Fatigue controls often fail at the point where operational practice meets the management system. Rostering staff may identify a schedule concern, while the safety team records a hazard, and the accountable manager receives only a summary after the decision has already been made. That separation makes it difficult to show whether fatigue risk was assessed, controlled and reviewed as one process. It also creates a recurring audit problem: an operator can produce a fatigue policy and a set of duty records, but cannot demonstrate how those records changed operational decisions. The sound approach is to treat fatigue risk management as a specialised application of the operator’s safety management system, while preserving the technical judgement required for flight-time limitation and fatigue assessment.
Start with the boundary between SMS and FRMS
Under the ICAO Annex 19 SMS framework, fatigue is managed through the same broad safety cycle as other operational hazards: identify the hazard, assess the risk, apply controls, monitor performance and improve the system. A fatigue risk management system adds the specialist methods needed to do that work properly. These may include analysis of duty patterns, sleep opportunity, circadian disruption, fatigue reports, operational context and, where justified, scientific or biomathematical tools.
The two systems should therefore not be treated as competing programmes. SMS provides governance, accountability and assurance. FRMS provides the fatigue-specific risk information and controls. The operator’s approved operations and fatigue arrangements remain the controlling reference; the SMS should not be used to set aside applicable flight-time limitations or other requirements imposed by the competent authority. For operators within the EASA framework, Part-ORO and the applicable ORO.FTL requirements provide the operational and fatigue-related context. Other authorities may use different terminology or approval arrangements, so the national CAA’s requirements and accepted means of compliance must be established before the system is designed.
A useful test is to ask where a fatigue issue goes after it is reported. If it enters only a confidential reporting mailbox, it may support learning but not necessarily risk control. If it enters only the rostering process, the operator may lose the safety trend. A mature arrangement allows the report to be protected at source, analysed for safety purposes, linked to the relevant hazard or risk record, and closed only when the action and its effectiveness have been assessed.
Build one chain of evidence
The most important implementation decision is to define the evidence chain before selecting forms or software. A fatigue-related concern should be traceable from the operational signal to the management decision. The signal may be an individual fatigue report, a repeated exceedance of a roster design parameter, a stability problem in a particular duty pattern, sickness or absence information, a post-flight observation, or a trend found in crew feedback. Not every signal is proof of a fatigue event, but each should have a defined route for screening and escalation.
The risk assessment should state the hazard in operational terms. “Fatigue” is too broad to guide a control. A better description identifies the exposure and the possible consequence, such as reduced alertness during a late duty following insufficient recovery opportunity, or repeated circadian disruption in a particular roster sequence. The record should then show the existing controls, the assumptions used, the risk owner, the decision taken and the review trigger. Where a schedule is accepted with residual risk, the approving manager should be identifiable and the rationale should be retained.
Responsibility must be separated from participation. Crew members provide reports and practical observations; rostering or operations personnel design and amend duties; the fatigue specialist or nominated safety function evaluates the risk method; the compliance monitoring function checks whether the process is being followed; and the accountable manager ensures that resources and escalation routes exist. The person who creates a roster should not be the only person deciding whether a recurring fatigue exposure is acceptable. That separation is particularly important when commercial or operational pressure makes a local solution attractive.
Records should be sufficient to reconstruct the decision without exposing unnecessary personal information. A useful record normally identifies the duty or roster characteristic, the assessment date, the source of the concern, the control applied, the person responsible, the due date and the effectiveness review. Individual medical information, employment details and protected report content should be handled under the operator’s privacy and reporting arrangements, with access limited to those who need it. The safety record should retain the risk-relevant facts, not create a second personnel file.
Assure the controls, not just the paperwork
Fatigue assurance is often reduced to checking that a policy exists or that duty limits were not exceeded. Those checks remain necessary, but they do not show whether the controls are working. Compliance monitoring should examine both conformity and performance. It may sample rosters against approved limitations, verify that fatigue-related deviations were assessed, review whether reports received a response, and confirm that corrective actions were closed by an authorised person. The SMS should then use the results to identify systemic issues rather than treating each event as an isolated failure.
Performance indicators should be interpreted carefully. A rise in fatigue reports may indicate worsening conditions, but it may also show greater trust in the reporting system. A fall in reports may reflect improvement, or it may indicate that reporting has become difficult or ineffective. The meaning comes from comparing several sources: roster characteristics, duty changes, report themes, absence or operational disruption data where appropriate, and feedback from crews and managers. Indicators are prompts for investigation, not automatic measures of safety.
Management review should also record what happened after a control was introduced. If a roster change reduced a late-duty sequence, was the intended reduction achieved in actual published rosters? If additional recovery time was provided, did reports or operational observations change? If a temporary mitigation was accepted, who decided whether it could continue? These questions create the link between FRMS activity and the SMS assurance process. They also give an inspector evidence that the operator evaluates effectiveness rather than merely accumulating completed forms.
Training should reflect these responsibilities. Crew need to understand reporting routes, personal responsibilities and the limits of self-assessment. Rostering personnel need practical guidance on the approved scheme, escalation criteria and the consequences of changing a duty pattern. Safety and compliance personnel need enough fatigue knowledge to challenge weak assessments without turning every concern into a scheduling decision. Training records alone are not evidence of competence; observed application, sampled decisions and corrective actions provide stronger assurance.
The practical objective is not to create a second management system for fatigue. It is to make fatigue decisions visible inside the existing safety system, without weakening confidential reporting or operational expertise. Establish the authority requirements first, map the ownership of each decision, preserve the link between report, risk assessment and control, and test whether the control worked. When those records can be followed from an operational signal to management review, the operator can defend both the fatigue programme and the SMS as one coherent process.