In-House SMS Build vs Purpose-Built Aviation Safety Software

Proportionate does not mean partial

A small aerodrome may have few movements, a compact team and managers who hold several responsibilities. Copying the SMS manual of a major international airport can create dozens of committees, reports and specialised roles that do not exist. The result looks complete but operates only before an audit.

The opposite response—treating SMS as unnecessary bureaucracy because the operation is small—is equally unsafe. Low traffic does not remove runway incursions, wildlife, works, fuel, emergency, vehicle, contractor or change risk. It may also mean fewer events from which to detect a trend.

Oman's CAR 100 establishes SMS requirements for approved or certified organisations and states that the system should correspond to organisational size and the nature and complexity of activities, considering inherent hazards and risks. Proportionality changes how the elements are delivered, not whether the safety outcomes exist.

Start with obligations and the operating picture

Confirm which approvals, certificate conditions, Civil Aviation Regulations, aerodrome manual provisions and accepted procedures apply. Oman CAA's aerodrome certification service lists the aerodrome manual, emergency plan, SMS, organisational structure, rescue and firefighting manual, security programme, surveys and charts among required material for certification.

Then describe the real system:

• operating hours and traffic mix;
• runway, taxiway, apron and access configuration;
• aircraft, vehicles and people using each area;
• air traffic and communication arrangements;
• rescue, firefighting and medical capability;
• fuel, ground handling and maintenance providers;
• wildlife, weather, terrain and obstacles;
• planned works and foreseeable operational changes;
• dependencies on contractors, neighbouring airports and emergency services.

The SMS should control this picture. Do not begin by filling a generic twelve-element template with policy text.

A lean role model

One person may hold more than one title. Accountability still needs separation where judgement could be compromised.

Role	Minimum responsibility
Accountable manager	Owns safety performance, accepts risk within authority and provides resources
SMS coordinator or safety manager	Maintains processes, facilitates risk work, analyses data and reports performance
Operational owner	Owns hazards, controls and corrective action in the operation
Independent reviewer	Tests implementation and effectiveness without reviewing their own work
All personnel and contractors	Report hazards, follow controls and stop unsafe activity

The SMS coordinator does not own every operational risk. If the same person operates the aerodrome and coordinates the SMS, define when another competent person reviews their risk assessment, investigation or closure decision. Independence can come from a trained colleague, group safety function, reciprocal peer review or qualified external specialist.

ICAO's safety management FAQ notes that there is no prescribed minimum headcount for an SMS and that people in a small organisation may combine roles. The organisation must still demonstrate competence and an effective system.

Use one short workflow from signal to learning

Small organisations are harmed by separate forms for hazard reports, incidents, inspections, audits, meetings and actions. Use one intake and route it according to the evidence.

1. Record: what happened or could happen, where, when and immediate controls.
2. Triage: identify urgency, notification requirements and responsible owner.
3. Assess: describe hazard, credible consequence, existing controls and residual risk.
4. Decide: accept, mitigate, suspend, escalate or investigate within defined authority.
5. Act: assign a named person, due date and required evidence.
6. Verify: confirm the control is implemented and works.
7. Learn: update procedures, training, risk registers and relevant parties.

Urgent notification and emergency response should never wait for completion of the workflow. Build those triggers into the first screen and the duty checklist.

Keep the hazard register operational

A useful register is not a catalogue of generic airport hazards. Each entry should connect:

activity → hazard → credible consequence → existing controls → control owner → assurance evidence → residual risk → further action

Prioritise the few hazards that can change an operational decision. Review them after occurrences, inspections, seasonal changes, works, new aircraft or operators, staffing changes and emergency exercises.

Avoid cloning risks for every report. Link occurrences and findings to the underlying hazard so recurrence becomes visible. Retain location-specific detail: wildlife on one runway end, an access-control weakness at one gate, or vehicle conflict at one stand.

Reporting must fit the workforce

Provide a fast channel for staff and contractors to record a hazard from the field. Ask for plain facts, location, time, immediate action and optional media. Do not require the reporter to select a formal risk score or determine root cause.

CAR 100 requires a safety policy supporting non-punitive reporting while identifying boundaries such as gross negligence and wilful misconduct. Put that policy into practice by restricting personal information, defining who can see reports, acknowledging receipt and explaining what changed.

