SMS and HSWA gap analysis for aviation operators.
A Part 100 safety management system (SMS) manages risk to aviation safety. The Health and Safety at Work Act (HSWA) asks more of the same organisation. QHSE reviews the SMS against the HSWA duties and reports on what it already covers, what it does not, and what to do about it.
Two systems, one organisation
A Part 100 SMS is built to identify hazards to aviation safety and manage the risk. The Health and Safety at Work Act covers the same organisation more widely: the health of workers as well as their safety, the hangar, the ramp and the farm airstrip, a personal due diligence duty on the chief executive and directors, worker engagement and participation, and notification of events to whichever regulator holds them.
CAA is the health and safety regulator only while an aircraft is in operation or being prepared for imminent flight. WorkSafe regulates everything else in aviation: maintenance, ground handling, airside works, the ground parts of a tour. CAA's own guidance describes the two systems as very similar and encourages operators to bring them together, but publishes little guidance on how. The join is left to the operator, and it is where things get missed.
From 1 April 2027 the Health and Safety at Work Amendment Act changes the ground again: a sharper focus on critical risks, specific provisions for PCBUs with fewer than 20 workers, and narrowed officer duties. Random drug and alcohol testing becomes mandatory for DAMP operators on 5 April 2027. Every operator has to look at its HSWA position again before then.
Who does what
What the gap analysis covers
An independent review of the SMS against the HSWA duties, with a written report the operator can act on and the work sequenced so it knows what to do first. Where the operator wants to know how the system works in practice as well as on paper, a SafePlus assessment runs alongside it.
- Risk register coverage: whether it carries occupational health and safety risk as well as aviation safety risk, how compound hazards with both consequences are handled, what controls exist for ground-side work, and what sits outside the SMS altogether.
- The regulatory boundary mapped for the operation: which activities sit with CAA and which with WorkSafe, and what that means for notification, inspection and enforcement.
- Officer due diligence: how the accountable role in the SMS lines up with the personal officer duty under HSWA for the chief executive and directors, and the evidence that shows the duty is being exercised.
- Overlapping duties with the businesses the operator works alongside: farmers and landowners, airport companies, ground handlers, tour operators and maintenance providers, with the arrangements written down.
- Worker engagement, participation and representation built into the safety committee and reporting structures the SMS already has, rather than run as a second system.
- Readiness for the 2027 changes: critical risks identified and written down, the small PCBU provisions applied where they fit, officer duties reset.
- The HSWA side of the drug and alcohol management plan: impairment policy, worker consultation and use of results.
Who it suits
Certificated operators of any size, from a single-aircraft agricultural or charter business to a multi-base operator or maintenance organisation, their chief executives and safety managers, and boards that want an independent view of where the organisation stands under HSWA.
The SMS stays the operator's. Rob Feasey, principal of QHSE, brings the health and safety law, the auditing, forty years in the industry, and the experience of having been a CAA-recognised Senior Person for SMS, so the review is done by someone who has sat on the operator's side of the SMS.
Discuss your operationSized to the business
Plenty of aviation businesses are small operations of a few people, where the owner is the director, the officer, and often the person flying, instructing, maintaining or running the job as well. The duty is the same as a large operator's, the time available is not. From April 2027 an operator with fewer than 20 workers will be able to concentrate on its critical risks, and the first job is knowing which risks those are and where the SMS already deals with them. QHSE sizes the work to that: the critical risks written down properly, controls that suit the way the business actually runs, and the officer duty evidenced without a filing cabinet of paper nobody reads.
Talk
A conversation about the operation, the certificates held, the SMS as it stands and what is worrying the operator.
Review
Documents, records and a site visit. Interviews with the chief executive, the safety manager and the people doing the work.
Report
A written report: what the SMS covers, what it does not, the boundary map, and the gaps ranked by what matters most.
Fix
Help closing the gaps where the operator wants it, sequenced ahead of April 2027, or a plan the operator runs itself.
Other work QHSE does for aviation organisations
SafePlus assessment
Run alongside the gap analysis, with each of the ten performance requirements mapped to the SMS elements it relates to, so the operator sees where the SMS covers it, where practice does, and where neither does.
Ground operations
Health and safety for hangars, ramps, workshops and stores, where WorkSafe is the regulator.
Audit
Internal audits carried out independently of the organisation's own staff, and preparation for regulatory, certification and customer audits.
Quality
Quality management system development, internal audit programme design and internal auditor training.
Investigation
Root cause analysis training so operators' own investigators work from a shared method, and independent investigation where an outside investigator is wanted.
Risk
Risk framework design and facilitated risk assessment for operational and business risk.
Governance
Board and officer due diligence for the chief executive and directors of certificated organisations.
Questions people ask
Do I need to change my SMS?
The SMS stays as it is for the review. The gap analysis looks at the SMS as it stands against the HSWA duties and reports on what it covers and what it does not. What you change afterwards is your call, and the answer is often a handful of additions to the risk register and the reporting, not a rebuild. The SMS stays yours.
Will CAA be involved?
QHSE is an independent consultancy working for you. The report is written for you and belongs to you. Your own duties to notify events do not change, and the review will tell you which regulator each kind of event goes to.
What about the parts of my operation that WorkSafe regulates?
They are in scope. The hangar, the workshop, the loading site and the ramp are where the SMS usually stops and HSWA carries on, so the review spends time there deliberately. The boundary between CAA and WorkSafe is mapped for your operation as part of the report.
How long does it take for a small operator?
For a single-aircraft or small fleet operation, usually two to three days including the site visit, with the report a week or so later. Larger or multi-site organisations are scoped after the first conversation. A fixed fee wherever possible, quoted in writing once the scope is agreed.
Can it run alongside a SafePlus assessment?
Yes, and it works well. The gap analysis tells you what the documents say. SafePlus tells you what actually happens, by talking to people at every level and watching the work. Run together they produce one set of findings rather than two reports. See the SafePlus page for how that works.
What happens after the report?
Whatever you want to happen. Some operators take the report and close the gaps themselves. Others ask QHSE to help with the parts that need an outside hand, such as the officer due diligence arrangements or the overlapping duties with landowners and airports. QHSE is available by phone afterwards either way.
Describe the operation.
Get in touch and describe the operation, the certificates held and where the SMS is at.