FOCA GM / INFO	Guidance Material / INFORMATION

Attachment Template

Attachment to the DTO Safety Policy

Source: Lukas Huber, FOCA DTO SAFETY POLICY

Scope	Guidance on the attachment of the DTO Safety Policy as a template in Word format, based on DTO.GEN.210.
Applies to	Training organisations wishing to declare a Training Organisation in accordance with Part-DTO.
Valid from	27.10.2020

Business object	331.01-1/3
Prepared by	SBFL L. Huber
Released by	AFS SB 27.10.2020
Distribution	Internal / External

Completion guidance

The information provided solely represent a possible means of how to provide the required information. An organisation must add further information or adapt the template to their specific needs.

The first two pages of this Word template are to be deleted by the organisation when adapting this template. This can be done by clicking the red button below.

Text shown in blue italic indicates where the organisation needs to provide its own specific information or data.

In addition, all references to manuals, chapters and sub-chapters are shown in blue and are to be verified to ensure compliance with the DTO specific and own documentation.

Log of revision

Date	Issue	Revision	Highlight of Revision
27.10.2020	1	0	Initial issue

Cover Page

Name of organisation

Address

Contact information

LEFT BLANK

LoR	Log of Revision

LoR	REV0 / TBD

Date	Issue	Revision (REV)	Changes
dd.mm.yyyy	1	0	Initial issue
…

LoC	List of Effective Chapters

LoC	REV0 / TBD

LoR	REV0 / TBD

LoC	REV0 / TBD

CoL	REV0 / TBD

ToC	REV0 / TBD

LoA	REV0 / TBD

1	REV0 / TBD

1.1	REV0 / TBD

1.2	REV0 / TBD

1.3	REV0 / TBD

1.4	REV0 / TBD

1.4.1	REV0 / TBD

1.4.2	REV0 / TBD

2	REV0 / TBD

2.1	REV0 / TBD

2.2	REV0 / TBD

2.3	REV0 / TBD

2.4	REV0 / TBD

3	REV0 / TBD

CoL	Compliance List

CoL	REV0 / TBD

Reference	Chapter
DTO.GEN.210	Chapter 1 / Chapter 2 / Chapter 3
EU 376/2014	Safety Policy / Chapter 2 / Chapter 3

LEFT BLANK

ToC	Table of Contents

ToC	REV0 / TBD

1	Hazard identification	1

1.1	Definition of hazard and risk	1

1.2	Risk assessment	1

1.3	Effectiveness of mitigation measures (implementation and follow-up)	4

1.4	Risk Assessment checklist	4

1.4.1	Organisational risks	4

1.4.2	Operational risks	7

2	Occurrence Reporting	9

2.1	Definitions	9

2.2	Mandatory Reporting	10

2.3	Voluntary Reporting	13

2.4	Follow-up process for handling occurrence reports	14

3	Document storage	15

LoA	List of Abbreviations

LoA	REV0 / TBD

The following abbreviations are used within this syllabus:

Abbreviation	Definition
ABB	Abbreviation
AD	Administration
AIP	Aeronautical Information Publication
ALARP	As Low As Reasonably Practicable
ATC	Air Traffic Control
ATIR	Air Traffic Incident Report
CoL	Compliance List
DTO	Declared Training Organisation
EASA	European Aviation Safety Agency
EDP	Electronic Data Processing
EFB	Electronic Flight Bag
ENR	En-Route
EU	European Union
FOCA	Federal Office of Civil Aviation
HT	Head of Training
IFR	Instrument Flight Rules
IMC	Instrument Meteorological Conditions
LoA	List of Abbreviations
LoC	List of Effective Chapters
NCC	Non-Commercial Complex
NCO	Non-Complex Operations
NIT	Night Rating
No	Number
Ref	Reference
REGA	Swiss Air Rescue Service
SUST	Schweizerische Unfalluntersuchungsstelle
ToC	Table of Contents

Hazard identification

1	REV0 / TBD

The hazard identification process is the formal means of collecting, evaluating and recording hazards, evaluate the associated risks and define related mitigation measures.

Definition of hazard and risk

1.1	REV0 / TBD

Hazard: Condition or object with the potential of causing injuries to people, damage to equipment or structures, loss of material, or reduction of ability to perform a stipulated function.

