Quick SMS snapshot, a light start

• Tell me briefly about your current SMS program and how long you have had it in place
• In a typical month, how many safety reports does your operation receive Options: 0-10, 11-50, 51-200, 201-500, 500+
• Who owns the safety reporting process day to day, and who signs off on the risk register Options: Safety director, Accountable executive, Quality manager, Operations manager, Shared committee, Other
• Which reporting channels do your frontline teams actually use, paper forms, mobile, email, or another method Options: Paper forms, Mobile app, Email, Crew briefing reports, Hotline/phone, Other
• Describe the last audit finding related to SMS you received and the most important action you took to close it

Where the system trips you up most

• Which single recurring SMS gap most often attracts auditor attention in your operation
• How long do safety issues typically sit in your backlog before they are risk assessed or closed Options: Less than 1 week, 1-4 weeks, 1-3 months, 3-6 months, Over 6 months
• What consequences have you seen when a hazard report is delayed or ignored, for example operational disruption, recurring incidents, or audit findings
• Tell me about a time a missing process or data field caused an investigation to stall, how long did recovery take Options: Less than a day, 1-3 days, A week, Multiple weeks, Never fully recovered
• In concrete numbers, how many open high risk items are in your register today

Reporting culture and crew behavior

• Who among your frontline crews is most likely to submit a confidential report, and why do they prefer that channel
• Walk me through the last major incident investigation from initial report to closure, including timelines and key handoffs
• When was the last time you ran a campaign or training to boost reporting, and what changed afterwards Options: Within 3 months, 3-12 months ago, Over a year ago, Never run one
• How does the current reporting workflow make the investigation team's job harder or easier
• Name the training or safety promotion activity that has historically driven the most uptick in reporting Options: Tailored toolbox talks, Incentive programs, Simplified mobile reporting, Near miss review sessions, Anonymous reporting option, Other

Operational readiness and technical constraints

• If your operations IT team cannot provide API access to flight logs and crew rosters, what stops this implementation from proceeding
• List the core systems that must integrate, such as operations control, maintenance tracking, or HR roster Options: Ops control, Maintenance tracking, Crew roster/HR, Flight data recorder systems, Training records, Other
• Do you currently have a named data owner who can authorize exports from those systems Options: Yes, named and available, Yes, but limited availability, No, not yet identified, Not applicable
• Identify the person in your IT organization who will be the day to day contact for integrations and testing
• Rate the readiness of historic reporting data needed for migration, options fully ready, partially ready, not available Options: Fully ready, Partially ready, Not available, Unknown
• What compliance approvals or legal reviews might gate the timeline, for example data sharing agreements or union signoff

Hidden hazards and the risk register

• Name the unresolved risk in your register that would make you stop a deployment immediately
• Provide the count of items in your risk register that have assigned owners but no closure date Options: 0, 1-5, 6-20, 21-50, 50+
• Identify the role that verifies risk scoring consistency across bases and fleets Options: Safety analyst, Risk committee, Accountable executive, Quality manager, Operations lead, Other
• When was the risk scoring methodology last updated and who signed off on the change
• If auditors asked for evidence linking a reported hazard to corrective actions, could you produce it within your target window Options: Yes, within 1 week, Yes, within 2-4 weeks, Longer than 4 weeks, No, not currently

Competitive landscape and other paths you are weighing

• List the external vendors and internal teams you are actively evaluating to address your SMS gaps Options: Incumbent vendor, New external vendor, Internal project team build, Consulting partner only, Not sure yet
• For each option, indicate the one change most likely to make you switch from your incumbent, cost, timeline, or functionality Options: Lower cost, Shorter timeline, Better functionality for crews, Stronger audit evidence, Stronger integration support, Other
• Have any internal teams proposed solving this without an outside partner and what would their proposed timeline look like Options: Yes, short term 3-6 months, Yes, long term 6-18 months, No internal plan proposed, Not sure
• Describe the incumbent strengths that, if still present, would keep you with the current approach
• Provide the procurement or vendor evaluation milestones on your internal timeline and their expected dates

