1Safety policy

1.1 Statement of the Accountable Executive

PilotRules Flight Academy, operated by Southeast Aerial Systems, trains ab initio cadets from zero time to airline transport pilot standards in fifty-two weeks. That mission is carried out in single-engine, multi-engine, and turbine aircraft, frequently by pilots at the least experienced point of their careers. The academy accepts that flight training is an inherently hazardous activity and that the hazards can be identified, measured, and controlled. This manual establishes how the academy does so.

The Wing Commander / Commandant, who is the Owner and Responsible Manager of the certificate and the Accountable Executive for this Safety Management System, commits the organization to the following:

• To provide the human, financial, and material resources necessary to operate and improve the Safety Management System, and to fund the corrective actions that the system identifies.
• To hold safety of persons and aircraft above the training schedule, above completion rates, and above cost, in every decision at every level of the organization.
• To maintain a reporting environment in which cadets, instructor pilots (IPs), maintenance personnel, and staff report hazards and errors without fear of reprisal, subject only to the limits set out in Section 3.
• To comply with all applicable regulations as a minimum standard rather than as a target, and to adopt higher internal standards wherever the risk warrants them.
• To ensure that no person is assigned a duty for which that person has not been trained, qualified, and found competent.
• To review the performance of the Safety Management System personally and to sign the annual effectiveness statement required by Section 12.

Signed: Wing Commander / Commandant, Accountable Executive, PilotRules Flight Academy — 1 August 2026.

Signed on behalf of Southeast Aerial Systems by the Wing Commander / Commandant, Accountable Executive, effective 1 August 2026. This statement is posted in the operations building, the flight rooms, the maintenance hangar, and the ground school, and is reissued with the signature and date of the incumbent whenever the position changes.

1.2 Framework and applicability

This Safety Management System is built on the four components described in 14 CFR Part 5 and in ICAO Annex 19: safety policy, safety risk management, safety assurance, and safety promotion. The twelve elements of the Annex 19 framework are mapped to the sections of this manual in Section 12.

14 CFR Part 5 requires an approved Safety Management System for defined categories of certificate holders, including air carriers operating under Part 121 and, under the expansion of that rule adopted in 2024, additional operators such as certificate holders under Part 135, operators conducting commercial air tours under §91.147, and certain holders of production certificates issued under Part 21, each on the compliance schedule published with that rule.

1.3 Authority to cancel or delay

Cancellations are logged by the Director of Operations / Operations Support Squadron (OSS) with the stated reason. The Director of Safety reviews the log monthly. A persistent absence of cancellations in adverse conditions is itself treated as an indicator of schedule pressure and is investigated.

1.4 Safety objectives and targets

The academy sets measurable safety objectives annually. Objectives are expressed so that performance can be demonstrated from records rather than from opinion. The supporting safety performance indicators and their targets appear in Section 7.

1.5 Management review

The Accountable Executive chairs the Safety Review Board quarterly and reviews the full Safety Management System annually. Quarterly review covers indicator performance against target, open corrective actions, risk assessments accepted at the executive level, and resource requests. The annual review additionally covers the adequacy of the policy itself, the training program, and the emergency response plan. Minutes of every review are retained under Section 12.

2Accountability and responsibilities

2.1 The Accountable Executive

The Wing Commander / Commandant is the single Accountable Executive for the Safety Management System. The position holds final authority over the operation of the academy, control of the human and financial resources required to conduct training, and final responsibility for the safety performance of the organization. These duties are not delegable:

• Issuing, signing, and periodically reaffirming the safety policy in Section 1.
• Providing the resources the system requires and deciding resource conflicts between safety and production.
• Appointing the Director of Safety and defining that position’s authority.
• Accepting residual risk at the highest level defined in Section 4.
• Chairing the Safety Review Board and signing the annual SMS effectiveness statement.
• Declaring activation of the Emergency Response Plan, or ratifying an activation made by another authorized person.

The Accountable Executive may delegate the execution of tasks but retains accountability for the outcome. When the Accountable Executive is absent for more than seventy-two hours, the Director of Operations / OSS is designated acting in the role, and the designation is recorded in writing.

2.2 The Director of Safety

The Director of Safety is the SMS manager: the person responsible for the day-to-day operation, maintenance, and development of the system on behalf of the Accountable Executive. The position is deliberately placed outside the training production chain so that safety findings are not filtered by the managers whose output they concern.

The Director of Safety has:

• Direct access to the Accountable Executive on any safety matter, at any time, without intermediate approval and without prior notice to any other manager.
• Authority to ground an aircraft, a person, or an entire operation immediately when a hazard is judged to present an unacceptable risk. A grounding stands until the Director of Safety releases it; it may not be reversed by the Chief Instructor, the Director of Operations / OSS, or the Maintenance Controller. Only the Accountable Executive may overrule a grounding, and that decision must be recorded in writing with the reasoning.
• Unrestricted access to records, training folders, maintenance documents, flight data, and personnel for the purpose of investigation and audit.
• Authority to convene the Safety Action Group at any time and to place any item on the Safety Review Board agenda.