At a small aerodrome, anonymity can be difficult even when names are hidden. Avoid unnecessary personal detail in committee packs and dashboards. Focus discussion on system conditions and behaviour evidence.

Assurance without a permanent audit team

Assurance should answer whether critical controls are present, suitable, operating and effective. The ICAO APAC aerodrome SMS evaluation guidance uses that progression to assess maturity.

Build a compact annual plan from risk rather than dividing the manual into equal audit sections. Examples include:

• routine runway and movement-area inspection records;
• airside driver and vehicle authorisation sampling;
• wildlife-control response and trend review;
• rescue and firefighting checks and exercises;
• contractor permits and works handbacks;
• occurrence reporting and feedback timeliness;
• change assessments and post-implementation review;
• high-risk action closure and effectiveness.

Combine methods: observation, record sampling, interviews, exercises and trend review. Rotate peer reviewers where independence is limited. One deep review of a critical control is worth more than ten checklist audits that confirm documents exist.

Choose indicators that work with small numbers

Rare events and low exposure make monthly percentages unstable. Do not create a dashboard full of zeroes and declare the operation safe.

Use a balanced set:

• significant occurrences and precursors, reviewed individually;
• runway or airside deviations with movement or vehicle exposure;
• repeat hazards and findings;
• time to acknowledge and assess reports;
• overdue high-risk actions;
• critical-control checks completed and failed;
• emergency exercise actions verified;
• reporting distribution across staff and contractors;
• data completeness and late records.

Show counts and exposure together. Use rolling periods where statistically sensible, but never allow aggregation to hide an urgent event. The accountable manager's review should record decisions, not merely note the numbers.

Make meetings proportionate too

A small aerodrome may not need separate weekly working groups and monthly boards. It does need the functions those meetings provide.

A single structured safety meeting can review:

1. urgent events and regulatory notifications;
2. top risks and control health;
3. operational changes and works;
4. overdue or blocked actions;
5. performance indicators and data confidence;
6. resources and decisions required;
7. communication back to personnel.

Set frequency according to operations and change. Convene exceptional review when triggers occur. Record attendees, evidence, challenge, decisions, owners and due dates.

Control contractors as part of the aerodrome system

Outsourcing does not remove the hazard. Include contractors in induction, reporting, emergency arrangements, competence records, permit controls and safety communication. Define which occurrence information they provide, how quickly, and who owns joint investigations.

CAR 100 addresses subcontracted entities and requires relevant instructions within the organisation's SMS. The airport should be able to see contractor actions and recurring deviations in the same risk picture as employee activity.

Manage change with a threshold, not a thick form

Create a short screening test. A formal assessment is triggered when a proposal could affect operating procedures, infrastructure, traffic, protected areas, emergency response, staffing, competence, contractors, equipment, interfaces or regulatory compliance.

Scale the assessment to the risk. Repainting an office and introducing a new aircraft type do not need the same document. Both need a recorded screening decision. For material changes, define assumptions, hazards, controls, acceptance authority, communication, readiness evidence and post-implementation review.

The evidence pack for an effective small SMS

A regulator or accountable manager should be able to trace:

• current policy, objectives, roles and competence;
• applicable obligations and accepted manual content;
• live hazard register and risk decisions;
• occurrences, notifications and investigations;
• assurance plan and completed checks;
• indicators, triggers and review decisions;
• changes and readiness evidence;
• actions from origin through effectiveness verification;
• safety communication and staff feedback;
• document changes and approval history.

Keep one source of truth and a simple index. Duplicate spreadsheets create more administration while weakening traceability.

Build a twelve-month implementation sequence

A small aerodrome should not try to perfect every SMS element simultaneously. Sequence the work so early controls support later analysis.

Months 1–2: establish accountability and scope

Confirm applicable requirements, certificate conditions and accepted manuals. Appoint the accountable manager, SMS coordinator, operational owners and independent review arrangement. Describe the operation, interfaces and outsourced services. Approve the safety policy, reporting protections and risk-acceptance authority.

The output is a short implementation register showing requirement, present arrangement, gap, owner, evidence and target date. Avoid scoring maturity before the organisation agrees what evidence would demonstrate it.

