) requires that your policy be signed by your accountable executive. §5.21(d) requires the accountable executive to review it regularly so it stays relevant. According to §5.25(a), the accountable executive has to meet four criteria: They are the final authority over operations conducted under your certificate, they control the financial resources for those operations, they control the human resources for them, and they retain ultimate responsibility for safety performance. It doesn't matter what your job title is, what matters is who holds ultimate decision-making authority and who is responsible for the resources necessary for safe operations.

In a two-pilot, three-aircraft operation, it's usually the owner, but if you name someone who fails one of those four criteria, then you've probably built a safety program whose accountable executive doesn't have the authority to fix what the system finds, and every downstream process inherits that defect.

§5.25(b) then puts five duties on that person: ensure the SMS is implemented and performing, develop and sign the policy, communicate it, review it regularly, and regularly review safety performance and direct action on substandard performance. That last one is a recurring obligation, not a one-time signature. Plan for it to show up on a calendar.

Safety risk management. §5.51 says that risk management happens: when you implement a new system, when you revise an existing one, when you develop operational procedures, and when your safety assurance processes turn up a hazard or an ineffective control. As an example, you have a new base of operations, you get a new aircraft type, a new contract that changes your mission profile, new scheduling software. All of these are ordinary business events for most operators, but they are also triggers.

The important thing to understand is that safety risk management is not a process that runs only after something goes wrong. §5.53 requires you to analyze the system and use that analysis to identify hazards, considering the system's function and purpose, its operating environment, its processes and procedures, the personnel and equipment and facilities it needs, and its interfaces. Keep in mind that interfaces were added in 2024, and for a small operator they're usually most of your actual risk.

Think of it this way. Your contract maintenance provider. The FBO handling your aircraft at an outstation. The broker booking your trips. The fuel vendor. You don't control any of these, but all of them can hurt you. That's why §5.55 requires processes to analyze the risk from identified hazards, a defined process for conducting risk assessment that lets you determine what risk is acceptable, processes to develop the controls the assessment calls for, and evaluation of whether the risk will be acceptable with the proposed control applied before you implement it.

The bottom line is that you need a defined process that allows you to determine acceptable risk. A matrix is one way to do that, but the regulation doesn't mandate that. Also, §5.57 is new and it says: if you identify a hazard in your operating environment, you have to notify any interfacing person who, to the best of your knowledge, could address the hazard or mitigate the risk. If your maintenance provider's process is creating a hazard and they're the ones who could fix it, you are required to tell them.

Safety assurance. This is where programs actually fail because this is the component that proves the rest of it's real, and this is the one that takes time.  §5.71(a) lists eight things your monitoring and measurement processes must include: (1) Monitoring of operational processes, (2) Monitoring of the operating environment to detect changes, (3) Auditing of operational processes and systems, (4) Evaluations of the SMS and of operational processes and systems, (5) Investigations of incidents and accidents, (6) Investigations of reports of potential non-compliance with regulations or with your own controls, (7) A confidential employee reporting system where people can report hazards, concerns, and occurrences and propose improvements without concern of reprisal, and (8) Investigations of hazard notifications you receive from outside.

The reprisal language is new as of 2024, and so is the requirement to investigate hazard notifications from external sources. §5.71(b) then requires processes to analyze the data all of that produces. §5.73 requires you to assess your safety performance against your safety objectives, including reviews by the accountable executive, in order to confirm compliance with your own controls, evaluate how the SMS is performing, evaluate whether your risk controls are actually effective and identify the ones that are not, identify changes in the operating environment that introduce new hazards, and identify new hazards. When that assessment finds an ineffective control or a new hazard, §5.73(b) sends you back through safety risk management.

§5.75 requires processes to correct the deficiencies those assessments find. The entire process is a loop: Identify, control, monitor, assess, correct, and then back around to identify and start all over. The output of that loop is the evidence that your program exists, so if your loop has only run once or twice, you probably don't have much evidence. This is the main reason why most operators are behind timeline when it comes to the May 2027 deadline.