The Director of Safety does not carry line responsibility for the training schedule and is not evaluated on completion rate, sortie count, or revenue.

2.3 Position responsibilities

2.4 Safety Review Board

The Safety Review Board is the strategic body. It is chaired by the Accountable Executive and comprises the Director of Safety, Chief Instructor, Director of Operations / OSS, Director of Training, Maintenance Controller, and Chief Inspector. It meets quarterly and within seventy-two hours of any accident or serious incident.

The Board decides: acceptance of high-level residual risk; allocation of resources to corrective action; changes to the safety policy and to safety objectives and targets; approval of the annual internal evaluation plan; approval of major changes under the management-of-change process in Section 7; and the disposition of any finding that the Safety Action Group cannot resolve.

2.5 Safety Action Group

The Safety Action Group is the working body. It is chaired by the Director of Safety and comprises the Assistant Chief Instructor, a line IP nominated by the flights, the Chief Inspector or a maintenance representative, the Duty Safety Officer, and a cadet representative elected by the class. It meets monthly and on call.

The Group decides: the initial risk index assigned to each new hazard; the practical mitigation for hazards it is competent to close; assignment and tracking of corrective actions; the content of the safety bulletin; and which items must be escalated to the Board. The Group cannot accept unacceptable risk, cannot change policy, and cannot commit funds.

3Hazard identification and reporting

3.1 Purpose

A hazard is a condition or object with the potential to cause injury to persons, damage to equipment, or degradation of the ability to perform a function. Hazards are not events; they exist before anything happens. The purpose of this section is to make hazards visible early enough to be controlled, and to do that the academy depends almost entirely on people choosing to report.

3.2 Sources of hazard data

The Director of Safety draws hazard data from reactive, proactive, and predictive sources:

• Cadet and IP hazard reports filed through the reporting channels in paragraph 3.4.
• Maintenance squawks submitted through the online squawk form at /maintenance, including repeat discrepancies and items deferred more than once.
• Flight data and avionics downloads from the fleet, reviewed for exceedances such as unstabilized approaches, low-altitude maneuvering, and abnormal engine parameters.
• Stage-check and check-ride trends reported by Check Instructors, where a repeated weakness across cadets indicates a training system defect rather than an individual shortfall.
• Maintenance findings from inspections, service difficulty history, and manufacturer service information.
• Weather events, including unforecast conditions encountered, convective encounters, turbulence, and icing, cross-referenced against the products on /weather.
• Near misses and traffic conflicts, including loss of separation, non-standard pattern entries, and radio confusion at non-towered fields.
• Ramp events, including propeller-arc violations, towing damage, fuel spills, chock and tie-down omissions, and pedestrian conflicts.
• External audits and inspections, insurance surveys, and regulatory surveillance findings.
• Investigation output from the process in Section 8, and hazards identified during the management-of-change process in Section 7.
• Local knowledge captured in /route-hazards, covering terrain, obstacles, noise-sensitive areas, and airspace pinch points in the training area.

3.3 Non-punitive reporting policy

Reports are not used as evidence in an individual disciplinary process. Investigation under Section 8 seeks the systemic condition that allowed the error, not the person to blame for it. Where an individual competence gap is found, the response is training, not sanction.

3.4 How to file a report

Any of the following channels is acceptable, and no channel is considered less legitimate than another:

1. Electronic hazard report through the academy portal, which time-stamps the submission and routes it directly to the Director of Safety.
2. Squawk form at /maintenance for any airworthiness or equipment condition. A squawk that also reveals a systemic hazard is copied to the Director of Safety automatically.
3. Paper form from the rack in each flight room and in the maintenance hangar, deposited in the locked safety box.
4. Verbal report to the Duty Safety Officer, any IP, or the Director of Safety. The recipient is responsible for reducing it to writing the same duty day.

An urgent hazard — one that could affect a flight already scheduled — is reported verbally first and in writing afterward. The person receiving it notifies the Duty Safety Officer immediately.

3.5 Anonymous reporting

Anonymous reporting is available and is used without stigma. The paper form contains no mandatory identifying field, and the locked safety box is opened only by the Director of Safety. The academy accepts that an anonymous report cannot be clarified with the reporter and may therefore be acted upon more conservatively than a named report. No attempt is made to identify an anonymous reporter, including by handwriting, schedule inference, or access logs; any such attempt is itself a reportable breach of this policy.

Reporting internally does not replace or restrict a person’s ability to file with an external voluntary reporting program, and the academy neither discourages nor requires external filing.

3.6 Acknowledgement and feedback

A reporting system that produces no visible response stops producing reports. The following timeline is a commitment of the Director of Safety.

