14 CFR § 5.71

Any person required to have an SMS under this part must develop and maintain processes and systems to acquire data with respect to its operations, products, and services to monitor the safety performance of the organization. These processes and systems must include, at a minimum, the following:

Monitoring of operational processes.

Monitoring of the operational environment to detect changes.

Auditing of operational processes and systems.

Evaluations of the SMS and operational processes and systems.

Investigations of incidents and accidents.

Investigations of reports regarding potential non-compliance with regulatory standards or other safety risk controls established by the person through the safety risk management process established in subpart C of this part.

A confidential employee reporting system in which employees can report hazards, issues, concerns, occurrences, incidents, as well as propose solutions and safety improvements, without concern of reprisal for reporting.

Investigations of hazard notifications that have been received from external sources.

Any person required to have an SMS under this part must develop and maintain processes that analyze the data acquired through the processes and systems identified under paragraph (a) of this section and any other relevant data with respect to its operations, products, and services.

Any person that holds both a type certificate and a production certificate issued under part 21 of this chapter for the same product must submit a summary of the confidential employee reports received under paragraph (a)(7) of this section to the Administrator once every 6 months.