Safety promotion. §5.91 requires you to train each individual identified in §5.23 so they attain and maintain the competencies to perform their SMS duties. §5.93 requires a means of communicating safety information that makes employees aware of the SMS policies and tools relevant to their responsibilities, conveys hazard information relevant to their responsibilities, explains why safety actions were taken, and explains why procedures were introduced or changed.

§5.93 doesn't require a newsletter. It requires that when you change something because of a hazard, the people affected find out why. You need to write down how that happens and do it the same way consistently with documentation and records. Although §5.95 requires you to develop and maintain documentation of your safety policy and your SMS processes and procedures, it  does not require an SMS manual.

I want to be clear though, because the FAA guidance is explicit that organizations commonly meet this requirement using several documents, and that organizations not required to maintain a manual system can document their SMS in a compliance statement instead.

Most Part 135 operators do maintain a manual system, so in practice your SMS documentation will often live inside the manuals you already have rather than in a new standalone volume. That's a choice available to you, not a compromise.

§5.97 sets your retention periods, and they differ by record type. Safety risk management outputs are kept as long as the control remains relevant to the operation. Safety assurance outputs are kept a minimum of five years. Training records for each individual are kept as long as that person works for you. Records of communications under §5.93 and hazard notifications under §5.57 are kept a minimum of 24 consecutive calendar months.

The five-year number is the one to plan around. Whatever system you use to hold safety assurance records, you are going to be living with it for a while. If you came from a Part 121 background or built a voluntary program years ago, most of this is familiar. However, the 2024 amendment added the following: an updated definition of hazard, the code of ethics in the safety policy, consideration of interfaces in the §5.53 system analysis, the new §5.57 hazard notification requirement, the §5.71(a)(8) requirement to investigate externally received hazard notifications, the addition of "without concern of reprisal" to the confidential reporting requirement, and the §5.97(d) retention requirement for hazard information sharing records.

4. Does the single-pilot exception apply to you?

Not if you have two pilots. But the test is more specific than most operators assume, and it's worth getting it right. §5.9(e) excepts thirteen provisions of Part 5 for organizations with a single pilot who is the sole individual performing all necessary functions in the conduct and execution related to, or in direct support of, the safe operation of the aircraft.

FAA guidance sets out four steps for working out whether that describes you. Define your organizational structure and ask whether there is more than one employee. Identify the necessary functions. Identify who performs each one. Then ask whether more than one employee performs functions that could affect the safe operation. If the answer is no, the excepted sections apply. The word carrying the weight there is functions. This isn't a headcount.

Three clarifications from FAA guidance are worth knowing precisely, because two of them are more generous than operators expect and one is stricter. 

Administrative help may not defeat the exception. Someone doing accounting, invoicing, answering the phone, or cleaning is not performing a function related to the safe operation of the aircraft, and FAA guidance says the exceptions may still apply in that situation. 

External vendors are generally not part of your organization. An FBO that fuels and tows your aircraft, or a shop that performs your annual and your unscheduled maintenance, is a contracted service provider rather than an employee. FAA guidance says that has no bearing on whether the exceptions apply. 

Maintenance coordination is the hinge. Here the guidance draws a fine line. If you personally track and coordinate the completion of maintenance and simply hire a provider to perform the work, the exception still applies. If you let the provider track or coordinate that work for you, it doesn't. The distinction isn't who turns the wrenches. It's who owns the function.

Separately, the FAA has said that a single-pilot Part 135 certificate holder with multiple employees has to meet all applicable Part 5 requirements. For a two-pilot operation this is all academic. Two pilots means two people performing flight crewmember duties, which are the archetypal necessary functions, and you are outside the exception at step one.