Where a report cannot be actioned, the reporter is told why. A report closed without action is still retained as hazard data and is counted in the trend analysis in Section 7.

4Safety risk management

4.1 The five-step process

Every identified hazard, every proposed change, and every new operation is processed through the following five steps. The output is recorded on the risk register maintained by the Director of Safety.

1. Describe the system. Define what is being assessed: the aircraft type, the phase of training, the airspace, the people involved, the procedures in use, the equipment, and the interfaces with maintenance, dispatch, and air traffic services. An assessment that has not bounded the system will miss the hazard at the boundary.
2. Identify hazards. List the conditions with the potential to cause harm, drawing on the data sources in Section 3 and on structured techniques such as scenario walk-through and what-if analysis. Each hazard is stated as a condition, followed by the credible outcome it could produce.
3. Analyze risk. For each hazard-outcome pair, determine the severity of the credible worst outcome and the likelihood of that outcome occurring, using the definitions in paragraphs 4.2 and 4.3.
4. Assess risk. Combine severity and likelihood into a risk index using the matrix in paragraph 4.4, and compare the result to the acceptance criteria.
5. Control risk. Apply controls from the hierarchy in Section 6, re-index the residual risk, obtain the acceptance decision from the authority in paragraph 4.5, and verify that the control works before the item is closed.

4.2 Severity

Severity describes the credible worst outcome, not the worst conceivable outcome and not the outcome that actually occurred. An event that happened to end without damage is assessed on what it could reasonably have produced.

4.3 Likelihood

Likelihood is judged against the academy’s own exposure — approximately fourteen thousand fleet hours and eighteen thousand landings per year across the Cessna 172, Piper Seminole, and Pilatus PC-12 fleets — and not against industry-wide rates.

4.4 Risk matrix

The risk index is the likelihood level followed by the severity level, for example 5A or 1E. Each cell carries a fixed acceptance decision.

4.5 Who may accept residual risk

Acceptance is always recorded with the name of the accepting authority, the date, the controls relied upon, and the review date. Acceptance is never open-ended: every mitigated risk carries a scheduled re-review, at intervals not exceeding twelve months.

4.6 Re-assessment after change

A risk assessment is valid only for the system that was described in step one. Re-assessment is mandatory when an aircraft type or configuration is introduced or modified; when the syllabus, a Training Course Outline, or a standard operating procedure changes; when the training area, base of operations, or airspace structure changes; when cadet throughput or fleet utilization increases materially; when key personnel change; when a control fails or an event occurs that the assessment did not anticipate; and at the scheduled review date. The management-of-change process in Section 7 governs how the re-assessment is triggered and tracked.

5Flight Risk Assessment Tool and go/no-go

5.1 Purpose and applicability

The Flight Risk Assessment Tool (FRAT) converts the risk process of Section 4 into a pre-flight decision that takes two minutes. It does not replace judgement; it makes the accumulation of small risks visible before the aggregate becomes hazardous, and it gives a cadet an objective basis for declining a flight.

A FRAT is mandatory and must be completed, scored, and briefed before:

• Every solo sortie of any kind, including pattern-only solos.
• Every cross-country sortie, dual or solo.
• Every night sortie.
• Every sortie in the Piper Seminole and every sortie in the Pilatus PC-12.
• Every sortie flown in instrument meteorological conditions or under an IFR clearance.
• Every sortie by a cadet within the first thirty days of the program.
• Any sortie the Duty Safety Officer or the IP designates.

For routine dual local sorties in the Cessna 172 in day visual conditions, the FRAT is completed at the flight-room level as part of the mass brief unless any single factor scores four or more, in which case an individual FRAT is required. The completed FRAT is retained with the dispatch record.

5.2 Scored risk factors

Factors within a category are cumulative except where they are mutually exclusive by definition, such as the ceiling and visibility bands, from which only the single applicable band is scored.

5.3 Score bands and required action

5.4 Solo cadet limits

5.5 Supporting resources

The weather products used to populate the FRAT are consolidated at /weather. Terrain, obstacle, and airspace considerations for the local area are published at /route-hazards. Personal minimums are developed and recorded at /minimums and are reviewed with the IP at each syllabus phase change described in /upt-program.

6Risk controls and mitigations

6.1 Hierarchy of controls

Controls are not equal. A control that removes the hazard is durable; a control that depends on a person remembering something under pressure is fragile. When selecting a mitigation, the Safety Action Group works down the following hierarchy and documents why any higher level was rejected.

A mitigation package that consists only of levels 5 and 6 is regarded as weak and is accepted only where higher-level controls are demonstrably impracticable.

6.2 Standing controls

The following controls are permanent features of the operation. Each exists because a specific hazard was assessed, and each is subject to the effectiveness monitoring in Section 7.