Concrete success criteria and decision triggers

• Should a pilot increase voluntary reporting by 30 percent, name the single condition that would allow you to sign the agreement within a week
• By when do you need key evidence prepared for auditors to consider the program live, for example populated risk register entries and training logs Options: Immediately, Within 30 days, 60-90 days, Over 90 days, No fixed date
• Choose the top three KPIs that will determine pilot success Options: Voluntary reporting rate, Time to close high risk items, Investigation turnaround time, Audit readiness score, User adoption by crews, Data integration completeness
• Final sign off on acceptance criteria rests with which role and who else needs to approve Options: Accountable executive, Safety director, Operations director, Quality manager, Procurement/legal
• Specify any hard no go criteria that would kill the project, such as inability to anonymize reports or lack of IT support

Timeline, budget, and final blockers

• Point to the single approval, budget line, or deadline that could stop this project before it starts
• State the tentative budget allocated for SMS implementation and the first year of support or state if undecided Options: Under $50k, $50k-$150k, $150k-$500k, Over $500k, Undecided
• Please enumerate the internal stakeholders who must sign off on the final commercial terms, procurement, legal, operations, safety Options: Procurement, Legal, Operations, Safety, Finance, Other
• By when do you aim to achieve go live validation across your bases and fleets Options: Within 30 days, 30-90 days, 3-6 months, 6-12 months, No date set
• Should the project pause for union consultation, what is your expected timeframe to resume Options: Less than 2 weeks, 2-4 weeks, 1-3 months, Over 3 months, Unknown

Final check and agreed next steps

• Point to the single internal change that would accelerate your decision from evaluation to mutual commit
• Propose a target date to schedule a pilot kickoff assuming required integrations and approvals are in place Options: Within 2 weeks, 2-6 weeks, 6-12 weeks, Quarter+ depending on approvals, TBD
• Do you want a follow up workshop to model your risk register mapping and pilot success criteria Options: Yes, schedule now, Maybe, after internal review, No
• Indicate the artifacts you would like prepared before that workshop, for example evidence pack, integration checklist, training plan Options: Evidence package for auditors, Integration checklist with owners, Training overview and schedule, Pilot success criteria, Data migration plan, Other
• Finally, who on your team should receive the meeting notes and next step actions, include name and role

• Solution Experience Session

• Confirm the current state and its cost to your team
• You confirm the demonstrated workflow eliminates the gap between frontline reports and the risk register.
• Provide three recent incident reports and an export of the current risk register for the pilot mapping exercise.
• Map a real reporting scenario end-to-end
• You confirm the generated audit evidence would satisfy your most recent regulatory findings.
• Deliver a tailored mapping document that shows how the SMS framework will populate the buyer's risk register and produce the audit evidence package for one selected scenario.
• Demonstrate audit scenario evidence assembly
• Prepare and deliver a sample audit evidence package for one regulatory scenario before the follow-up meeting.
• You agree on concrete pilot acceptance criteria and the next evidence the seller will deliver.
• Identify the IT owner and available integration windows for data sources needed in the pilot.
• Validate role access and multi-base, multi-fleet coverage
• Is this what you meant when you said you needed better reporting, a live risk register, and audit-ready evidence?
• Agree next steps and acceptance criteria for pilot

• Solution Experience Session
• Solution Experience Deck
• Solution Brief

• meeting
• slides
• document

• Deliver SMS Policy and Manual
• Develop Hazard Reporting Forms and Workflows
• Install Voluntary Safety Reporting Portal
• Configure Anonymous and Confidential Reporting
• Implement Risk Register with Controls Tracking
• Configure Investigation and Case Management Workflows
• Provide Root-Cause Analysis Investigation Templates
• Deploy Trend Analysis and KPI Dashboards
• Execute Safety Assurance Audit Program
• Deliver Safety Promotion and Reporting Training
• Migrate Existing Safety Records and Incidents
• Configure Role-Based Access and Multi-Base Permissions
• Provide Regulatory Audit Preparation Toolkit and Evidence Pack