For the operator who does qualify, here is what §5.9(e) removes: the employee safety reporting policy and the disciplinary-conditions policy from the safety policy, the requirement to communicate the policy throughout the organization, management and employee accountability, identifying the levels of management authorized to accept risk, designating management personnel, delegating emergency authority and assigning employee emergency responsibilities, the confidential employee reporting system, safety communication entirely, and the §5.97(d) retention requirement, which by its own terms covers records of communications under both §5.93 and §5.57.

If you look carefully, every single item on that list is a clause about other people. Remove the other people and those requirements stop making sense, which is the reason the FAA carved them out. The exceptions are about internal communications and management structure, and that's all they are about.

Keep in mind that the solo operator still owes safety objectives, the resource commitment, an emergency response plan, the code of ethics, a signed and regularly reviewed policy, accountable executive designation and duties, coordination of the emergency plan with the outside organizations you interface with, all of safety risk management including the §5.57 obligation to notify interfacing persons of hazards, safety performance monitoring including auditing and evaluations and investigations of incidents, safety performance assessment, continuous improvement, training under §5.91, documentation under §5.95, and records under §5.97 with the five-year retention on safety assurance outputs.

I'd encourage you to read that again because a one-person operation still has to audit itself, evaluate its own systems, investigate its own occurrences, assess its own performance against its own objectives, and keep five years of the results. The auditor and the audited are the same person. That's the structural situation the regulation puts a solo operator in, and Part 5 doesn't require anyone from outside to resolve it.

FAA guidance is clear that a small organization can meet these requirements with simple methods, performed by the sole individual.

Our recommendation, and this is a recommendation rather than a requirement, is that an independent review is worth more to a genuinely solo operator than to almost anybody else, precisely because there is nobody inside the organization to provide the second look.

5. The calendar is shorter than the date

In the fighter pilot community we always work from the target backward. If you think about May 28, 2027, as your target, you have less time than you think. Here's why. Safety assurance isn't a document you write. It's a loop that runs. §5.71 collects data, §5.73 assesses your performance against your objectives and asks whether your risk controls actually worked, and §5.75 requires you to correct what the assessment found. Every one of those steps is retrospective. It looks at what your operation did and what your controls produced. A loop that has run once produces one data point. A loop that has run twice produces a trend of two.

You can absolutely write a safety policy, an SRM procedure, and a manual in thirty days. Plenty of operators have and plenty of vendors will sell you that. What thirty days cannot produce is the record of the system operating, and §5.9(a)(1) doesn't ask you to develop an SMS. It asks you to develop and implement one. Implemented means running.

Be careful with what you hear about how much history is required, including from me. There is no FAA rule requiring twelve months of SMS performance data before you declare. The Air Charter Safety Foundation has publicly advised operators that the FAA often expects to see more than a year of performance history, and that's a credible industry read on how oversight actually goes, but it's an industry characterization and not agency policy.

Anyone who quotes you a required number is doing the thing this page warns about in section 2. What FAA guidance does say is that implementation means using the SMS processes in your operations, and that validation happens through routine surveillance of how the system performs. That's the standard your program has to be built for.

So the practical math. If you start now (fall 2026), the loop turns a handful of times before the deadline and your declaration rests on a record of the system actually running. If you start in early 2027, that might mean submitting a declaration supported by one audit of one component and a hazard log seeded the week before. Although both declarations arrive on time, only one of them is describing something that exists.

There is one more thing about the timing that's specific to this rule. Because nobody reviews your SMS before you implement it, you won't find out you built it wrong when it's convenient for you. You'll find out during surveillance, which happens after you've already signed the attestation. That's why you need to start now, because time is the one input you can't buy back later at any price.

6. What you file, and what you keep

These are two different obligations with two different sizes, and confusing them is the most common way operators overscope this project.

What you file.  One document, containing four things: your organization's name and certificate number, your physical address, a statement that you have developed and implemented an SMS meeting the requirements of Part 5, and the signature of your accountable executive or another senior member of management. It goes to your local FAA office and that's it. There is no cover package, no manual submission, no evidence binder attached.

