Airworthiness Issue Papers (AwIPs) are primarily used to manage and communicate risks associated with complex airworthiness issues. This annex outlines the role of AwIPs and describes how they are drafted and processed.
The AwIP provides a structured format for documenting the application of Defence’s seven-step safety risk management process in accordance with the 7-step risk management process (refer DASA AC 003/2018). Other forms providing similar functionality include the AE628 Risk Decision Brief and various aircraft-bespoke forms.
An AwIP provides a template for thoroughly documenting the risk, the actions undertaken to eliminate or otherwise minimise the risk so far as reasonably practicable (SFARP) and the assessment supporting the final decision-to-proceed. The structured format facilitates improved communication between all stakeholders involved in managing a risk to airworthiness. Unlike other risk decision forms, an AwIP enables DASA to provide an independent position on the credibility and defensibility of the risk management process, prior to the final decision-to-proceed.
AwIPs must be used for managing risks associated with complex airworthiness issues, given they require a high level of visibility and sustained focus. This include issues that link to airworthiness.
That is, AwIPs are used to address complex aviation safety issues resulting from design shortfalls identified as part of a certification activity (ie MTC/MRTC/MSTC issue or major change approval), or where role and environment differences result in a safety issue with the design. In these situations the AwIP will be used to underpin the approval of a Military Certification Review Item (MCRI).
AwIPs must not be used for issues that do not have a link to airworthiness or are outside the scope of aviation safety. Examples include issues related to ground safety, logistics and hazardous materials in an aircraft’s design.
Complexity. An issue is complex if it exhibits several of the following characteristics: 11
Defining the problem or problems creating the issue may be difficult with different stakeholders perceiving the issue in varied ways, leading to uncertainty about what the issue is and how it should be resolved.
The risks associated with the issue interact with each other in complicated, dependent ways that are not necessarily well understood.
The issue has diverse stakeholders spread across both technical, operational and other domains.
The issue will require iterative risk management and thus iterative discussions amongst these diverse stakeholders.
The issue has long-term implications and consequences that extend far beyond the immediate context, both in time and scope.
The issue cannot be easily resolved with ‘quick fix’ solutions to meet timelines based on capability imperatives. Such solutions may lead to unintended and undesirable consequences.
The information required to resolve the issue is uncertain or incomplete.
The issue involves new and novel technologies that may not be well understood.
Where the AwIP is raised to document type certification-related risks, usually the applicant for the airworthiness instrument (Military Type Certificate Holder (MTCH), Project Engineering Manager (PEM) or 21J design organisation) will raise the AwIP in consultation with relevant operational staff. The person raising the AwIP should decide, in consultation with DASA, whether an issue is 'complex'.
An AwIP has two statuses, namely ‘Open’ and ‘Closed’. In the ‘Open’ status the issue remains under investigation and review (ie whilst investigation of potential controls, assessment of whether identified controls are reasonably practicable, and exploring sources of reasonable knowledge remain ongoing).
In the ‘Closed’ status, either the investigation is complete, with the risks eliminated or otherwise minimised SFARP and the risk remaining is retained; or the investigations and implementation of all reasonably practicable controls are not complete, but progressed to the stage where the issue is no longer ‘complex’. Remaining investigations and controls must be captured and tracked in the relevant safety management system. In both situations appropriate through-life controls are in place and being managed within the relevant safety management system.
Section 1 – Evaluation and Risk Management. Section 1 of the AwIP presents a combined technical and operational evaluation of the risk, in accordance with the seven-step risk management process, to demonstrate that the risk/s has been eliminated or otherwise minimised so far as reasonably practicable. The DASA AwIP template, available on the DASA website, provides guidance to assist the drafter completing each of the seven steps.
Section 2 – Authority Position. Once Section 1 is finalised, the applicant should submit the AwIP to the Authority (via the DASA Type Certification mailbox) for its position on the relevant risks 22. DASA will assess whether the documented seven steps provide a credible and defensible basis for Command risk decisions. The possible scenarios, together with the likely DASA positions, are as follows:
The risk management is credible, defensible and well argued in Section 1. DASA will provide a supporting DASA position without the need to expand on the argument.
The risk management is credible, defensible but inadequately argued in Section 1. DASA will provide a supporting DASA position that clarifies the Section 1 argument, drawing out the key matters to be considered in Section 3.