Risk: The assessment, expressed in terms of predicted probability and severity, of the consequence(s) of a hazard, taking as reference the worst foreseeable situation.

Starting with the Hazard Identification Process and the associated tables, the hazard identification and the associated risk assessment can be performed.

Step	Tool	Responsibility
Identify hazard	Reporting Form XX	All personnel
Evaluate associated risk	Table for probability, severity, tolerability Matrix and Risk Assessment Checklist Risk Assessment Checklist	Representative
Define mitigation action
Set duties on task list	Task list	Representative
Controlling/monitoring	Yearly organisational review	Person responsible for the organisational review programme

Risk assessment

1.2	REV0 / TBD

The probability of an individual risk will be determined by taking into account any mitigation measures that may already be in place. Determination of probability is not an exact science but relies on a logical, common-sense analysis of the risk, in order to arrive at a reasonable answer.

Risk probability is to be defined in accordance with the following table:

Probability Classification	Definition	Probability per year
Frequent 5	An event will almost certainly occur.	> 75%
Probable 4	An event is likely to happen.	> 50%
Occasional 3	An event will probably occur sometime.	< 50%
Remote 2	An event is unlikely to occur, but is possible.	~ 25%
Improbable 1	An event is highly unlikely to occur.	< 5%

The severity of risk will be determined by taking into account any mitigation measures that may already be in place. Severity should be assessed in terms of the worst possible realistic scenario.

Risk severity should be defined in accordance with the following table:

Severity Classification	Severity Indicators
Level of damage	Level of injury	Safety Barriers (e.g. Emergency procedures, technical systems)	Operational/Human Factors
Catastrophic 5	Loss of Aircraft Equipment destroyed	Multiple fatalities	No safety barriers remaining	Complete reduction of operational capability; Complete loss of control; Outcome is not under control; DTO is unable to avoid accident.
Hazardous 4	Substantial aircraft or equipment damage	Fatal or serious injuries to a number of people	None or very few safety barriers remaining	Large reduction of operational capability; Physical distress; Excessive workload such that DTO cannot be relied upon to perform required tasks accurately or completely.
Major 3	Minor damage to aircraft or equipment	Individual serious injuries but no fatalities	Several safety barriers remaining	A significant reduction in the capability of the DTO to cope with adverse operating condition; Significant increase in DTO workload, and significant concern over the consequences of failure; Conditions impairing DTO efficiency or creating significant discomfort; Physical distress to students and instructors.
Minor 2	Insignificant damage to aircraft or equipment	Individual minor injuries	Multiple safety barriers remaining, alternate/emergency procedures are able to compensate for functional loss/nuisance	Actions required by DTO are well within their capabilities but cause slightly increased workload/operational limitations/loss of efficiency; some physical discomfort to students (not to instructors); Nuisance.
No Significant Safety Effect 1	No damage to aircraft or equipment	No injury	Existing safety barriers come into play to avoid the event turning into a minor incident	Nuisance/Failure can be eliminated by routine action, or does not require action at all.

When severity and probability have been defined, the tolerability of the risk can be determined. Tolerability is defined as either acceptable, to be reviewed or unacceptable, allowing a suitable risk mitigation strategy to be developed if required.

Definitions of tolerability levels are as follows:

Classification	Definition
Unacceptable	A risk falling into this category is regarded as unacceptable whatever the level of benefits associated with the activity. Any activity or practice-giving rise to risks falling into this category would, as a matter of principle, be ruled out unless the activity or practice can be modified to reduce the degree of risk so that it falls into one of the classifications mentioned below, or there are exceptional reasons for the activity or practice to be retained.
Tolerable	Risks in this category are typical of the risks from activities that people are prepared to tolerate in order to secure benefits, in the expectation that: the nature and level of the risks are accurately assessed and the results used properly to determine control measures. The assessment of the risks needs to be based on the best available scientific evidence and, where evidence is lacking, on the best available scientific advice; the residual risks are not unduly high and are kept as low as reasonably practicable (the ALARP principle); and the risks are periodically reviewed to ensure that they still meet the ALARP criteria, for example, by ascertaining whether further or new control measures need to be introduced to take into account changes over time, such as new knowledge about the risk or the availability of new techniques in order to reduce or eliminate risks.
Broadly acceptable	Risks falling into this category are generally regarded as insignificant and adequately controlled. The levels of risk characterising this category are comparable to those that people regard as insignificant or trivial in their daily lives. They are typical of the risk from activities that are inherently not very hazardous or from hazardous activities that can be, and are, readily controlled to produce very low risks.