The four sentences are small but the standard behind them is not. Your accountable executive is signing a legal attestation about a federal requirement. Before that signature goes on paper, that person should be able to say what your safety objectives are, when they last reviewed safety performance, and what the last thing was that the system found and fixed. If they can't, the declaration is premature regardless of what the manual says.

What you keep. §5.9(d) requires you to make available to the Administrator, on request, all the information and data demonstrating that you have an SMS meeting Part 5. That's the real obligation, and unlike the declaration it's continuous: §5.9(c) ties it to the whole period during which you remain authorized under Part 135 or §91.147. §5.95 requires you to develop and maintain documentation of two things: your safety policy, and your SMS processes and procedures. Not an SMS manual, which Part 5 does not require. You just need documentation, which can live across the manuals and records you already keep.

§5.97 sets retention, and the periods differ by record type in a way that matters for how you store things. Safety risk management outputs are kept as long as the control remains relevant to the operation, which for some controls means indefinitely. Safety assurance outputs are kept a minimum of five years. Training records for each individual are kept as long as that person works for you. Records of communications under §5.93, and of hazard notifications under §5.57, are kept a minimum of 24 consecutive calendar months.

The practical version means that you build an evidence index while you build the program, not afterward. One page that says where each category of record lives and who can produce it. When a request comes, the difference between an operator who looks organized and one who looks like they are improvising is entirely whether that page exists. And once your SMS starts operating, retain what it generates according to §5.97 from that point forward, not from the date you declare. Those records are the only proof you will ever have that the system was running before you said it was.

7. What happens after you declare

Not much, immediately, and that's the part that most operators find hardest to plan around. When your declaration arrives, your certificate management team updates your organization's status in an internal FAA database noting that you have an SMS meeting Part 5. Your SMS then gets validated as part of scheduled surveillance, using the oversight data collection tools your team already uses for everything else. The FAA has said that affected organizations may or may not receive specific contact from their local office about the new requirements, and that the first communication you get about SMS could be your team asking for a copy of your processes and procedures ahead of surveillance.

There is no validation visit that your declaration triggers. Nobody schedules an appointment because you filed. If you build your project plan around a review date, you are planning around an event that doesn't exist. What this actually changes is the character of your relationship with your certificate management team. Before, your SMS was invisible to them. After, it is on their list, and the questions they ask during normal surveillance now include it. There are two things you should take away from this:

(1) Organize your program so a Part 5 reader can navigate it. Your manual doesn't have to mirror the regulation section for section, and nothing requires it to. But an inspector working from a data collection tool built around Part 5 is going to look for specific things, and if your documentation is organized around your operation rather than around the requirement, they will have to hunt.

When the FAA extended Part 5, it modified the system performance data collection tool used in surveillance to carry four new elements corresponding to the four SMS components, and folded the accompanying inspector instructions into Order 8900.1 Volume 17. Your program will be looked at through a Part 5-shaped lens whether or not it is organized that way. A cross-reference showing where you satisfy each Part 5 requirement costs you an afternoon and makes that conversation short. FAA guidance discusses exactly this device under the name compliance statement, and provides sample formats for organizations that do and do not maintain a manual system. It isn't required of an existing operator, but it is the cheapest thing on this page relative to what it saves you.

(2) Understand what the SMS does not do for you. FAA guidance states plainly that an SMS is not a substitute for compliance with other federal regulations, and that SMS requirements are in addition to existing statutory and regulatory obligations. Your safety risk management process finding a hazard does not authorize you to keep operating with it. If your system surfaces something that's also a regulatory violation, you have two problems, and the SMS doesn't resolve the first one.