The risk management is not credible and defensible. DASA will return the AwIP for re-work of Section 1.
In rare circumstances, if the requested rework cannot be completed due to time pressures or an impasse, DASA would document a dissenting position to Command, highlighting the areas of concern, which Command can consider in developing its position.
To avoid the need for re-work or a dissenting Authority position, the Section 1 drafter should provide a draft of Section 1 to DASA prior to its formal completion.
Section 3 – Command position. Once the Authority position has been provided, the applicant/drafter will staff the AwIP to Command for a Command Position. The Command position should confirm that the risk has been eliminated or otherwise minimised SFARP, and that Command has made a decision-to-proceed.
Section 4 – Authority disposition. DASA will complete Section 4 as follows:
DASA will decide whether the AwIP will remain ‘Open’ or is now ‘Closed’, providing any closure requirements and any comments relevant to this disposition.
DASA may close an AwIP even though a risk still exists. Where the AwIP assesses that specific controls will become reasonably practicable in the future (eg a modification is being implemented but will take 24 months to incorporate across the fleet) the AwIP may be closed if DASA considers that Command could effectively manage and track the implementation of risk controls through an alternate system such as the platform hazard log.
DASA may leave an AwIP ‘Open’ where investigation into potential controls continues, until all controls have either been assessed as not reasonably practicable or reasonably practicable controls have been implemented. DASA may also decide to leave an AwIP ‘Open’ when doing so would materially contribute to safety by keeping sustained focus on the issue.
DASA will document its assurance that the Command position in Section 3 of this AwIP is congruent with the evaluation in Section 1, as possibly modified by Section 2. The term ‘congruent’ means that the Command position aligns consistently and logically with the evidence and reasoning provided in Sections 1 and 2 33
All risks evaluated in an AwIP must be subject to continuous monitoring and review, in the same way as all other aviation safety risks, regardless of whether the AwIP is ‘Open’ or ‘Closed’. Both Command, and the MTCH where applicable, should ensure that risks continue to be eliminated or otherwise minimised so far as reasonably practicable. Monitoring should identify any changes in the relevant risks (consequence, likelihood or both) and changes to the risk controls in place. Reviews conducted at a specified time, such as annually, may not be sufficient for continuous monitoring and review. Therefore, risks associated with AwIPs should be integrated into standard safety management system practices to ensure appropriate management.
Given the need for continuous monitoring and review, an ‘Open’ AwIP may move through several versions. Any changes to Section 1 should be resubmitted to the Authority for completion of a new Section 2 and later sections. Care must be taken to ensure rigorous version control.
Command is responsible for managing AwIPs. That is, Command should:
maintain visibility of an AwIP’s status and track its progress towards closure
ensure the seven-step risk management process in Section 1 is vigorously progressed
ensure that after completion of each Section, the AwIP is expeditiously forwarded to the organisation responsible for the following Section
ensure that reviews and AwIP updates occur as required
proactively maintain communications amongst relevant stakeholders
store the AwIP in an appropriate Objective folder
ensure that any alternative methods of risk management, such as platform hazard logs, are correctly established
(in-conjunction with the MTCHO) propose an AwIP should move to a different status providing suitable evidence to substantiate the proposal
AwIP assurance
DASA does not actively monitor the progress that Command makes on specific ‘Open’ AwIPs. DASA’s safety assurance role is limited to whether risks documented in the AwIP are being professionally managed. DASA may, during routine oversight, assure risks and controls are correctly captured within the relevant safety management system and that controls have been implemented and are subject to continual monitoring and review.
Additional information and templates for AwIPs can be found:
in the AwIP template accessible from the DASA website -= DASA Templates page.
Additional guidance related to TCB tailoring is contained in Chapter 7.2 and associated annexes.
in the seven-step risk management framework detailed in AC 03/2018 Risk Management in the Defence Aviation Safety Program
DASA Point of Contact: DIA-DASA Type Certification Section dasa.typecert@defence.gov.au
How does one choose between an AwIP or other risk management form?
For non-complex aviation safety issues, another RDB form (such as the AE628) may be used instead of an AwIP provided the other form documents the seven-step risk management process. In choosing an alternative form to document an airworthiness issue the person raising the AwIP must be confident that DASA’s concurrence with the risk management outcome is a ‘given’. Given the ‘decision to proceed’ on these alternatives is not informed by a documented DASA position, the person raising the AwIP may be taking on some schedule risk when using alternative RDBs late in the process for gaining a certification.
