DGCA Audits and Findings Management: Closing NCRs Before They Escalate

Written for the people who run the programme: the aerodrome safety manager who chairs the runway safety team, the ANSP safety officer who brings the ATC data, and the operator safety lead who has to explain why the same taxiway intersection produced four reports this year. By the end you should be able to classify an event, defend a hot spot designation, name the factor families an investigation must cover, and say what data makes the programme measurable rather than anecdotal.

The definition decides what you count

ICAO's Doc 9870 definition is deliberately wide: "Any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft." GCAA uses the same wording in Safety Alert 2018-15.

Three words carry the weight. Incorrect means without authorisation or contrary to the clearance given, which is why a vehicle crossing on a valid clearance is not an incursion and one crossing on a misheard clearance is. Protected area is wider than the runway strip, so a stop bar crossed with no aircraft within ten miles still counts. Any occurrence means severity is assessed after the event is counted, not before.

That last point is where most programmes lose their data. If reports only arrive when something nearly happened, the dataset is the tail of the distribution and the precursors are invisible. A healthy set is dominated by category D events with no immediate safety consequence, because those reveal the layout problem before it meets a departure.

Severity classification A to E

Doc 9870 sets five classes. The definitions are short, and the response each one should trigger is not in the manual, so the third column below is practice rather than regulation.

Severity class	ICAO definition	Typical response
A	"A serious incident in which a collision is narrowly avoided"	Immediate notification to the regulator as a serious incident; independent investigation; consider operational restriction at the location pending findings
B	"An incident in which separation decreases and there is significant potential for collision, which may result in a time-critical corrective/evasive response to avoid a collision"	Formal investigation with a named lead; ATC and flight crew interviews; risk assessment against the aerodrome risk matrix; interim mitigation before the next peak period
C	"An incident characterized by ample time and/or distance to avoid a collision"	Investigation proportionate to the risk assessment; contributing factors recorded against the full taxonomy; reviewed at the next runway safety team meeting
D	"An incident that meets the definition of runway incursion such as the incorrect presence of a single vehicle, person or aircraft on the protected area of a surface designated for the landing and take-off of aircraft but with no immediate safety consequences"	Trend analysis by location, time of day and actor type; individually low value, collectively the most useful signal you have
E	"Insufficient information or inconclusive or conflicting evidence precludes a severity assessment"	Treat as a data quality finding; if E is more than a small fraction of the set, the reporting form or the evidence retention is the problem

Two disciplines follow. Classify from evidence, not from outcome: the same geometry can produce an A or a D depending on where the departing aircraft happened to be, and grading by luck teaches the organisation nothing. And do not let category E become a filing cabinet. In UAE practice, GCAA's CAAP-22 lists runway incursion as a reportable occurrence with the A to E categories carried through its appendices, so an unclassifiable event is also an incomplete regulatory submission.

The local runway safety team, and who actually sits on it

Doc 9870 says a local runway safety team should "develop an action plan for runway safety, advise management as appropriate on potential runway incursion issues and recommend strategies for hazard removal". The Runway Safety Team Handbook puts it more bluntly: "The primary role of a runway safety team is to advise relevant operators and service provider's management and operational staff on prevailing local conditions on the runway, taxiways and adjacent areas."

Membership is the part that gets diluted. ICAO's core list is aerodrome operations, air traffic services, commercial air operators, flight crew representatives, general aviation, and technical experts from pilot and controller associations, with regulators, military operators, ground handlers and emergency responders brought in as needed. GCAA's Safety Alert is directive about ownership: aerodrome operators must "continuously and actively lead the implementation and maintenance" of local runway safety teams, while ANSPs and aircraft operators are required to participate.

The membership test that matters is not the distribution list. It is whether the people in the room can commit their organisation to an action. A team where the ANSP is represented by someone who must take every proposal back to a watch manager produces minutes, not mitigations.

The Handbook's suggested terms of reference cover "Objectives, scope of oversight, and expected frequency of RST meetings; Membership selection processes; Roles and responsibilities of individual RST members; Processes and formal agreements governing sharing of safety data". The last item is usually missing and it is the one that stops the team working: without a data-sharing agreement, the ANSP cannot show you its occurrence reports and you cannot show it yours.