Stabilized-approach gate

By 500 ft AGL in visual conditions and 1,000 ft above touchdown zone elevation in instrument conditions, the aircraft must be on the correct lateral and vertical path, in the landing configuration, at the target airspeed with a tolerance of plus 10 and minus 5 knots, at a stabilized power setting, and with a descent rate not exceeding 1,000 ft per minute. If any parameter is outside the gate at the gate, a go-around is executed. The go-around is not a failure and is never graded as one; continuing an unstabilized approach is the failure. Full parameters are published in the Flight Standards Manual at /manual-fsm.

Crew rest and duty

The duty day is 0600 to 1800 and a minimum of 12 hours of crew rest is provided before the next duty period. The control is described in Section 10 and is enforced by the OSS at the point of scheduling rather than at the point of dispatch.

Sterile cockpit

No conversation unrelated to the immediate operation of the aircraft below 10,000 ft MSL, and in all cases during taxi, takeoff, departure, approach, landing, and any abnormal condition. The IP calls “sterile” and the cadet acknowledges. Instructional commentary that is not required for the safe conduct of the phase is deferred to the debrief.

Dual-only weather thresholds

Conditions below the solo limits in paragraph 5.4 but within the academy’s operating envelope are flown dual only. This preserves the training value of marginal weather while placing a qualified IP in the aircraft.

Critical control confirmation in the PC-12

This protocol exists because turbine control layouts place high-consequence controls adjacent to routine ones and because the consequence of a wrong selection is immediate and, in some regimes, unrecoverable.

Additional standing controls

• Positive transfer of control using the three-way exchange: “you have the aircraft — I have the aircraft — you have the aircraft.”
• Fuel reserve of one hour at normal cruise for all training sorties, exceeding the regulatory minimum.
• Minimum maneuvering altitude of 1,500 ft AGL for stalls and slow flight, and 3,000 ft AGL for spin awareness and unusual attitude work.
• Mandatory go-around if the aircraft is not on the ground in the first third of the available runway.
• Two-person independent check of fuel quantity and oil level before the first sortie of the day on each airframe.

6.3 Verifying that a control works

A control is not a mitigation until it has been shown to work in the operation, not merely written into a manual. Before a risk is closed, the assigned owner must demonstrate, and the Director of Safety must accept, the following:

1. The control is in place. It is published in the applicable manual, the change is issued, and the affected population has been trained on it and has acknowledged the training.
2. The control is being used. Evidence is drawn from observation on the line, dispatch and FRAT records, flight data, and audit sampling — not from the assertion that it was briefed.
3. The control is producing the intended effect. The related safety performance indicator has moved in the intended direction, or the hazard has ceased to be reported, over a monitoring period of not less than ninety days.
4. The control has not introduced a new hazard. The assessment is re-run for the changed system in accordance with paragraph 4.6, with specific attention to added workload, added complexity, and the risk of the control being bypassed under time pressure.

If any of the four cannot be shown, the risk remains open, the interim controls stay in force, and the Safety Action Group selects a stronger control from a higher level of the hierarchy.

7Safety assurance

7.1 Continuous monitoring

Safety assurance answers a single question: are the controls described in Section 6 still working, and is the organization’s safety performance where it should be? The Director of Safety monitors continuously rather than only at audit points, drawing on daily dispatch and cancellation records, FRAT scores and their distribution, squawk volume and closure time, flight data exceedances, stage-check and check-ride results, duty-time records, and the hazard report stream from Section 3.

Monitoring output is reviewed at the monthly Safety Action Group and reported quarterly to the Safety Review Board with a written commentary, not merely a data table.

7.2 Internal evaluation and audit

The internal evaluation program tests compliance with the academy’s own procedures and the effectiveness of its controls. Audits are conducted by a person independent of the function being audited; where the academy lacks an independent qualified person, an external auditor is engaged.

Every finding is classified as a Level 1 finding, requiring immediate action and an interim control before operations continue in the affected area, or a Level 2 finding, requiring a corrective action plan within thirty days. Observations that do not constitute findings are recorded as opportunities for improvement.

7.3 Safety performance indicators

An indicator that misses target for two consecutive review periods triggers a formal risk assessment under Section 4, whether or not any event has occurred.

7.4 Trend analysis

Individual data points are weak evidence; direction over time is strong evidence. The Director of Safety maintains a rolling twelve-month view of every indicator and examines the data for clustering by aircraft type, by syllabus phase, by flight, by IP, by time of day, and by season. Seasonal effects — summer convection, winter density altitude and icing, the compressed daylight of the winter schedule — are expected and are separated from genuine deterioration. Where a cluster is found, it is treated as a hazard and enters the process at paragraph 4.1 step one.

