SMS, QMS & IMS DEVELOPMENT · Aero Support Group FZCO · Updated 22 October 2026
The regulatory basis
- ICAO Annex 19 requires service providers to implement an SMS. Appendix 2 sets the framework of four components and twelve elements: safety policy and objectives, safety risk management, safety assurance and safety promotion. ICAO Doc 9859, the Safety Management Manual (fourth edition), gives the guidance. The third edition of Annex 19 becomes applicable on 26 November 2026.
- EASA sets management system requirements in each organisation rule: ORO.GEN.200 for air operators, ORA.GEN.200 for training organisations, 145.A.200 for maintenance organisations, CAMO.A.200 for continuing airworthiness management, ADR.OR.D.005 for aerodromes and ATM/ANS.OR.B.005 for air navigation service providers. Each requires safety risk management, compliance monitoring, documentation, training and a defined accountable manager.
- Part-IS adds information security management to the same management system for organisations in its scope.
- IOSA and ISAGO assess the management system in the ORG and ORM sections, including SMS and quality assurance.
- ISO 9001:2015 is not a regulatory requirement for most aviation organisations, but many use it as the framework for process management and certification.
What integration means in practice
An integrated management system (IMS) uses one set of processes to meet several requirements. In practice that means:
- one accountable manager and one management review covering safety, quality, security and emergency response;
- one hazard identification and risk assessment method, with safety, security and information security risks in a common register where that makes sense;
- one compliance monitoring and audit programme covering all the applicable requirements;
- one document control system and one manual structure, with each procedure annotated to the requirements it meets;
- one set of performance indicators reviewed together, so that a quality trend that signals a safety risk is seen by the same people.
Integration does not remove the distinct purpose of each element. The SMS still manages safety risk, compliance monitoring still checks conformity with the rules, and the security programme still meets Annex 17 and national requirements.
How ASG develops a management system
1. Assessment. We review the existing systems against Annex 19, the applicable EASA or national rules, and IOSA or ISAGO where relevant, and identify where processes duplicate or contradict each other.
2. Architecture. We design the governance structure, the risk management method, the compliance monitoring programme and the document structure for the integrated system.
3. Documentation. We draft the management system or safety management manual and the core procedures, written around how the organisation works.
4. Implementation. We set up the hazard log, risk register, safety performance indicators and safety review board, train process owners, and run the first cycle of risk assessments and reviews with the organisation.
5. Review. After a period of operation we check whether the system is producing decisions and evidence, and adjust it before the next external audit.
Where management systems fall short
- The SMS manual describes processes that are not in use, often copied from guidance material.
- Safety and quality are run by separate departments with separate audits, risk registers and reports to management.
- Safety performance indicators are counts of events with no targets, alert levels or trend analysis.
- The safety review board meets but does not record decisions or follow them up.
- Management of change is applied to large projects only and not to everyday operational changes.
- Contractors’ activities are outside the scope of hazard identification.
Services
- SMS gap analysis against Annex 19 and the applicable regulations, including the changes in the third edition of Annex 19.
- Design of integrated management systems for airlines, MROs, CAMOs, ground handlers, airports and training organisations.
- Safety management manual and management system manual drafting.
- Hazard log, risk register and SPI framework development.
- Safety review board and safety action group set-up and facilitation.
- SMS training for accountable managers, safety managers and staff.
- Ongoing support through SMS RADAR, with periodic reviews of SPIs, risk register currency and safety review board follow-up.
Conclusion
A management system earns its place when it helps management make decisions about risk and shows auditors that those decisions are followed through. Combining safety, quality and security in one structure reduces duplication and makes risks visible to the people who can act on them. ASG builds systems that work that way.
Frequently asked questions
EASA requires each approved organisation to have a management system covering safety risk management and compliance monitoring, so safety and compliance are already expected to work together. How far an organisation integrates security, environment or ISO 9001 is its own choice.
ICAO Annex 19 Appendix 2 sets four components: safety policy and objectives, safety risk management, safety assurance and safety promotion, divided into twelve elements.
The SMS manages safety risks to an acceptable level. A quality or compliance monitoring system checks that the organisation conforms to requirements and its own procedures. Each supports the other, and EASA rules place both in the same management system.
Not for regulatory purposes in most cases. Some organisations use ISO 9001 because customers ask for it or because it provides a useful process framework.
It depends on the size of the organisation and what already exists. The documentation can be produced quickly; showing that the system works takes at least one cycle of risk assessments, SPI reviews and safety review board meetings.
Key takeaways
- ICAO Annex 19 sets the SMS framework of four components and twelve elements
- EASA requires one management system per approval, with safety risk management and compliance monitoring
- Integration means one set of processes meeting several requirements
- Auditors look for a working hazard log, risk register, SPIs and safety review board
- Part-IS adds information security to the same system
Building or reviewing your management system?
Tell us your approvals and what you already have. ASG will assess your system and propose how to integrate it.