Deliver SMS Policy and Manual

• Which SMS standard must the delivered policy and manual satisfy for your operation (select all that apply)? Options: ICAO Annex 19, FAA Part 5 (14 CFR Part 5), IS-BAO, IOSA, Other / Custom
• How many organizational manuals or local procedures need alignment into the single SMS manual (examples: operations manual, maintenance procedures, ground handling SOPs)? Options: 1-3, 4-7, 8+
• Do you require the manual to include base-specific sections (for example separate chapters for Base A dispatch vs Base B maintenance)? Options: Yes, No
• Who will provide the existing policy documents, gap assessment report, and current safety procedures for incorporation into the manual?
• What acceptance criteria will confirm the policy and manual deliverable is complete (for example: traceability matrix to ICAO Annex 19 clauses, sign-off by accountable executive, and version-controlled PDF package)?
• Which distribution format do you require for the manual at handover (select all that apply)? Options: Printable PDF, Searchable HTML site, Editable Word/Google Doc, Platform-embedded knowledge base

Develop Hazard Reporting Forms and Workflows

• Which frontline groups must have dedicated reporting forms (examples: flight crew, maintenance technicians, ground handling, cabin crew)? Options: Flight crew, Maintenance, Ground handling, Cabin crew, Air Traffic / Third parties, Other
• What fields are mandatory on your occurrence report form (examples: tail number, flight number, UTC timestamp, duty position, narrative)?
• Do you require forms for both voluntary safety reports and mandatory occurrence reports (MOR) mapped to regulatory timelines? Options: Yes, both, Voluntary only, Mandatory only
• How should your reporting workflow escalate high-risk reports (examples: immediate SMS alert to accountable executive, operational pause request to dispatch)?
• Which integrations must reporting forms support at submission (examples: attach to maintenance tracking record, create a case in investigation workflow, post to internal SLACK/email distribution)?
• Are there regulatory or union constraints that affect what fields can be collected or how anonymity is preserved on forms? Options: Yes, No

Install Voluntary Safety Reporting Portal

• Which access methods do you require for the portal (examples: web browser, mobile app, intranet single sign-on)? Options: Web browser, Mobile web / responsive, Native mobile app, Intranet SSO
• How many bases and remote locations should be reachable by the portal without VPN (provide count of bases and remote user groups)? Options: 1-3, 4-10, 11+
• Which languages must the portal support at launch (examples: English, Spanish, French, local base language)?
• Do you require integration between the portal and your rostering or crew scheduling system to pre-fill duty data (e.g., flight number, sector)? Options: Yes, No
• What uptime and response SLA do you require for the reporting portal during peak operations (examples: 99.5% uptime, <3 sec page load from regional office)? Options: Standard (99%), High (99.5%), Critical (99.9%)
• Which authentication options must the portal support for your workforce (examples: SAML SSO, OAuth via corporate identity provider, local accounts)? Options: SAML SSO, OAuth / OIDC, Local accounts, Other

Configure Anonymous and Confidential Reporting

• Which reporting modes do you require: fully anonymous, confidential (identity hidden from investigators), or both? Options: Anonymous only, Confidential only, Both anonymous and confidential
• How should you handle follow-up questions for anonymous reporters (examples: secure one-way reply token, offering web case ID for updates)?
• Are there regulatory constraints in your jurisdiction on anonymous reporting tied to FAA or local civil aviation authority guidance? Options: Yes, No
• Which data fields must be redacted automatically when a report is marked anonymous (examples: reporter name, employee ID, contact email)?
• Who in your organization should retain the ability to un-redact confidential reports and under what documented authority (examples: accountable executive, safety manager)?
• How will you verify anonymous mode preserves unlinkability to personnel records (for example: demonstration of hashed identifiers and audit log showing no reversible mapping)?