The tolerability of an individual risk is determined by use of the following risk tolerability matrix:

Risk probability	Risk Severity
Catastrophic	Hazardous	Major	Minor	No Significant Safety Effect
5	4	3	2	1
Frequent	5	25	20	15	10	05
Occasional	4	20	16	12	08	04
Remote	3	15	12	09	06	03
Improbable	2	10	08	06	04	02
Extremely Improbable	1	05	04	03	02	01

Effectiveness of mitigation measures (implementation and follow-up)

1.3	REV0 / TBD

Step	Remarks	Tool	Responsibility
Analysis	Analysis of action/measurement required; Perform Risk Assessment; Identification of the root cause and human factors; Definition of mitigation/preventive action; Establish corrective action plan.	FOCA Document/Audit/or Inspection Report; Third Party Safety/measures information (e.g. EASA); Annual internal Review Checklist Occurrence Report	Person responsible for the annual internal review
Initiation of actions and measures	Initiate corrective action and preventive action (who does what, when and due date): Correction to eliminate problem; Corrective action to eliminate root cause; Preventive action to eliminate potential root cause; Define measurement criteria to evaluate effectiveness.	Annual internal Review Checklist List of pending items	Representative
Monitoring of Effectiveness	Verify implementation of measures and the effectiveness.	Follow-up audit or inspection	Representative
Feedback to the Representative	Inform the Representative with data, facts and results.	Annual internal Review Checklist	Person responsible for the annual internal review

Risk Assessment checklist

1.4	REV0 / TBD

Organisational risks

1.4.1	REV0 / TBD

P = Probability, S = Severity, R = Risk Probability

Ref	Area	Hazards may stem from	Risk Assessment P x S = R	Mitigation Action	Risk post mitigation
P	S	R	P	S	R
1	Organisation – Management	financial distress	…	…	…	…	…	…	…
limited or lack of management commitment
limited or lack of resources availability or planning
lack of or ineffective reporting policy (just culture)
Lack or inadequate implementation of pandemic preventive measures
…
…
2	Personnel requirements	unclear reporting lines	…	…	…	…	…	…	…
lack of, incorrect or incomplete control of necessary certificates of staff (licences, ratings, medical certificates).
absence of refresher / recurrent training programme
change of instructor during ongoing training
…
…
…
3	Facility requirements & equipment	facilities exposed to high level of noise, distraction, etc.	…	…	…	…	…	…	…
changes, upgrades or new equipment
…
…
…
4	Record keeping	unauthorised access	…	…	…	…	…	…	…
hardware or software changes
…
5	Processes & procedures	lack of incorrect, incomplete documents or operating procedures	…	…	…	…	…	…	…
existence of informal procedures
language barriers
difficulties to access procedures and documents
…
…
6	Terms of declaration and training courses	Lack of or incomplete declaration	…	…	…	…	…	…	…
frequent changes
wide range of different declared training courses including categories of aircraft
…
…
7	Human factors	combination of positions (workload and stress)	…	…	…	…	…	…	…
Lack of or inadequate application of pandemic preventive measures and protective equipment
instructor fatigue
alcohol and substance abuse
medications
complacency
psycho-social stresses (financial, birth of child, divorce, bereavement, etc.)
…