The team supports the safety management system rather than replacing it: "Although not considered a regulatory authority or intended to replace any required component of a Safety Management System (SMS), the RST is aimed to improve and support runway safety by integrating the safety systems of the participating organizations." ICAO's Global Runway Safety Action Plan records that establishing runway safety teams "is now mandatory under ICAO's PANS-Aerodromes". [NEEDS SOURCE: the PANS-Aerodromes (Doc 9981) provision mandating runway safety teams, and whether GCAA has adopted it as a requirement in CAR-ADR rather than as guidance.]

Hot spots: identification, and getting them onto the chart

The definition is common to Doc 9870 and to GCAA's CAR-ADR, which carries it at 1.3.3: "A location on an aerodrome movement area with a history or potential risk of collision or runway incursion, and where heightened attention by pilots/drivers is necessary."

Read "or potential risk" carefully. A hot spot does not require a history of events. A newly reconfigured taxiway with an acute-angle entry and a sightline problem qualifies on geometry alone, and waiting for three reports before designating it is a decision to collect the reports.

Identification is not a desk exercise. The Handbook describes team members conducting "periodic airport tours at various times and weather conditions to identify hazards specific to particular operational circumstances". Do the tour at night, in low visibility, and from a vehicle cab as well as a flight deck; a sign legible in a saloon car at midday is not necessarily legible from a tug at 0300.

Publication has two halves that are easy to get wrong separately. Doc 9870 says hot spot information should be "produced locally, checked regularly for accuracy, revised as needed, distributed locally, and published in the Aeronautical Information Publication (AIP)". Local distribution reaches drivers and handlers; the AIP entry, and the aerodrome chart derived from it, reaches the flight crews who have never been there before. A hot spot in the aerodrome safety bulletin but not in the AIP is invisible to the population most likely to be caught by it. GCAA adds a detail worth copying: the depiction "should be placed near to the working position so that Air Traffic Control can relate to what a lost pilot or driver is seeing".

Hot spots also need a retirement rule. A location rebuilt, re-signed and clear for two review cycles should come off, or the chart becomes noise.

The contributing-factor taxonomy

Doc 9870 groups causal factors into five families, and an investigation that does not visit all five has not finished.

• Communications: non-standard phraseology, failed or partial readbacks, misunderstandings, blocked transmissions, and instructions too complex to be held.
• Flight crew factors: loss of situational awareness, difficulty interpreting signage and markings, workload during the landing roll, rushing, and complicated aerodrome layouts.
• Air traffic control factors: momentary memory lapses about an aircraft or a clearance issued, failure to anticipate a separation problem, inadequate coordination, misidentification, and communication errors.
• Airside vehicle driver factors: failure to obtain a clearance, non-compliance with an instruction, communication error, inadequate training, and lack of aerodrome familiarisation.
• Aerodrome design factors: complex layouts, insufficient runway spacing, departure taxiways that do not intersect at right angles, and the absence of perimeter taxiways.

GCAA's Safety Alert lists fifteen contributing factors from UAE experience and names misunderstanding as the most frequent, alongside communication breakdowns and non-standard phraseology, incomplete or incorrect readbacks with conditional clearances, last-minute changes to ATC instructions, inadequate aviation English proficiency, stop bar misuse, low visibility operations, shift handover information gaps, and works in progress. Notice how many of those are organisational rather than individual. A taxonomy that bottoms out at "pilot error" is not a taxonomy.

Phraseology and conditional clearances

Doc 9870's rule on phraseology is unambiguous: standard phraseology must be used "in all situations for which it has been specified. Only when standardized phraseology cannot serve an intended transmission, plain language shall be used."

Conditional clearances are the recurring structural risk. The manual sets the construction, with the condition stated before the instruction, and requires that the readback be checked: the example given is "SAS941, BEHIND DC9 ON SHORT FINAL, LINE UP BEHIND", with the crew reading back "BEHIND LANDING DC9 ON SHORT FINAL, LINING UP BEHIND SAS941". The condition appears twice in the exchange, at the start and at the end, which is the whole point of the construction.

GCAA's data gives the reason to care: of reported runway incursions involving conditional clearances, approximately half showed incomplete readbacks, and the Safety Alert recommends limiting their use. That is a specific, testable local control. If your aerodrome issues conditional clearances, the runway safety team should be looking at a count of them, a sample of readback compliance, and the traffic conditions under which they are used, not simply at whether the phraseology is in the unit training package.

