SMS and risk
DRT 343 Regulations, Safety, Risk Management and Ethics for Unmanned Aircraft Systems
Lesson
By the end of this module you will be able to
- Define hazard, safety and safety risk as in ICAO Annex 19
- Explain the four components and twelve elements of a safety management system (SMS)
- Explain the Swiss cheese model and the difference between active failures and latent conditions
- Assess risk with the ICAO Doc 9859 matrix and propose mitigations
- Calculate a simple safety performance indicator
Why this matters
Good safety does not come from waiting for accidents and then fixing things. It comes from finding hazards before events happen and managing them systematically across the organisation. A safety management system (SMS) is how aviation has done this for decades, and it is now reaching drone operations.
ICAO Annex 19 Amendment 2, applicable from 26 November 2026, extends SMS requirements to certified RPAS operators authorised for international operations. In Thailand, the 2026 CAAT notification lets CAAT request a “risk-management manual” with a Specific Category application. Organisations that fly drones regularly should have an SMS scaled to their size.
An SMS is like a hospital’s health programme. It does not just treat patients who walk in; it runs check-ups, keeps statistics, looks for common causes and trains staff, to reduce illness for everyone.
Definitions from ICAO Annex 19
| Term | Definition (summarised from Annex 19) |
|---|---|
| Hazard | A condition or object with the potential to cause or contribute to an aircraft incident or accident |
| Safety risk | The predicted probability and severity of the consequences of a hazard |
| Safety | The state in which risks of aviation activities are reduced and controlled to an acceptable level |
Note that safety does not mean “no risk”; it means risk is controlled to an acceptable level.
The four SMS components
| Component | Elements (ICAO Doc 9859, 4th ed.) | Example in a drone unit |
|---|---|---|
| 1 Policy and objectives | 1.1 Management commitment 1.2 Safety accountability and responsibilities 1.3 Appointment of key safety personnel 1.4 Coordination of emergency response planning 1.5 SMS documentation | The unit head signs the policy and appoints a safety lead |
| 2 Safety risk management | 2.1 Hazard identification 2.2 Safety risk assessment and mitigation | A hazard register for every mission |
| 3 Safety assurance | 3.1 Safety performance monitoring and measurement 3.2 Management of change 3.3 Continuous improvement of the SMS | Event statistics; review when aircraft or software change |
| 4 Safety promotion | 4.1 Training and education 4.2 Safety communication | Monthly lessons-learned meetings |
Why accidents happen: the Swiss cheese model
James Reason described an organisation as having many layers of defence, each with “holes” that shift over time. An accident happens when the holes in every layer line up and a hazard passes straight through.
- Active failures are unsafe acts by front-line staff, such as skipping the compass check. Their effect is immediate
- Latent conditions arise from decisions higher up, such as over-tight schedules, insufficient maintenance budget or no recurrent training. They lie hidden until they combine with a front-line error
The key lesson: punishing the last person in the chain does not close the holes in the other layers. Good investigations look for latent conditions too.
Assessing risk with a matrix
ICAO Doc 9859 provides example tables for risk assessment (ICAO labels them examples; organisations may adapt them).
| Probability | Value | Meaning |
|---|---|---|
| Frequent | 5 | Likely to occur many times |
| Occasional | 4 | Likely to occur sometimes |
| Remote | 3 | Unlikely, but possible |
| Improbable | 2 | Very unlikely; not known to have occurred |
| Extremely improbable | 1 | Almost inconceivable |
| Severity | Code | Example consequences |
|---|---|---|
| Catastrophic | A | Aircraft or equipment destroyed; multiple deaths |
| Hazardous | B | Large reduction in safety margins; serious injury; major equipment damage |
| Major | C | Significant reduction in safety margins; serious incident; injury |
| Minor | D | Nuisance; use of emergency procedures; minor incident |
| Negligible | E | Few consequences |
- Intolerable: take immediate action to mitigate or stop the activity
- Tolerable: can be tolerated based on mitigation; may need a management decision to accept
- Acceptable: acceptable as is
Example 1 Assessing and reducing risk
A unit inspects a road corridor near high-voltage transmission towers. The hazard is compass interference causing a flyaway. The unit’s records show this occurring sometimes, and if it happens the drone could fall onto moving traffic.