Implement Risk Register with Controls Tracking

• Which risk taxonomy do you use today that should map into the register (examples: severity x probability matrix, ICAO risk matrix, company risk categories)? Options: ICAO matrix, Company custom matrix, FAA guidance matrix, Other
• How many active hazards or existing register entries must be migrated into the new risk register at cutover? Options: None, 1-50, 51-200, 200+
• Which controls tracking fields are required (examples: control owner, implementation date, verification evidence, residual risk score)?
• What verification frequency do you require for control effectiveness reviews (examples: monthly for high-risk, quarterly for medium-risk)? Options: Monthly, Quarterly, Bi-annual, Annual
• Which integrations should feed the risk register automatically (examples: maintenance deferred defects, flight data monitoring events, safety reports)?
• How will you measure success for controls tracking (examples: percent of controls verified within scheduled window, reduction in high-severity residual risk by X%)?

Configure Investigation and Case Management Workflows

• What investigation types must the case management support (examples: Level 1 safety reports, Level 2 occurrence investigations, regulatory MOR investigations)? Options: Level 1 / simple, Level 2 / complex, Regulatory MOR, All of the above
• How many concurrent investigations do you expect the system to manage at peak (estimate active cases per month)? Options: 1-10, 11-50, 51-200, 200+
• Which evidence types must be attachable to a case (examples: aircraft technical log snapshots, CVR/FDR analysis summaries, photos, witness statements)?
• Do you require role-based gating on investigative steps (for example only a nominated investigator can close a root-cause field or only accountable executive can approve corrective action)? Options: Yes, No
• Which workflow automation rules would you like configured (examples: auto-assign investigator when severity >= X, escalate overdue cases after 14 days)?
• Are regulatory timelines required to be enforced in the workflow (examples: MOR submission within 72 hours to authority)? Options: Yes, No

Provide Root-Cause Analysis Investigation Templates

• Which RCA (root-cause analysis) methods do you prefer for templates (examples: 5 Whys, Fault Tree Analysis, Human Factors analysis, SHELL model)? Options: 5 Whys, Fault Tree Analysis, Human Factors / SHELL, Bow-Tie
• How many template categories do you need (examples: technical, human factors, organizational, environmental)? Options: 1-2, 3-4, 5+
• Which output artifacts must templates produce for each investigation (examples: CAPA list, action owners, verification dates, lessons-learned memo)?
• Do you require templates to include regulatory cross-reference mapping (for example mapping findings to FAA Part 5 or ICAO Annex 19 clauses)? Options: Yes, No
• Who in your organization will approve RCA templates before they are published (examples: safety manager, accountable executive, head of maintenance)?
• How should RCA templates capture human factors inputs (examples: pre-populated HF checklists, sequence of events timeline, fatigue and duty roster context)?

Deploy Trend Analysis and KPI Dashboards

• Which KPIs must be visible on operational dashboards at go-live (examples: reporting rate per 1,000 staff flight hours, open corrective actions by aging, high-risk events per 10,000 sectors)?
• How many distinct dashboard views are required (examples: executive, safety team, base managers, investigators)? Options: 1-2, 3-5, 6+
• Which data sources will feed dashboards (examples: voluntary reports, FOQA/flight data monitoring, scheduled maintenance logs, HR roster)?
• What reporting cadence do you require for scheduled KPI exports (examples: daily operational brief, weekly safety digest, monthly audit pack)? Options: Daily, Weekly, Monthly, Custom cadence
• Do you need configurable thresholds that trigger alerts on dashboards (examples: reporting rate drop >30%, unverified controls past due 14 days)? Options: Yes, No
• Which visualization types are preferred for specific KPIs (examples: heatmaps for base risk, trend lines for reporting rate, bar charts for action aging)?

Execute Safety Assurance Audit Program

• Which audit scope do you expect for the initial safety assurance program (examples: SMS system audit, operations process audit, maintenance process audit)? Options: SMS system, Operations, Maintenance, Combined
• How many sites or bases must be included in the initial audit wave? Options: 1, 2-5, 6-15, 16+
• What evidence types should audit checklists require (examples: completed training rosters, risk register snapshots, investigation case files)?
• Do you require auditor credentials to align to a standard (examples: IOSA audit experience, certified safety auditor training)? Options: Yes, No
• How will you accept the audit program deliverable (examples: signed audit report, prioritized findings register, remediation plan with owners)?
• Are recurring audit cadences needed to demonstrate safety assurance over time (examples: quarterly sampling, annual full program)? Options: Yes, No