The reporting loop, end to end

The loop only counts as closed when someone has checked that the mitigation worked. In UAE practice the stages map onto specific instruments.

1. Frontline report. CAAP-22 makes reporting mandatory for operators, ANSPs and ground handling organisations at UAE airports through the ROSI system, with a parallel voluntary channel (VORSY) for people not under a legal obligation. On the voluntary channel, GCAA "will not disclose the name of the person submitting" except where criminal activity, incompetence, or separate reporting by others applies. Publish that boundary in your reporting policy; an unclear boundary suppresses volume.
2. Notification against the clock. CAAP-22 sets timescales by category: accidents and serious incidents require immediate notification to the Duty Investigator with the initial report inside 3 to 8 hours depending on operator type; Category 1 incidents require notification to the principal inspector within 24 hours and the report within 72 hours; Category 2 incidents within 15 calendar days. A category A incursion is not a 15-day item, so the classification decision has to be made in the first hour by someone competent to make it.
3. Initial classification and capture. Doc 9870's Initial Notification Form "requires the inclusion of data to describe the event and to classify its severity". Capture location to a named intersection or holding position, not "runway 30L area"; location precision is what makes repeat-location analysis possible later.
4. Investigation and causal analysis. Doc 9870's Causal Factors Identification Form "establishes the how, what and why concerning the event and is to be completed once the detailed investigation into the event has been completed". Complete it against all five factor families.
5. Risk assessment and mitigation. Assess against the aerodrome risk matrix, assign an owner and a date, and record residual risk once the control is in place. The Handbook expects "a master register of the hazards identified, current controls and defences, risk analysis and outcome, additional controls and mitigations, action plan for implementation (owner and timelines), and residual risk".
6. Verification. Return at a defined interval and ask whether the rate at that location changed, whether readback compliance improved, whether the new sign is reported as legible. This is the stage that gets skipped, and its absence is why hot spot lists grow year on year with nothing coming off them.
7. Feedback to the reporter. Doc 9870 defines just culture as "an atmosphere of trust in which people are encouraged to provide essential safety-related information but in which they are also clear about where the line must be drawn between acceptable and unacceptable behaviour." Reports that vanish stop arriving.

The runway safety team cycle

A workable meeting cycle, in order. Steps 1 and 2 happen before the meeting, not in it.

1. Assemble the data pack two weeks ahead: every incursion and taxiway incursion report since the last cycle with severity class and precise location, the movement count for the period, open actions with owners and due dates, and the outcome of any verification due.
2. Circulate it under the data-sharing agreement. If the ANSP's occurrence data cannot be shared, fix the agreement before the meeting rather than discussing a partial picture in it.
3. Review verification first, not new events. Putting new events first guarantees the verification item runs out of time every cycle.
4. Review new events by severity and by location, looking for the intersection or holding position that appears more than once, whatever the severity.
5. Review the hot spot list: confirm each designation, consider new candidates on geometry as well as history, retire the ones resolved and verified.
6. Walk the aerodrome on a rotating schedule, at different times and in different conditions, with drivers and crews present, and feed the findings into the hot spot review.
7. Assign mitigations with a named owner, a date and a defined verification method. "Reminder in the safety bulletin", with no way to test whether it changed anything, is not a mitigation.
8. Set the next period's awareness activity and aim it at the population the data implicates: line crews, tug drivers or a specific handling agent.
9. Report upward into each organisation's SMS. The team advises; the accountable executives of the aerodrome, the ANSP and the operators own the risk.
10. Publish the minutes and the action register to everyone who submitted a report in the period.

The data that makes this measurable

Counts alone will mislead you, because traffic moves. The set worth maintaining:

• Incursion rate normalised per movement, usually expressed per 10,000 or per 100,000 movements. A falling count during a quiet quarter is not an improvement.
• Severity mix over time. A rising share of category A and B against a flat total is a deteriorating picture that a total count hides.
• Repeat locations, which is why step 3 above insists on a named intersection rather than a general area.
• Actor mix: aircraft, vehicle or pedestrian, and within vehicles, which operator or contractor.
• Contributing factors by family, so awareness effort can be aimed rather than broadcast.
• Category E share, as a data quality indicator.
• Action closure and verification lag, meaning how long between assigning a mitigation and confirming it worked.