7.5 Management of change

Change is the single most reliable generator of new hazards in a training organization. A change proposal is submitted to the Director of Safety before implementation whenever the academy adds or modifies an aircraft type or avionics fit; changes a Training Course Outline, syllabus, or standard operating procedure; changes the training area, base, or airspace it uses; changes class size, throughput, or fleet utilization by more than ten percent; changes a key position identified in Table 2-1; or adopts a new tool, vendor, or maintenance arrangement.

The proposal describes the change, identifies the hazards it introduces or alters, records the risk assessment, states the controls and who owns them, defines how effectiveness will be measured, and identifies every manual and record that must be updated. Changes assessed above the acceptable band require Safety Review Board approval before implementation. Every change carries a post-implementation review at ninety days.

7.6 Corrective and preventive action

Every finding, accepted hazard, and investigation recommendation becomes a tracked action on the corrective action register with a single named owner, a due date, and a defined completion criterion. Group ownership is not permitted. The register is reviewed at every Safety Action Group meeting. An action passing its due date is escalated to the Safety Review Board with an explanation from the owner. An action is closed only when the four verification tests in paragraph 6.3 have been satisfied and the Director of Safety has signed the closure. Preventive actions — those addressing a hazard that has not yet produced an event — are tracked on the same register and carry the same closure discipline.

8Investigation and event classification

8.1 Purpose

Internal investigation exists to find out why an event happened so that the organization can prevent the next one. It does not exist to determine fault, to support a disciplinary process, or to satisfy an insurer. Investigation findings are safety records and are handled under the confidentiality provisions of Section 12.

8.2 Classification of events

8.3 Who leads

The Director of Safety leads every internal investigation and selects the investigation team according to the technical content of the event. The team may include the Chief Inspector for airworthiness matters, the Chief Instructor for instructional matters, and an IP from a flight not involved in the event. No person investigates an event in which that person was directly involved, or one for which that person’s own decisions are within scope. If the Director of Safety is involved in the event, the Accountable Executive appoints an external investigator.

Where the NTSB or the FAA conducts an investigation, that investigation takes precedence. The academy’s internal work is suspended so far as necessary, cooperates fully, and resumes afterward for the purpose of internal prevention only.

8.4 External notification

Where a written report is required following an accident, it is submitted within the period prescribed by §830.15. The Director of Safety maintains the current NTSB and FAA Flight Standards District Office contact details in the Emergency Response Plan kit and verifies them at each annual exercise.

8.5 Evidence preservation

Under §830.10, the operator is responsible for preserving the aircraft, its contents, and all records to the extent possible until the NTSB takes custody or releases the wreckage. Disturbance is permitted only to remove persons or injured persons, to protect the wreckage from further damage, or to protect the public from injury; where any part must be moved, its original position and condition are photographed and sketched beforehand.

Immediately on notification of a significant event, the Director of Safety directs that the following be secured and placed beyond routine access: the aircraft and any separated parts; fuel and oil samples from the servicing source; the maintenance records and the airframe, engine, and propeller logbooks; the dispatch release, FRAT, and weight and balance documents; the weather briefing obtained and the products available at the time; the cadet’s and IP’s training folders and duty and rest records; avionics and flight data storage media, which are not powered up or overwritten; and any personal electronic recordings.

8.6 Root cause analysis

The investigation reconstructs the sequence of events, identifies the active failures and the conditions that made them likely, and traces those conditions to the organizational decisions that produced them. The academy uses a structured method — typically successive causal questioning supported by a barrier analysis of the controls that were expected to prevent the outcome.

8.7 Feeding findings back

Recommendations from every investigation are entered on the corrective action register described in paragraph 7.6. Where a finding touches training content, the Director of Training amends the affected lesson, briefing guide, or Training Course Outline and the change is reflected in /manual-training. Where it touches flight technique or limits, the Chief Instructor amends /manual-fsm. Where it touches airworthiness or the deferral process, the Maintenance Controller amends /manual-maintenance. Where it touches the conduct of the operation as a whole, the change is made in /manual-gom. The de-identified lesson is published in the safety bulletin and briefed at the next stand-up, as described in Section 11.

9Emergency Response Plan

9.1 Purpose and activation

The Emergency Response Plan converts a chaotic first hour into an ordered sequence of actions. It is designed to be executed by whoever is present, using the printed kit, without reference to memory.

The plan is activated by the Accountable Executive, the Director of Safety, the Director of Operations / OSS, or the Duty Safety Officer. Any of these persons may activate unilaterally; none needs the concurrence of another; an activation later found unnecessary is treated as a correct decision. Activation triggers include:

• An aircraft is overdue, uncommunicative, or the subject of an alert notice.
• A declared emergency, a forced or precautionary off-airport landing, or a diversion under abnormal conditions.
• An accident or serious incident as classified in Section 8, on or off the airport.
• Serious injury or death of any person during an academy activity, including ground and physical training.
• A fire, hazardous material release, or structural event affecting academy facilities.
• Notification from any external agency of an event involving an academy aircraft or person.