Months 3–4: make reporting and risk decisions work

Launch one accessible hazard and occurrence channel. Define urgent notification rules, triage, investigation thresholds and feedback. Establish the risk method using aerodrome-relevant consequence examples. Build the first live hazard register from workshops, inspections, occurrences, emergency planning and staff knowledge.

Test the process with historical or hypothetical scenarios. Can the duty team identify who to call? Can the accountable manager see which risks exceed local authority? Can a contractor report without access to an internal desktop system?

Months 5–6: connect actions and change

Move corrective actions into one controlled register. Define closure evidence and effectiveness review. Introduce a change-screening form and apply it to current works, equipment, staffing, routes and procedures. Review open projects rather than waiting for the next new change.

Months 7–9: build assurance and performance review

Create the risk-based assurance plan, conduct the first independent samples and correct weaknesses. Select a small indicator set linked to objectives and top risks. Establish the safety meeting and accountable-manager review with structured decisions.

Months 10–12: test and improve

Run an emergency or operational exercise, sample the full chain from report to verified action and conduct a proportionate SMS self-assessment. Seek staff and contractor feedback. Update the manual to reflect the system that actually operates.

Implementation is complete only in the limited sense that a repeatable cycle exists. The SMS itself continues to learn and change.

Define competence by task, not job title

“Safety trained” is too vague. Build a small competence matrix around decisions and activities:

• occurrence triage and mandatory notification;
• hazard identification and risk facilitation;
• risk acceptance;
• investigation and evidence preservation;
• aerodrome inspection and defect escalation;
• change assessment;
• emergency response role;
• assurance or internal review;
• safety data analysis;
• contractor and permit control.

For each competence, state required knowledge, practical skill, assessment method, assessor and renewal trigger. Experience at a large airport does not automatically confer competence for a small aerodrome's local procedures and interfaces.

Where expertise is rarely needed—human factors investigation, complex obstacle assessment or specialist wildlife analysis—maintain an approved support route. The SMS coordinator must know when to escalate and how quickly assistance can be obtained.

Test deputies. Small teams are vulnerable when the only trained person is on leave. A responsibility chart without competent coverage is not resilience.

Set risk acceptance authority that fits the organisation

The risk matrix should lead to a decision, not merely a colour. Define who can accept each residual-risk level, for how long and with what review.

An operational supervisor may accept a low, routine residual risk within an approved procedure. The accountable manager may accept higher risk subject to resources and monitoring. Risk outside organisational authority may require Oman CAA engagement or a change to the operation. The precise boundaries must follow applicable and accepted arrangements.

Temporary acceptance needs an expiry date and interim controls. Avoid “tolerable” risks that remain unchanged for years. Review when assumptions change, controls fail, exposure increases or new evidence appears.

Record dissent and uncertainty. A low-frequency operation may lack data to estimate likelihood confidently. Use conservative judgement, credible scenarios and specialist input rather than forcing false numerical precision.

Design investigations for the event, not for form completion

Define investigation levels. A low-consequence event with a known local cause may need a brief review and action. A serious, novel, repeated or high-potential occurrence needs formal evidence preservation, competent analysis, management review and any required external notification.

A proportionate investigation should establish:

• what happened and the reliable timeline;
• immediate actions and current exposure;
• task, environment and organisational context;
• controls expected, present and effective;
• human and system factors;
• actual and credible consequences;
• related events, hazards and changes;
• corrective or preventive decisions;
• how effectiveness will be verified.

Do not end with “operator failed to follow procedure”. Ask whether the procedure was available, workable, understood and reinforced; whether supervision, equipment, workload or local conditions shaped the action; and how the system detects recurrence.

Protect original evidence and maintain classification history. If an occurrence is reclassified, record who changed it and why.

Use emergency exercises as SMS evidence

An exercise is not successful because participants attended and the scenario ended. It should test defined capabilities and produce observable evidence.

Select objectives such as alarm transmission, command transfer, access route, agency communication, passenger accountability, disabled-aircraft coordination or recovery of normal operations. Assign evaluators who do not perform the activity being assessed. Time critical steps and capture decisions, not just photographs.

Classify findings by operational significance. Link each to the relevant hazard, emergency-plan control and action. Verify effectiveness through a targeted re-test where appropriate. Feed lessons into training, agreements, maps and change assessments.