Operational risks

1.4.2	REV0 / TBD

Ref	Area	Hazards may stem from	Risk Assessment PxS=R	Mitigation Action	Risk post mitigation
P	S	R	P	S	R
1	Pre-flight preparation	lack of or poor airworthiness verification	…	…	…	…	…	…	…
lack or poor verification of equipment and instruments including necessary equipment and instruments for a particular training flight
lack of incorrect or incomplete aircraft performance limitations verification
lack of, incorrect or incomplete flight planning
lack of or incorrect fuelling / power / energy calculation
lack of or poor aircraft dispatch or release
…
2	Aircraft loading	improper stowage of carry-on baggage	…	…	…	…	…	…	…
improper mass and balance calculations
…
3	Flight operations	absence of or incorrect flight manuals or charts on board	…	…	…	…	…	…	…
Loss of access to flight manuals or charts
Loss of EFB including power loss or incomplete battery charge
improper execution of procedures in all flight phases due to instruction (e.g. stall and spin recovery), including taxiing and parking
inadequate or complicated procedures
equipment and instruments necessary for a particular flight or operation not available or malfunctioning
lack of or poor communication (ATC, dispatch etc.)
…
4	Special flight operations	use of aircraft not equipped/not approved for the particular training flight (e.g. NIT).	…	…	…	…	…	…	…
…
5	Aerodromes and operating sites	use of aerodromes or operating sites with high traffic volumes	…	…	…	…	…	…	…
use of uncontrolled aerodromes or operating sites
taxiway and runway system complexity
…
6	Refuelling	incorrect fuelling / power / battery charging	…	…	…	…	…	…	…
…
…
7	Parking	lack of, limited or incorrect type of aircraft parking and tie down procedures	…	…	…	…	…	…	…
..

Occurrence Reporting

2	REV0 / TBD

The main target of the occurrence reporting system is to avoid any re-occurrence and to learn from reported events.

All persons involved in the organisation or in civil aviation are to report in accordance with regulation EU No 376/2014 any occurrence endangering or potentially endangering aviation safety. The following two reporting systems are in place within the organisation:

Mandatory reporting; and

Voluntary reporting

Definitions

2.1	REV0 / TBD

Incident	«Incident» means an occurrence, other than an accident, associated with the operation of an aircraft which affects or could affect the safety of operation;
Serious incident	«Serious incident» means an incident involving circumstances indicating that there was a high probability of an accident and is associated with the operation of an aircraft, which in the case of a manned aircraft, takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, or in the case of an unmanned aircraft, takes place between the time the aircraft is ready to move with the purpose of flight until such time it comes to rest at the end of the flight and the primary propulsion system is shut down.
Accident	«Accident» means an occurrence associated with the operation of an aircraft which, in the case of a manned aircraft, takes place between the time any person boards the aircraft with the intention of flight until such time as all such persons have disembarked, or in the case of an unmanned aircraft, takes place between the time the aircraft is ready to move with the purpose of flight until such time it comes to rest at the end of the flight and the primary propulsion system is shut down, in which: a person is fatally or seriously injured as a result of: being in the aircraft, or, direct contact with any part of the aircraft, including parts which have become detached from the aircraft, or, direct exposure to jet blast, except when the injuries are from natural causes, self-inflicted or inflicted by other persons, or when the injuries are to stowaways hiding outside the areas normally available to the passengers and crew; or the aircraft sustains damage or structural failure which adversely affects the structural strength, performance or flight characteristics of the aircraft, and would normally require major repair or replacement of the affected component, except for engine failure or damage, when the damage is limited to a single engine, (including its cowlings or accessories), to propellers, wing tips, antennas, probes, vanes, tires, brakes, wheels, fairings, panels, landing gear doors, windscreens, the aircraft skin (such as small dents or puncture holes) or minor damages to main rotor blades, tail rotor blades, landing gear, and those resulting from hail or bird strike; or the aircraft is missing or is completely inaccessible;
Hazard	Condition or object with the potential of causing injuries to personnel, damage to equipment or structures, loss of material, or reduction of ability to perform a prescribed function.
ATIR	Air Traffic Incident Reports result from incidents in connection with ATC services. Refer to AIP Switzerland, ENR 1.14
Occurrences	Occurrences are incidents that pose a significant risk to aviation safety