9.2 Call tree

The call tree with current numbers is printed and held in the operations desk kit, the maintenance hangar kit, and the vehicle kit, and is carried by the Duty Safety Officer. It is verified quarterly and at every annual exercise. The plan does not depend on any single electronic system being available.

9.3 On-scene commander

One person holds on-scene authority. Until the Director of Safety arrives, the on-scene commander is the Duty Safety Officer; on arrival, the Director of Safety assumes the role unless the Accountable Executive designates otherwise. The on-scene commander does not attempt to run the whole response; the role is to control the site, keep people away from hazards, brief arriving emergency services on fuel state, occupants, and hazardous items such as ballistic devices or oxygen systems, and preserve evidence under paragraph 8.5. When public emergency services or an investigative authority assume control of the site, the on-scene commander becomes the academy’s liaison and follows their direction.

9.4 Family and next-of-kin notification

The Registrar maintains current emergency contact details for every cadet and staff member and verifies them at intake and at each phase transition. International cadets have consular notification requirements recorded on file. Once notification is made, a single point of contact is assigned to each family for the duration of the response.

9.5 Media policy

The Accountable Executive is the sole spokesperson for the academy and may delegate the role in writing to one named individual. No other person makes any statement to the media, and no person speculates publicly on cause. The standing response for anyone approached is: “I am not authorized to comment. Please contact the academy’s designated spokesperson.” Staff and cadets are instructed not to post images, aircraft registrations, names, or commentary on any platform. Statements confirm only established facts, express concern for those affected, and refer questions of cause to the investigating authority.

9.6 Securing records and the aircraft

On activation, the Director of Safety directs that access to the training folders, maintenance records, dispatch documents, and scheduling data associated with the event be restricted, that no record be amended or completed retrospectively, and that electronic records be preserved with their audit trails intact. Any correction to a record made after the event is dated, signed, and identified as post-event. The aircraft and its parts are secured as described in paragraph 8.5.

9.7 Drug and alcohol testing

Academy policy requires that any crew member and any maintenance person whose work is connected to a qualifying event be removed from duty immediately and undergo drug and alcohol testing under the company program as soon as practicable, and in any case within the window specified in the program. Separately, §91.17(c) obliges a crew member to submit to a test to indicate blood or breath alcohol concentration when requested by a law enforcement officer in the circumstances described in that section. No person who may be required to be tested consumes alcohol or any non-prescribed substance after an event and before testing is complete.

9.8 Post-event support

An event affects far more people than those in the aircraft. The academy provides, without cost and without any record in a training file:

• Immediate removal from flying duties for anyone involved or closely affected, with return only after a fitness discussion with the Chief Instructor and the Director of Safety. Time away does not count against course progression, and no cadet is disadvantaged in the syllabus for it.
• Access to critical incident stress management resources and to professional counseling through the academy’s employee and cadet assistance arrangement.
• A structured defusing session within twenty-four hours for those directly involved and a facilitated debriefing for the wider class and cadre within seventy-two hours. Attendance is offered, not compelled, and the sessions are not investigative.
• Recognition that grief, intrusive recollection, and impaired concentration are normal responses, and an explicit instruction that a person experiencing them should declare unfit for duty under Section 10.

9.9 Exercising the plan

The plan is exercised at least annually. The exercise alternates between a tabletop walkthrough of a complex scenario and a practical drill that includes an actual call-tree activation, retrieval of the kits, and coordination with airport emergency services. Every exercise produces a written report with findings entered on the corrective action register. The plan is revised whenever an exercise, an actual activation, a personnel change, or a change of contact details requires it, and reissued to all kit locations.

10Fatigue risk management

10.1 Why the limits exist

Fatigue degrades exactly the capacities that ab initio flight training depends on: sustained attention, working memory, situational awareness, risk perception, and the willingness to abandon a plan that is no longer working. The effects appear before the person feels tired, and self-assessment becomes less reliable as impairment increases. Extended wakefulness produces performance decrements comparable to alcohol impairment, and sleep debt accumulates across consecutive days without being felt as sleepiness.

Cadets are additionally exposed because the program compresses academics, physical training, simulator, and flying into a continuous fifty-two weeks, and because a novice pilot has no automated skill to fall back on when capacity is reduced. Every task in the cockpit is still consuming conscious effort.

10.2 Personal responsibility to declare

Every person — cadet, IP, or maintenance technician — has an individual obligation to declare when not fit for duty, whatever the cause and however inconvenient the timing. The declaration requires no explanation, no medical evidence, and no approval. It is made to the IP, the Duty Safety Officer, or the OSS, and the person is removed from the schedule for that period.