8. What you actually need to buy

There are four ways to get from here to a working SMS, and the right answer depends almost entirely on one question: who is running this in month fourteen? Everyone focuses on building the SMS, but the problem is once you build it, the system has to keep running for as long as you hold the certificate, because §5.9(c) says you maintain the SMS as long as you are authorized to operate. You have four options:

Do it yourself. This seems like the cheapest in cash, but it's arguably the most expensive in terms of the hours of the people who could be flying or selling. DIY works when somebody in your organization has run an SMS before and has the discipline to keep the loop turning after the interesting part is over. If you choose DIY and have zero experience running an SMS, you might not know that what you built was wrong until it's too late.

Buy a build, then operate it yourself. You hire someone or a company to write an SMS for you. You get a program shaped to your operation and you own it afterward. The failure mode is predictable and I've seen it happen: the consultant leaves or you get the product and then the company has no obligation to you after that. Not long after that the audits slip, the hazard log goes quiet, and eighteen months later you have a manual describing a system that isn't running. If you choose this path, don't ask for a better manual. Ask for a defined operating rhythm that you can actually hold, and a check-in after six months.

Hire a safety manager. This is arguably the right answer above a certain size and the wrong one below it. At three aircraft you're creating a full-time position for work that doesn't fill a full-time week, and a single point of failure whose vacation stops your program.

Buy the operating layer. Someone outside your organization carries the recurring work: the audits, the assessments, the corrective action follow-up, the record. You keep the accountable executive role, because §5.25(a) doesn't let you outsource it. This is the model that fits the two-to-fifteen aircraft operator best, and the thing to check before signing is what happens when the assigned person leaves.

When it comes to manuals and software: Two specific warnings, because both purchases get mistaken for the whole project. A manual satisfies §5.95, which requires you to document your safety policy and your SMS processes and procedures. That's one requirement out of roughly two dozen. Custom Part 5 manuals and standalone compliance audits are real products sold by competent people, and there's nothing wrong with either of them. However, manuals and audits aren't the same as an implemented SMS, and an operator who buys one and stops has spent real money to satisfy the smallest obligation in the rule.

Software is genuinely useful and it's not the system either. Good software takes in reports, holds your risk assessments, tracks corrective actions to closure, and leaves an evidence trail somebody can follow. What it can't do is decide anything. It won't accept a risk, it won't conduct your performance assessment, and it won't be your accountable executive.

The question to ask any vendor, in any of these categories, is simple. Show me what my program looks like in month fourteen, and tell me who does each thing on that list.

Whichever of the four paths you choose, the first step is the same: find out precisely what you have and what you're missing. That's the SMS gap analysis, and it's the right first purchase no matter who does the building.

9. Where this actually goes wrong

I have spent years reading accident investigations and one of the things that I've noticed is that when it comes to Part 135 mishaps, in most cases someone in the organization saw the information. They knew there was a risk or a problem, but they either normalized deviations from the rule that was keeping them safe or they turned the risk into a process that forced a decision. That's the failure that Part 5 exists to prevent, and these are the patterns that produce it.

The accountable executive who is not. Somebody names the chief pilot because the chief pilot handles safety. The chief pilot doesn't sign the checks or do the hiring, so when the system identifies a problem that costs money to fix, it goes to a person with no authority to spend. §5.25(a) sets four tests for a reason, and all four are about authority.

A reporting system with nothing in it. An operator stands up a reporting process, tells everyone about it once, and gets no reports. Six months later they conclude the operation doesn't have any hazards. What they actually have is a system nobody trusts or nobody remembers, and either way the input side of their SMS is dead. If reports aren't coming in, that's your first finding, not your first success.

Corrective actions that close without anyone checking. This one is nearly universal. A problem gets identified, a fix gets implemented, the item gets marked closed. Nobody ever goes back to see whether the fix worked. §5.73(a)(3) requires you to evaluate the effectiveness of your risk controls and identify the ones that are not working, and §5.75 requires you to correct the deficiencies that assessment finds. A closure without verification satisfies neither. It just makes the log look tidy.