Mandatory Reporting

2.2	REV0 / TBD

Accident and Serious Incident
Responsibility	Notification to	Dispatch time	Means/Address
Pilot in Command or any person directly involved in, or becoming aware of an accident or serious incident	Air Traffic Control	Immediately	Current frequency
Swiss Air Rescue Service (REGA)	Phone: 1414 (from abroad: +41 333 333 333)
Head of Training	Initial notification: by best practicable means Phone: Written report: Reporting/Analysis Form E-Mail:
Swiss Air Rescue Service (REGA)	Schweizerische Unfalluntersuchungsstelle SUST	Immediately	Schweizerische Unfalluntersuchungsstelle SUST Bereich Aviatik Aéropôle 1 CH-1530 Payerne Tel. +41 58 466 33 00 Fax +41 58 466 33 01 info-av@sust.admin.ch
Head of Training	Activation of the organisation’s emergency response	Immediately	Refer to XXX
FOCA	Within 72 Hours of becoming aware of the occurrence, unless exceptional circumstances prevent this	Aviation Safety Reporting [On-line] Available (20.05.2016) http://www.aviationreporting.eu
Additionally, to assigned inspector by the best practicable means; or dto@qcm.ch
Representative	As soon as practicable	Phone: E-Mail:
Refer to «Follow-up process for handling occurrence reports»

Laser attack
Responsibility	Notification to:	Dispatch time:	Address:
Pilot in Command/ Instructor	Local broadcast or Air Traffic Control	Immediately	Current frequency
Cantonal Police	Schweizer Polizei [On-line] Available (21.10.2016): https://polizei.ch/
In case of canton Zurich	E-Mail: fp.ezf@kapo.zh.ch Form: «Eilmeldung Laserattacke» [On-line] Available (20.05.2016) https://www.bazl.admin.ch/dam/bazl/de/dokumente/Fachleute/Ausbildung_und_Lizenzen/Laserblendungen/laserattacke_kantonspolizeizuerich.pdf.download.pdf/laserattacke_kantonspolizeizuerich.pdf
Head of Training	As soon as practicable	Initial notification: by best practicable means Phone: Written report: Reporting/Analysis Form E-Mail:
Head of Training	FOCA	Within 72 Hours of becoming aware of the occurrence, unless exceptional circumstances prevent this	Aviation Safety Reporting [On-line] Available (20.05.2016) http://www.aviationreporting.eu
Additionally, to assigned inspector by the best practicable means; or dto@qcm.ch
Representative	As soon as practicable	Phone: E-Mail:
Refer to «Follow-up process for handling occurrence reports»

Reportable occurrences in accordance with Regulation (EU) No 2015/1018
Air operations Unintentional loss of control; Landing outside of intended landing area; Inability or failure to achieve required aircraft performance expected in normal conditions during take-off, climb or landing; Runway incursion; Runway excursion; Any flight which has been performed with an aircraft which was not airworthy, or for which flight preparation was not completed, which has or could have endangered the aircraft, its occupants or any other person; Unintended flight into IMC (Instrument Meteorological Conditions) conditions of aircraft not IFR (Instrument flight rules) certified, or a pilot not qualified for IFR, which has or could have endangered the aircraft, its occupants or any other person.
Technical occurrences Abnormal severe vibration (for example: aileron or elevator ‘flutter’, or of propeller); Any flight control not functioning correctly or disconnected; A failure or substantial deterioration of the aircraft structure; A loss of any part of the aircraft structure or installation in flight; A failure of an engine, rotor, propeller, fuel system or other essential system; Leakage of any fluid which resulted in a fire hazard or possible hazardous contamination of aircraft structure, systems or equipment, or risk to occupants;
Interaction with air navigation services and air traffic management Interaction with air navigation services (for example: incorrect services provided, conflicting communications or deviation from clearance) which has or could have endangered the aircraft, its occupants or any other person; Airspace infringement.
Emergencies and other critical situations Any occurrence leading to an emergency call; Fire, explosion, smoke, toxic gases or toxic fumes in the aircraft; Incapacitation of the pilot leading to inability to perform any duty.
External environment and meteorology A collision on the ground or in the air, with another aircraft, terrain or obstacle (or vehicle); A near collision, on the ground or in the air, with another aircraft, terrain or obstacle (or vehicle) requiring an emergency avoidance manoeuvre to avoid a collision; Wildlife strike including bird strike which resulted in damage to the aircraft or loss or malfunction of any essential service; Interference with the aircraft by firearms, fireworks, flying kites, laser illumination, high powered lights lasers, Remotely Piloted Aircraft Systems, model aircraft or by similar means; A lightning strike resulting in damage to or loss of functions of the aircraft; Severe turbulence encounter which resulted in injury to aircraft occupants or in the need for a post-flight turbulence damage check of the aircraft; Icing including carburettor icing which has or could have endangered the aircraft, its occupants or any other person.
The list above applies to other than complex motor powered aircraft (Part NCO). For reportable occurrences related to complex aircraft (Part NCC), Sailplanes, Balloons and Airships refer to Regulation EU No 2015/1018 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1447326836554&uri=CELEX:32015R1018 [On-line] Available (24.04.2019) For further information refer to http://www.aviationreporting.eu [On-line] Available (21.10.2016)

(Note: Amend the list above with the respective elements regarding used aircraft and type of operation. Delete this note.)