Are there any specific timings for when AwIPs should be raised?
No. DASA does not provide any specific timings on AwIPs, but they should be raised as soon as the need for an AwIP becomes evident. Processing times for AwIPs can be lengthy given multiple stakeholders. DASA’s turnaround times for processing AwIPs are advised after their formal submission to the Authority.
Do all TCB-related AwIPs result in Exception MCRIs?
No. TCB-related AwIPs should be used primarily to underpin Exception MCRIs but may occasionally be required for other types of MCRIs requiring risk decisions, for example some Special Condition MCRIs where risk decisions determine the certification requirement/standard, or Equivalent Safety Finding MCRIs relying on implementation of operational controls. DASP Manual Volume 3 Chapter 7.2 Annex A provides more information.
Is an AwIP always required to address a TCB non-compliance?
No. Equivalent risk management documentation may be used for some TCB non-compliances, depending on the context and complexity. See DASP Manual Volume 3 Chapter 7.2 Annex A for more information.
Is a separate AwIP required for every risk?
No. A single AwIP can combine multiple risks provided they are closely related and their individual risk management remains clearly documented. An AwIP may be separated into sections covering risk or annexes used to provide individual evaluation of each risk.
Can a MCRI be approved prior to closing the AwIP?
Yes. A MCRI may result in a level of risk above that represented by compliance with the Authority-prescribed design requirements and standards (ie Exception MCRIs and some Special Condition MCRIs). The MCRI can be approved against an ‘Open’ AwIP, provided Command has decided, in Section 3, to proceed with the elevated risk.
Can instruments be issued while an AwIP remains ‘Open’?
Yes. Various instruments, such as a Military Type Certificate or Military Permit to Fly, can be issued while an AwIP remains ‘Open’.
What is the preferred AwIP writing style?
Drafters should write AwIPs using clear, easy to understand, unambiguous, simple and concise language. The AwIP should avoid unnecessary verbiage and be precise enough to leave no uncertainty in the mind of the reader. Reference to other documents should not prevent readers from understanding the issues and their analysis.
Can a ‘Closed’ AwIP be reopened?
In rare circumstances, stakeholders may become aware of new information that puts in doubt the rationale for closing the AwIP. In such circumstances the AwIP may be reopened or a new AwIP raised.
Do AwIPs have a time limit for processing?
No. AwIPs might stipulate requirements for closure and an associated timeframe but in some cases, they can remain open for years. For example, a long-term project may be established to investigate potential design solutions to resolve the risk. ‘Open’ AwIPs should be reviewed and updated regularly to ensure that the risk remains eliminated or otherwise minimised so far as reasonably practicable.
Who can access AwIPs?
Since AwIPs document the management of airworthiness or flight operations issues, DASA compliance assurance staff may periodically access AwIPs as part of their ongoing assurance. AwBs may also access AwIPs as part of their ‘independent assurance function’. AwIPs are stored within the DASA’s Objective folder relevant to the issue. A central Objective AwIP folder, using the alias functionality, collocates all AwIPs for ease of access.
A risk control identified in an AwIP has been mandated by a DASA Airworthiness Directive (AD)—can the AwIP be closed if all other risk controls are implemented?
Yes. Provided all other AwIP risk controls are implemented, the AwIP could be closed. Even if the actions in the AD have yet to be implemented, the actions are mandatory and have been approved by DASA. Therefore, it is highly unlikely that DASA would wish to provide further assurance via the AwIP process for the specific risk control that is the subject of the AD.
What factors need to be considered for closure of older AwIPs?
Older AwIPs, especially those which pre-date the introduction of the DASR, will be in a different format to the four-section structure described above, and the risk assessment may not align with the contemporary 7-step risk management process. Nonetheless, it should still be clear which risk controls were assessed as reasonably practicable to inform the risk retention and decision-to-proceed.
Older format AwIPs will typically have a ‘Proposed IP Closure Criteria’ section, which may contain actions aside from implementation of risk controls. When justifying closure of older AwIPs, applicants should describe how the intent of all such actions has been met.
Applicants are also reminded of their Work Health and Safety (WHS) obligations when revisiting older AwIPs, especially obligations regarding continuous monitoring and review (ie consideration of changes in the hazard and risk context, and new possible controls).