10.3 Fatigue indicators and required action

10.4 Commuting and rest before showtime

Rest means opportunity for sleep, not merely absence from the academy. A person whose journey to base exceeds ninety minutes, or who arrives from a distance on the morning of duty, is regarded as having reduced their rest period accordingly and must inform the OSS. Cadets are billeted within a reasonable distance of the field precisely to protect the rest period. Travel time is not rest, and a person who has driven a long distance immediately before showtime is not rested.

Personal study is a duty activity in this context. Cadets are expected to stop academic work in time to obtain a full sleep opportunity; the Director of Training sizes assignments accordingly, and a cadet who cannot complete the workload within the duty day reports that fact rather than absorbing it into the rest period.

10.5 How the OSS protects rest

Fatigue is designed out at the scheduling stage, not managed at the dispatch desk. The Director of Operations / OSS builds the schedule to the following rules:

• Showtime is not earlier than 0600 and the last debrief is complete by 1800.
• No more than three flight events are assigned to a cadet in one duty day, and no more than four instructional sorties to an IP.
• A minimum of forty-five minutes is scheduled between the end of one flight event and the brief for the next.
• One full duty-free day is scheduled in every seven, and it is protected against make-up sorties except by the Chief Instructor’s written approval.
• Night flying blocks are scheduled with a compensating late showtime the following day rather than a normal 0600 report.
• Weather-cancelled sorties are rescheduled into subsequent days, never absorbed by extending the duty day.
• Schedules are published the preceding afternoon so that people can plan their rest.

10.6 Illness, medication, and lookback periods

A person must not fly or perform maintenance while affected by illness, injury, or medication that could impair performance. The following lookback periods are academy policy and apply in addition to any regulatory requirement or medical restriction.

10.7 Physical training and the 0600 formation

The military-style 0600 formation and the physical training that follows are deliberate features of the program: they set a common start time, allow accountability for every cadet, and give the Duty Safety Officer a daily opportunity to observe the whole class for signs of fatigue, illness, or distraction. They also consume energy at the start of a long duty day, and that cost is managed rather than ignored.

The PT Instructor coordinates with the OSS so that heavy physical training is not scheduled immediately before a cadet’s first flight event, that a minimum of sixty minutes and a meal separate PT from a flight brief, and that heat index, hydration, and acclimatization are assessed daily during summer operations. A cadet who is injured, dehydrated, or unable to complete PT is not scheduled to fly until cleared. Cadets are reminded that the effects of dehydration and low blood sugar in the cockpit closely resemble the effects of fatigue and are equally disabling.

11Safety promotion and training

11.1 Purpose

Safety promotion is the component that makes the other three work. A policy that nobody has read, a reporting system that nobody trusts, and controls that nobody understands produce documentation rather than safety. Promotion at this academy is deliberately continuous and embedded in the daily routine rather than delivered as an annual event.

11.2 Indoctrination training

Every cadet receives SMS indoctrination during the first week of the program, before the first flight event. Every IP, ground instructor, maintenance technician, and staff member receives the same content within ten duty days of hire. The syllabus covers:

• The safety policy and the authority in paragraph 1.3 to cancel or delay any activity.
• The four components of the SMS and how they relate to daily work.
• Hazard recognition, and the difference between a hazard, an event, and a consequence.
• How to file a report, what happens to it, and the exact limits of the non-punitive policy.
• The risk matrix, the FRAT, and personal minimums.
• The standing controls in Section 6 and the reasoning behind each.
• Fatigue recognition and the obligation to declare unfit.
• Individual actions on activation of the Emergency Response Plan.

Completion is recorded by the Registrar and is a prerequisite for the first solo authorization. Understanding is confirmed by a written check and by a practical discussion, not by a signature on an attendance sheet.

11.3 Recurrent training

All personnel complete recurrent safety training every twelve months. Content is built from the preceding year’s hazard data, investigation findings, audit results, and indicator trends, so that no two years are identical. IPs additionally complete standardization training semi-annually covering instructional risk, the management of surprise in the cockpit, and the specific hazards of demonstrating abnormal procedures. Maintenance personnel complete human-factors training covering error traps, interruption management, and the pressures of return-to-service timing.

11.4 The EP of the day and stand-up

Each duty day opens with stand-up in the flight room. A named cadet is presented with an emergency procedure scenario — the EP of the day — and must brief the immediate action items, the follow-on decision making, and the reasoning, in front of the class and the cadre. The exercise is graded for correctness and for calm, structured thought, and it distributes the same scenario to every cadet present, not only the one called.

Stand-up also carries a daily safety item delivered by the Duty Safety Officer: a hazard reported in the previous twenty-four hours, a weather or airspace consideration for the day, a maintenance condition affecting the fleet, or a lesson from a published event elsewhere in aviation. The item is short, specific, and actionable. Attendance is recorded.