Deliver Safety Promotion and Reporting Training

• Which target audiences must receive training at go-live (examples: flight crew initial briefing, maintenance technicians, ground handling supervisors)?
• What training delivery modes do you prefer (examples: instructor-led sessions, e-learning modules, on-the-job briefings)? Options: Instructor-led, E-learning, On-the-job, Blended
• How will you measure training effectiveness for safety promotion (examples: post-training quiz >=80%, increase in reporting rate by X%)?
• Do you require role-based variants of reporting training (for example separate training for supervisors on how to handle reports vs frontline reporters)? Options: Yes, No
• Which languages and local regulatory references must be included in training materials (examples: FAA reference, local CAA rules, union agreements)?
• When should refresher training be scheduled after go-live (examples: 3 months, 6 months, annually)? Options: 3 months, 6 months, Annually, Custom cadence

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Subscription Agreement & Order Form
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Multi-Base & Multi-Fleet Operational Responsibilities Addendum
• Deployment Acceptance Certificate
• Training & Knowledge Transfer Agreement
• Change Order Agreement
• Aviation Regulatory Compliance Addendum

• Go-Live Health Check (Week 1-4)
• First Measurement Review (Week 4-10)
• Acceptance Gate Review (Around Day 90)
• Quarterly Success Review

• Prepare the audit evidence package checklist for the next scheduled audit cycle and flag any gaps for immediate action.
• Update the shared dashboard to include metric definitions and target lines from Solution Scope.
• Schedule the Acceptance Gate meeting and circulate the required evidence list from Solution Scope.
• Restate acceptance criteria and numeric targets
• Produce a documented pass or fail decision for each acceptance criterion recorded in Solution Scope.
• If any criterion failed, agree remediation items, owners, and resolution dates until criteria are met.
• Confirm the mechanism and named signatory for recording the acceptance decision as required for this engagement.
• Publish the acceptance decision record and upload the evidence package to the shared workspace.
• Create remediation tickets for any failed criteria with owners, acceptance checks, and resolution deadlines.
• Confirm the ongoing realization tracking cadence and schedule the first Quarterly Success Review.
• Trend review of operational KPIs
• Confirm whether operational KPIs are at or moving toward targets recorded in Solution Scope and identify any outliers requiring action.
• Resolve or re-prioritize persistent issues and agree next steps for the top three items.
• Ensure enhancement requests are triaged and scheduled or assigned for owner follow-up in the shared channel.
• Update the risk register with newly identified hazards, assign owners, and set mitigation timelines.
• Publish the prioritized enhancement backlog and estimated delivery windows in the shared channel.
• Reconfirm committed success criteria and owners
• Confirm integrations and core deployment components are functioning as expected.
• Identify the top three blockers and commit remediation actions with target dates.
• Verify initial training enrollment and basic user provisioning status for operational teams.
• Publish the go-live validation checklist with current statuses and target resolution dates in the shared workspace.
• Provide access logs and the initial count of safety reports submitted for review at the First Measurement meeting.
• Create remediation tickets for each blocker in the shared channel with target resolution dates.
• Present first outcome data
• Determine whether hazard reporting volume and reporter penetration are trending toward targets and document any shortfalls.
• Assign corrective actions with deadlines to address the primary root causes.
• Confirm the Acceptance Gate date and evidence checklist aligns with targets recorded in Solution Scope.
• Deliver a root-cause analysis for any metric below target with recommended fixes and timelines.
• Present outcome data against each criterion
• Persistent issues and remediation status
• Deployment and integration validation
• Root-cause diagnosis for any metric gaps
• Document pass/fail per criterion and formal acceptance decision
• Early adoption signals and usage patterns
• Enhancement request backlog and prioritization
• Agree corrective actions and owners
• Audit readiness and evidence package check
• Agree remediation plan for any failed criteria
• Blockers and open issues triage
• Confirm timeline to Acceptance Gate and required evidence
• Review progress on Go-Live blockers
• Publish acceptance record and next steps
• Confirm next-quarter checkpoints
• Agree immediate remediation actions and timeline