Any person required to have an SMS under this part must apply safety risk management to the following:

(a) Implementation of new systems.

(b) Revision of existing systems.

(c) Development of operational procedures.

(d) Identification of hazards or ineffective risk controls through the safety assurance processes in subpart D of this part.

(a) When applying safety risk management, any person required to have an SMS under this part must analyze the systems identified in § 5.51. Those system analyses must be used to identify hazards under paragraph (c) of this section and in developing and implementing risk controls related to the system under § 5.55(c).

(b) In conducting the system analysis, the following information must be considered:

(1) Function and purpose of the system.

(2) The system's operating environment.

(3) An outline of the system's processes and procedures.

(4) The personnel, equipment, and facilities necessary for operation of the system.

(5) The interfaces of the system.

(c) Any person required to have an SMS under this part must develop and maintain processes to identify hazards within the context of the system analysis.

Any person required to have an SMS under this part must:

(a) Develop and maintain processes to analyze safety risk associated with the hazards identified in § 5.53(c).

(b) Define a process for conducting risk assessment that allows for the determination of acceptable safety risk.

(c) Develop and maintain processes to develop safety risk controls that are necessary as a result of the safety risk assessment process under paragraph (b) of this section.

(d) Evaluate whether the risk will be acceptable with the proposed safety risk control applied before the safety risk control is implemented.

If a person required to have an SMS under this part identifies a hazard in the operating environment, the person must provide notice of the hazard to any interfacing person that, to the best of the person's knowledge, could address the hazard or mitigate the risk. For the purpose of this section, interfacing persons are those that contribute to the safety of the certificate or Letter of Authorization holder's aviation-related products and services.