11.5 Safety bulletin and lessons learned

The Director of Safety publishes a safety bulletin monthly, posted in the flight rooms, the hangar, and the academy portal. Each edition contains the indicator dashboard against target, a summary of hazards reported and what was done about them, one lesson-learned narrative in depth, the status of open corrective actions, and any change to procedure taking effect that month.

The lessons-learned brief is delivered quarterly to the whole organization, cadets and staff together. It walks through one internal event and one external event in detail: what the crew or the technician knew at the time, what decisions were available, which controls were expected to work, and what has changed as a result. The emphasis is on the situation being understandable, not on the people involved being deficient.

11.6 Publishing outcomes while protecting the reporter

People report when they see reports produce change. Every published item is therefore de-identified before release: names, cadet class numbers, aircraft registrations, dates narrowed to the month, and any detail that would identify an individual by inference — a unique sortie, an unusual route, a distinctive maintenance task — are removed or generalized. Where an event cannot be described without identifying the reporter, the Director of Safety obtains the reporter’s explicit consent or publishes only the resulting change without the narrative. The identity of a reporter is known only to the Director of Safety and is not disclosed to any manager, including the Accountable Executive, except where the exclusions in paragraph 3.3 are engaged.

11.7 Annual safety stand-down

One full duty day each year is designated a safety stand-down. No flying is scheduled and no revenue or training pressure competes with it. The day covers the annual review of safety performance presented by the Director of Safety, a workshop in which cadets and staff identify hazards in mixed groups, refresher training on emergency procedures and the Emergency Response Plan, a practical exercise of part of the plan, and an open forum with the Accountable Executive at which any person may raise any safety concern directly. Outputs are captured as hazard entries and corrective actions in the normal way.

11.8 Competency and communication

No person is assigned a safety-related duty without demonstrated competence for it. The Director of Safety completes formal SMS training and maintains currency through recognized professional development. The Chief Instructor and Assistant Chief Instructor complete investigation-awareness training sufficient to support the process in Section 8. Competency records are held by the Registrar.

Safety communication flows in both directions and the academy measures whether it is arriving. Upward flow is through reports, the cadet representative on the Safety Action Group, and the open forum. Downward flow is through stand-up, the bulletin, the lessons-learned brief, and manual revisions. Every person is told what the academy’s current safety objectives are, how the organization is performing against them, and what changed because someone reported something. All safety communication is issued in US English and in plain language, and any person who is unclear on a safety instruction is expected to say so rather than proceed.

12SMS records and documentation

12.1 Document hierarchy

This manual sits at the top of the safety documentation set. It states what the academy does about risk and why. The operating manuals state how the work is performed, and each contains the controls that this manual requires. Where a conflict exists, this manual governs on matters of safety policy, risk acceptance, and reporting; the specialist manual governs on matters of technique and procedure within its own scope.

The current revision of every manual is listed at /manuals. Printed copies are uncontrolled; the electronic version is the controlled document.

12.2 Records and retention

Records are held electronically with access control and are backed up to a separate location. A record subject to an investigation or a legal hold is not destroyed at the end of its retention period.

12.3 Confidentiality and de-identification

Safety reports and investigation files are held separately from personnel files and training folders and are not accessible to line managers. Access is limited to the Director of Safety, to investigation team members for the specific file, and to the Accountable Executive where a decision requires it. Identifying information is removed as soon as the report has been clarified with the reporter and, in any event, before the report enters trend analysis. De-identified data is the only form in which reports are presented to the Safety Action Group, the Safety Review Board, or the wider organization.

12.4 Revision and control

This manual is reviewed at least annually and whenever a change under paragraph 7.5 requires it. Revisions are proposed by the Director of Safety, reviewed by the Safety Review Board, and approved by the Accountable Executive. Each revision carries a revision number and effective date on the cover, and a revision record is maintained showing the date, the sections changed, and the reason. On issue of a revision, the Director of Safety confirms that all Emergency Response Plan kits, posted extracts, and cross-referenced manuals have been updated, and that affected personnel have been briefed on the change.

12.5 Annual effectiveness review

Once each year the Director of Safety prepares an SMS effectiveness review for the Accountable Executive. It addresses each of the four components in turn and answers, with evidence: whether the policy is current, understood, and observed in practice; whether hazards are being identified before events rather than after them; whether risk assessments are being completed, accepted at the correct level, and re-reviewed on schedule; whether controls are demonstrably effective under the tests in paragraph 6.3; whether indicators met their targets and what the trends show; whether corrective actions closed on time; whether the Emergency Response Plan was exercised and what the exercise found; whether training was delivered and understood; and what the priorities are for the coming year.

The Accountable Executive reviews the assessment, decides the resource allocation that follows from it, and signs the effectiveness statement. The signed statement is retained indefinitely under Table 12-2 and its principal conclusions are published to the organization in the safety bulletin. An unsigned or deferred statement is itself reported to the Safety Review Board as a deficiency of the system.