[NEEDS SOURCE: any UAE national runway incursion rate, target or alert level published by GCAA. Safety Alert 2018-15 states that GCAA "has identified an increasing trend in the numbers of both taxiway and runway incursions" but publishes no figures; verify against the current GCAA State Safety Programme or national safety plan before quoting a rate.]

Where teams get this wrong

Under-reporting category D and calling it improvement. Events with no immediate safety consequence map the aerodrome's weak points. A programme whose D count falls while layout and traffic are unchanged has a reporting problem, not a safety improvement.

Reviewing events and never verifying. The action register grows, everything is closed on the owner's assertion, and the same intersection reappears eighteen months later.

Hot spots that only ever get added. With no retirement rule the chart accumulates markings and crews skim past them.

Location captured as free text. "Near Bravo", "B3/B4 area" and "taxiway Bravo south" are one place in three formats, and no analysis will join them.

Treating conditional clearances as a phraseology topic rather than a measured control. Half of conditional-clearance incursions in the GCAA data involved incomplete readbacks. That is a measurable behaviour and it belongs in the data pack with a number attached.

The right organisations and the wrong people. Attendance without decision authority converts a safety forum into a reporting meeting.

What to automate, and what not to

Automate the record-keeping and the arithmetic: single intake across all channels, structured location capture from a controlled list of intersections and holding positions, severity class as a required field, normalisation of counts against movement data, repeat-location detection, action registers with owners and verification dates, and reminders when a verification falls due. These fail silently when done by hand, and they are what an audit asks to see.

Do not automate severity classification or causal analysis. Grading an event A or B is a judgement about what nearly happened, made from recordings, radar and interviews; a tool that infers it from keywords will grade by outcome. Nor will software create the data-sharing agreement between an aerodrome and an ANSP, or put a decision-maker in the room.

Where a system helps

The measurable difference is traceability from a single report to a verified control: one report classified, located against a controlled list, analysed against the five factor families, linked to a mitigation with an owner and a date, then linked again to the verification that shows the rate at that location changed. That is what makes a runway safety team's data pack a five-minute export rather than a fortnight of spreadsheet work, and it is what KreupAI's aviation safety management is built to hold.

FAQ

Is a vehicle entering the runway with a valid clearance an incursion? No. The definition turns on incorrect presence: without authorisation or contrary to the clearance issued. A vehicle on a clearance it misheard is an incursion, and the readback is where the investigation starts.

Who chairs the local runway safety team? In the UAE, GCAA's Safety Alert 2018-15 requires aerodrome operators to lead the implementation and maintenance of local runway safety teams, with ANSPs and aircraft operators required to participate. ICAO does not prescribe a chair, but the aerodrome operator holds most of the physical mitigations.

Does a hot spot need a history of incursions? No. The definition covers "a history or potential risk of collision or runway incursion". Geometry, sightlines, signage complexity and works in progress are sufficient grounds on their own.

How quickly must a runway incursion be reported in the UAE? It depends on the classification. Under CAAP-22, accidents and serious incidents require immediate notification to the Duty Investigator with the initial report within 3 to 8 hours; Category 1 incidents within 24 hours with a report in 72 hours; Category 2 incidents a report within 15 calendar days.

What is the point of category E? It exists so that events with inconclusive evidence are still counted rather than discarded. A large category E share is a signal that the reporting form, the evidence retention period or the investigation timeliness needs work.

Related reading

• KB-105: "What Is a Safety Performance Indicator?"
• KB-106: "What Is a Safety Case in Aviation?"

Sources

• ICAO Doc 9870, Manual on the Prevention of Runway Incursions (PDF)
• ICAO Runway Safety Team Handbook, Second Edition, June 2015 (PDF)
• ICAO Global Runway Safety Action Plan, Second Edition, 2024 (PDF)
• GCAA Safety Alert 2018-15, Prevention of Runway and Taxiway Incursions, Issue 02 (PDF)
• GCAA CAAP-22, Incident Reporting, Issue 05 (PDF)
• GCAA CAR Part IX, CAR-ADR Aerodromes, Issue 11 (PDF)
• ICAO Model Advisory Circular, Runway Incursion Prevention and Pilot Training (PDF)