- Probability: occasional = 4; severity: hazardous = B; index 4B, intolerable. Stop or mitigate first
- Probability mitigations: calibrate and check the compass before every flight, route away from the towers, set a geofence (DRT 342 module 2). With evidence that they work, reassess probability as improbable = 2: 2B, tolerable
- Severity mitigation: shift the route so it is not over the traffic lanes; severity drops to major = C: 2C, still tolerable. Management must decide to accept the residual risk and record it
The ISO 31000 risk management process
ISO 31000:2018 defines risk broadly as “effect of uncertainty on objectives”. Its process is: scope, context and criteria → risk assessment (identification, analysis, evaluation) → risk treatment → monitoring and review, with communication, consultation, recording and reporting throughout. Aviation SMS applies the same principles with a safety focus, while SORA (DRT 342 module 5) assesses one type of operation for authorisation. The three complement each other; none replaces another.
Measuring whether safety is improving
Safety assurance needs safety performance indicators (SPIs), such as link-loss events per 100 flight hours:
Example 2 An indicator before and after improvement
In the first quarter a unit flew 240 hours with 3 link-loss events. After raising the station antenna and revising procedures, it flew 310 hours the next quarter with 2 events.
- First quarter events per 100 hours
- Next quarter events per 100 hours
The rate nearly halved, but the counts are very small and the difference may be chance. Track several quarters before concluding, and use leading indicators too, such as the share of flights with a completed checklist.
Class activity
Activity: Hazard register and matrix
Use core lesson G02 “Writing risks and deciding together” and exercise B02 “Evidence-based risk assessment” from the drone knowledge hub.
- Write at least 5 risks in the form “Because… … may happen, resulting in…”.
- Assess each index with the matrix in Figure 3 before and after mitigation, with owners and evidence.
- Analyse one accident report chosen by the instructor with the Swiss cheese model, separating front-line failures from latent conditions.
- Propose two SPIs for your group’s unit.
Common mistakes
Watch out
- Thinking safety means zero risk
- Lowering risk indices on paper without evidence that mitigations work
- Looking only for the last person at fault, not latent conditions in the organisation
- Using another organisation’s matrix without adapting its definitions to your own work
- Drawing trends from a handful of events
Summary
- Annex 19 defines safety as risk controlled to an acceptable level, not zero
- An SMS has 4 components and 12 elements: policy (5), risk management (2), assurance (3) and promotion (2)
- The Swiss cheese model separates front-line failures from latent conditions; accidents happen when holes in every layer line up
- The ICAO Doc 9859 matrix combines probability 1–5 with severity A–E into intolerable, tolerable and acceptable regions
- SPIs such as events per 100 flight hours track whether safety is improving
Check your understanding
- According to ICAO, how does a hazard differ from a safety risk?
- Which SMS component contains the element “management of change”?
- Which region of the matrix is index 3A in?
- A unit flew 500 hours and recorded 4 GNSS anomalies. What is the rate per 100 hours?
- A roster that makes pilots work until fatigued: active failure or latent condition?
Answers
- A hazard is a condition or object that could cause an event; safety risk is the predicted probability and severity of the consequences of that hazard
- Safety assurance
- Intolerable
- per 100 hours
- A latent condition, because it comes from an organisational decision and lies hidden until it combines with a front-line error
Key formulas
| Risk index (ICAO Doc 9859): probability followed by severity code | |
| Events per 100 flight hours |
Key references
- International Civil Aviation Organization. (2016). Annex 19 to the Convention on International Civil Aviation: Safety management (2nd ed.). link
- International Civil Aviation Organization. (2018). Safety management manual (Doc 9859, 4th ed.). link
- Reason, J. (1997). Managing the risks of organizational accidents. Ashgate.
- Reason, J. (2000). Human error: Models and management. BMJ, 320(7237), 768–770. link
- International Organization for Standardization. (2018). Risk management – Guidelines (ISO 31000:2018). link
- Joint Authorities for Rulemaking on Unmanned Systems. (2024). JARUS guidelines on Specific Operations Risk Assessment (SORA), main body, edition 2.5 (JAR-DEL-SRM-SORA-MB-2.5). link
- สำนักงานการบินพลเรือนแห่งประเทศไทย. (2569). ประกาศ กพท. เรื่อง หลักเกณฑ์และวิธีการในการอนุญาตให้ผู้บังคับหรือปล่อยอากาศยานซึ่งไม่มีนักบิน ประเภทอากาศยานที่ควบคุมการบินจากภายนอก ที่มีน้ำหนักไม่เกิน 25 กิโลกรัม ปฏิบัติแตกต่างไปจากเงื่อนไขที่กำหนด พ.ศ. 2569 (มีผล 17 พฤษภาคม 2569). link
Further reading
Study the assigned knowledge units in advance, review media and take the module quiz
Safety management systems (SMS)
The SORA methodology
Writing risks and deciding as a team
Evidence-based risk assessment
In class / field
Lecture, case discussion and in-class problem solving
Learning evidence: Quiz results and submitted exercises