Risk acceptance sitting in the wrong chair. §5.23(b) requires you to identify the levels of management with authority to accept safety risk. Nothing prohibits a formally authorized safety manager from holding some of that authority. But FAA guidance is direct that the designated management representative facilitates hazard analysis rather than owning it, is not expected to make risk-based decisions, and that the operational managers and process owners must be the ones accountable for risk acceptance. When the authority drifts informally onto whoever handles safety, the person deciding is usually not the person who owns the consequences.

Airline architecture sold as the federal requirement. You might be told that you need a five by five risk matrix, a formal Internal Evaluation Program, a procedure titled Management of Change, and risk driven as low as reasonably practicable. However, be precise about what's actually required here, because the truth is split. Part 5 doesn't prescribe a five by five matrix. FAA guidance offers a sample matrix, notes that it may be qualitative or quantitative, and warns against over-engineering it. Part 5 does not use "as low as reasonably practicable" (ALARP), and it doesn't contain a procedure called Management of Change, but the underlying functions are required.

§5.71(a)(4) expressly requires evaluations of the SMS and of operational processes and systems, and §5.51 requires safety risk management whenever you implement a new system, revise an existing one, or develop operational procedures, which is most of what a change-management process is for. The mistake isn't using these tools, because several of them are good. The mistake is a vendor telling a three-aircraft operator that a particular branded, airline-scale implementation of a requirement is itself the federal requirement. You end up building machinery you can't sustain, and you get false precision: a matrix assigning a likelihood of 3 to something you have no data about, producing a number that looks like analysis and is not.

The interfaces nobody owns. Your contract maintenance provider. The FBO handling your aircraft away from home. The broker filling your seats. You don't control any of them and every one of them can hurt you. §5.53(b)(5) requires your system analysis to consider interfaces, and §5.57 requires you to tell an interfacing person when you find a hazard they could address. For an operator your size this isn't a corner of the program. It's most of your exposure.

None of these patterns are exotic and none of them require a bad operator. They're what happens when a safety program is built to satisfy a requirement instead of to answer a question. The question is whether your operation is doing something today that will look obvious in an investigation later. Part 5 is just a structure for asking it on a schedule.

10. Start here: the first thirty days

If you haven't begun, here's what to do before you spend any money. All of this is free and none of it requires a vendor.

Read Part 5. The whole thing runs about ten pages. Nothing on this page substitutes for having the regulation in your own head, and once you read it you'll be able to tell immediately which SMS vendors have and which ones are working from a summary.

Name your accountable executive in writing. Run the four tests in §5.25(a). Final authority over operations, control of the money, control of the people, ultimate responsibility for safety performance. In most operations the answer is the owner, but if the answer is somebody who fails one of those tests, fix that before you build anything on top of it.

Write down three or four safety objectives. Not aspirations. Things you could actually measure at the end of a quarter and know whether you achieved them. §5.21(a)(1) requires them and §5.73(a) makes you assess your performance against them, so vague ones will fail you twice.

Open your hazard log today and put real entries in it. You likely already know what hazards exist in your operation. Maybe it's an airport that becomes a challenge in the winter. Maybe it's a maintenance turn that always runs late. It might even be a specific customer who always pushes. Write down the hazards. A log that starts with six honest entries from people who fly the operation is worth more than any template.

List your interfaces. Every outside organization that touches the safe operation of your aircraft. Maintenance, fuel, handling, brokers, anyone. §5.53(b)(5) is going to make you consider them and §5.57 is going to make you talk to them, and the list itself usually surfaces two or three hazards on its own.

Decide who is running this in month fourteen. Before you choose a vendor, a platform, or a path, answer that question. Every other decision follows from it and at the end of the first thirty days you'll have the four things that everything else in Part 5 attaches to: a named accountable executive, written objectives, a live hazard log, and a map of who else can hurt you.

11. Frequently asked questions