Small aerodromes often depend heavily on external emergency services. Confirm contacts, access, equipment compatibility, terminology and responsibilities with those organisations. A memorandum or phone list is not proof that the interface works.

Integrate wildlife, works and inspections into one risk picture

Operational programmes often live in separate files even though they affect the same hazards. Bring their evidence into the SMS.

Wildlife records should connect species, location, time, conditions, dispersal, strike evidence and habitat action to movements and seasonal trends. Works permits should connect change assessment, contractor competence, worksite inspection, handback and occurrence. Aerodrome inspections should connect defects to restrictions, work orders, risk and closure.

This makes control degradation visible. Repeated standing water, vegetation observations and bird activity may collectively indicate a drainage and habitat risk that no single checklist reveals. Repeated temporary repairs may show that an infrastructure control is becoming unreliable.

The operational owner should see the combined history without asking the safety coordinator to merge spreadsheets before every meeting.

Prepare for regulatory oversight continuously

Audit preparation should be retrieval, not reconstruction. Maintain a requirement-to-evidence map linking CAR and accepted manual obligations to procedures, responsible roles and current records.

Sample it quarterly. Can the aerodrome retrieve the latest risk acceptance, competence assessment, occurrence decision, change review and action verification? Does the evidence show the process operating, or only a blank template?

When a finding is raised, record requirement, evidence, immediate containment, cause, corrective action and effectiveness check. Closing a finding by revising a document is appropriate only if the weakness was genuinely documentary. If the process did not operate, test it in practice.

Treat regulator feedback as one input to the risk and improvement system. Link findings to existing hazards and recurring themes so leadership can see systemic weaknesses.

Budget the SMS around critical capabilities

Proportionality is not a reason to leave the SMS unfunded. The accountable manager should identify resources for training, assurance, emergency exercises, reporting access, specialist support and critical-control maintenance.

Build the case around operational risk. A shared external investigator, peer-review arrangement or simple digital workflow may be more effective than a permanent specialist role. Conversely, a high-risk interface cannot be left uncontrolled merely because the airport is small.

Track resource decisions. When an action is deferred, record the residual risk, interim control, authority and review date. The safety meeting should make resource constraints visible before they become accepted normality.

A maturity test based on behaviour

After the first year, ask practical questions:

• Can any worker report a hazard quickly and receive feedback?
• Can the duty manager recognise and escalate a reportable occurrence?
• Are top risks owned by operations and reviewed when conditions change?
• Can leaders identify controls whose effectiveness is uncertain?
• Are changes screened before commitment and reviewed after introduction?
• Do actions close with evidence and a check that they worked?
• Can independent assurance challenge the person who owns the process?
• Do contractors participate in reporting, emergency and learning systems?
• Can the accountable manager trace performance to decisions and resources?
• Can evidence be retrieved without rebuilding it for an audit?

These behaviours demonstrate a functioning SMS more convincingly than the length of its manual.

FAQ

Does a small Omani aerodrome need a full-time safety manager? The applicable approval and accepted organisation structure govern the answer. CAR 100 allows proportionality, and ICAO does not prescribe a universal SMS headcount. The aerodrome must demonstrate competent performance, resources and appropriate independence.

Can the operations manager also coordinate SMS? Potentially, if accepted arrangements address competence, workload and conflicts. Decisions involving that person's work need credible independent review.

How many hazards should the register contain? Enough to represent the actual operation. Quality, ownership and review matter more than volume. Do not inflate the register with generic duplicates.

Can an external consultant run the SMS? A consultant can supply expertise and independent review. Accountability, operational risk ownership and day-to-day learning must remain within the aerodrome organisation.

Where a system helps

A proportionate platform can keep the SMS lean without making it informal: one intake, one risk model, visible obligations, controlled documents, role-based decisions, mobile inspections and traceable action verification. Shared expertise can be added without losing local ownership.

Explore SafetyMS for aviation safety.

Related reading: Safety Data Without Safety Insight (KB-476) and What Is a Safety Performance Indicator in Aviation? (KB-105).

Sources

• Oman CAA, CAR 100 — Safety Management System
• Oman CAA, Application for Aerodrome Certificate
• ICAO, Safety Management Frequently Asked Questions
• ICAO APAC, Generic Aerodrome SMS Evaluation Tool and Guidance