ICAO Annex 19 · Doc 9859

Implement your safety management system, not a folder of Word files

Hazard identification, risk assessment, mitigation tracking and safety performance monitoring — in one place, where each fact is recorded once and every form that needs it reads the same value.

Start freeSee how it works

Free for one site. No card required.

What actually goes wrong

The same risk index, typed four times

Initial risk appears on the worksheet, the action plan, the follow-up form and the register. Change the probability in one and three documents quietly disagree with it — usually discovered during an audit.

Mitigation status that lives in somebody’s memory

A mitigation was completed in March. The follow-up form still says nothing, because updating it means opening a different file and remembering which row.

A register that is stale the day after the audit

Six documents regenerated by hand is an afternoon’s work, so it happens before an audit and not again until the next one.

One source of truth, by construction

The hazard worksheet originates every fact about a hazard. Each other document is a view of it plus, at most, a handful of fields of its own. Those fields — and only those — are editable on that form; everything else is locked and links back to where it lives.

How the hazard worksheet feeds the other five register documentsThe Hazard Work Sheet (SS-23) originates all hazard data. Five documents derive from it: the Action Plan, which owns only Time Frame; the Follow Up on Implementation (SS-35), which owns only Status of Implementation; the Safety Risk Monitoring Plan, which owns the monitoring person, activities, start date, frequency and duration; the Monitoring of Predicted Risk (SS-21), which owns the twelve monthly occurrence counts; and the Hazard Register (SS-03), which owns nothing at all.SS-23Hazard Work SheetOwns fields 1–18Every fact starts hereAction PlanOwns: Time FrameFollow Up on Implementation SS-35Owns: Status of ImplementationSafety Risk Monitoring PlanOwns: Monitoring person, activities, start date, frequency, durationMonitoring of Predicted Risk SS-21Owns: The twelve monthly occurrence countsHazard Register SS-03Owns: Nothing — every cell belongs to another form
Data-flow diagram of the six register documents.

This is enforced in the database, not by discipline. A time frame cannot be written onto a worksheet and a risk index cannot be written onto an action plan, because those columns do not exist there.

The forms, as they look on paper

Every form page reproduces its printed layout — the same columns, the same widths, the same merged cells. What you fill in on screen is what comes out of the Word export, so there is no moment of translation where something can be lost.

  • View mode reads exactly like the printed form
  • Edit mode unlocks only the fields that form owns
  • Word export renders into the controlled template
  • Multi-consequence hazards merge cells the way the paper form does
Hazard Work Sheet · SS-23
ConsequenceProb.Sev.InitialResidual
Hazards in ATM are not identified or are wrongly assessed3C3C1C
Safety management procedures are not correctly applied3D3D1D

Built on the standard

The four components of ICAO Annex 19, the 5×5 risk matrix, and ICAO terminology used precisely — hazard, consequence, safety risk, SPI, SPT.

1

Safety Policy and Objectives

Accountability, key personnel, SMS documentation

2

Safety Risk Management

Hazard identification, risk assessment and mitigation

3

Safety Assurance

Performance monitoring, management of change, improvement

4

Safety Promotion

Training, education and safety communication

For TCAA, and for everyone else

Tanzania Civil Aviation Authority

Documents render into the official TCAA templates exactly as issued — headers, footers and form codes intact. A worksheet downloaded here is the controlled SS-23, not an approximation of it.

Every other organisation

The same forms in a neutral layout carrying your logo, legal name, address and document code. These are your documents once downloaded, and they say so: the footer marks them uncontrolled, because document control is yours to run, not ours to imply.

Pricing

Start free. When your organisation is ready, we will talk to whoever approves it.

Talk to us about pricing

Tell us how many sites and coordinators you have and we will size it with you.

Get started