Responsibility	Notification to:	Dispatch time:	Means/Address
Pilot in Command/ Instructor	Local broadcast or Air Traffic Control	Immediately	Current frequency
If an aerodrome is affected: Aerodrome Operator Airport Authority	Ground frequency C-Office of the aerodrome concerned
Head of Training	Within 72 Hours of becoming aware of the occurrence, unless exceptional circumstances prevent this	Initial notification: by best practicable means Phone: Written report: Reporting/Analysis Form E-Mail:
Head of Training	FOCA	Within 72 Hours of becoming aware of the occurrence, unless exceptional circumstances prevent this	Aviation Safety Reporting [On-line] Available (20.05.2016) http://www.aviationreporting.eu
Additionally, to assigned inspector by the best practicable means; or dto@qcm.ch
Representative	As soon as practicable	Reporting/Analysis Form
Refer to «Follow-up process for handling occurrence reports»

Voluntary Reporting

2.3	REV0 / TBD

Responsibility	Notification to:	Address:
Any employee/freelance of the organisation, instructors and students	Representative / Head of Training	Written report: Reporting/Analysis Form E-Mail:
Refer to «Follow-up process for handling occurrence reports»

Follow-up process for handling occurrence reports

2.4	REV0 / TBD

Step	Task	Tool	Responsibility
Data Input	Collect and sort	Specific reporting means - internal reporting tool xy (for internal reporting) - reporting portal (EU) (for external reporting)	… anyone …
Initial Analysis	Evaluate and classify data	Reporting means	Head of Training
Data Quality Check	Check and correct errors in data entry, completeness of data, proper use of ADREP taxonomy and improve data consistency between information collected initially and the report stored in the database.	Reporting means
Notification	Employees shall report occurrences at the latest within 72 hours to their organisation, which itself has to report within another 72 hours to FOCA.	Reporting Procedures as described in the DTO safety policy	Head of Training
Hazard Identification	Identify Hazard	Hazard Identification Form,	Representative
Risk Assessment	Assess the Risk Transfer to Risk portfolio	Risk Assessment Tool, Risk Portfolio	Representative
Tolerability Assessment	Check tolerability	Tolerability Matrix,	Representative
Mitigation	Define corrective action and preventive measures	…	Representative and Head of Training
Notification	If an actual or potential safety risk is identified, the organisation shall transmit to FOCA the preliminary results of an analysis performed within 30 days and the final results within three months.	Communication means	Representative and Head of Training
Feedback	Provide the sender of the report with a feedback	Form XY	Representative
Information	Notification of internal and external parties involved and/or interested	Reporting schemes of external parties and/or Means as adequate to the case including investigation documentation or parts thereof	Representative
Implementation	Implement corrective action and preventive measures	…	Head of Training
Monitor	Monitor the effectiveness	Risk Portfolio	Representative
…

Document storage

3	REV0 / TBD

The Declared Training Organisation’s system of record keeping allows the storage and reliable traceability of all its activities and related data. The record keeping system ensures that the records are always accessible and traceable throughout the required retention period and protection from damage, alteration and theft are ensured.

Document	Responsibility	Type of Storage	Place of Storage	Storage Period	Follow-up
Student records	Representative	Paper	File-folder Office Representative	3 years	Scan and destroy paper- dossier
Annual internal Review and Report	Person responsible for the annual internal review programme	Paper	File-folder Office Representative	3 years	Scan and destroy paper- dossier
Training programme / Syllabus and related documentation	HT	File Folder	Office XY	3 years	Scan and destroy paper dossier
Reporting and analysing form	Representative	EDP	P://…/Reporting	5 years	Archive
…

Note: Student related data must include details of ground, flight and simulated flight training, information on individual progress and information on the licences and associated ratings relevant to the training provided, including expiry dates of ratings and medical certificates.