Compliance Monitoring Audit Programme for Part-145 and CAMO: The Annual Cycle and a Sample Plan
The audit programme behind 145.A.200(a)(6) and CAMO.A.200(a)(6): annual cycle, product audits, independence, extensions up to 100 % and a sample 12-month plan.
Dionysis Kefalas18 min readFor Part-145, CAMO and Air Ops staff
Part 3 of 3 in Audits, Findings and Compliance Monitoring Show parts
- 1EASA Level 1 and Level 2 Findings: Rules and Deadlines
- 2Root Cause Analysis and CAPs for EASA Audit Findings
- 3Compliance Monitoring Audit Programme: Part-145 and CAMO
Quotes checked on against 2 sources. Show sourcesHide sources
- EASA Easy Access Rules for Continuing Airworthiness (Regulation (EU) No 1321/2014) — 2 Sep 2025 revision
- EASA Easy Access Rules for Air Operations (Regulation (EU) No 965/2012) — 27 Mar 2026 revision
On this page
Three cells on the audit plan
ExampleMRO's 2026 audit plan has three cells that are not green. The brake workshop audit slipped from March to July. The night-shift product audit happened on a Tuesday afternoon. The NDT subcontractor was "covered" by a desk review of its certificate. Were all aspects of Part-145 compliance verified this year, including the subcontracted work?
A compliance monitoring audit programme answers that question. 145.A.200(a)(6) and CAMO.A.200(a)(6) require a function that monitors compliance and feeds findings back to the accountable manager. Under the AMC, an independent audit runs to a plan. For Part-145, the plan should, every year, verify all aspects of compliance, including subcontracted activities, and sample one product on each product line. Part-CAMO asks for the same annual verification. Auditors should not be responsible for what they audit. With no safety-related findings, a risk assessment and/or mitigation actions, and the competent authority's agreement, the cycle may be increased by up to 100 %.
Key facts
- All aspects, every year, including all subcontracted activities, for Part-145 and for Part-CAMO.
- One product audit per product line each year for Part-145; some audits unannounced, some at night where work happens at night.
- Listed line stations: no more than 2 years between audits. Contracted independent audit: twice every year.
- Up to 100 % longer cycle, only with no safety-related findings, a risk assessment and/or mitigation actions, and agreement by the competent authority.
- Independence: auditors are not responsible for what they audit, and the compliance monitoring function is audited too.
- Accountable manager: where follow-up is delegated, meets senior staff at least twice per year and receives at least a half-yearly summary report on non-compliance findings.
Where the programme comes from
(a)The organisation shall establish, implement and maintain a management system that includes:
[…]
(6)a function to monitor the compliance of the organisation with the relevant requirements. Compliance monitoring shall include a feedback system of findings to the accountable manager to ensure the effective implementation of corrective actions as necessary.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
CAMO.A.200(a)(6) and ORO.GEN.200(a)(6) say the same for a CAMO and an air operator in almost the same words. The AMC then asks for independence before anything else.
COMPLIANCE MONITORING — GENERAL
[…]
(b)The independence of the compliance monitoring should be established by always ensuring that audits and inspections are carried out by personnel who are not responsible for the functions, procedures or products that are audited or inspected.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
COMPLIANCE MONITORING FUNCTION
The compliance monitoring function is one of the elements that is required to be in compliance with the applicable requirements. This means that the compliance monitoring function itself should be subject to independent monitoring of compliance in accordance with 145.A.200(a)(6).
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Apply independence row by row. A brake-workshop engineer can audit the hangar but not the brake workshop, and the compliance monitoring function is audited by someone other than the compliance monitoring manager. (Two items carry the label GM1 145.A.200(a)(6); the other one covers remote audits.)
What the programme has to cover
COMPLIANCE MONITORING — INDEPENDENT AUDIT
[…]
(b)The independent audit should be an objective process of routine sample checks of all aspects of the organisation’s ability to carry out all maintenance to the standards required by this Regulation. It should include checking compliance of the organisation procedures with the Regulation, adherence of the organisation to these procedures, and product or maintenance sampling (i.e. product audit), as this is the end result of the maintenance process.
(c)The independent audit should provide an objective overview of the complete set of maintenance-related activities. It should include a percentage of unannounced audits carried out on a sample basis while maintenance is being carried out. This means that some audits should be carried out during the night for those organisations that work at night.
(d)The organisation should establish an audit plan to show when and how often the activities as required by this Regulation will be audited.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Point (b) asks three questions. Do the procedures match the Regulation? Are they followed? What does the finished product look like? Point (c) means some visits are unannounced, and night shifts get audited where they exist.
COMPLIANCE MONITORING — AUDIT PLAN
[…]
(e)A matrix can be used, as shown in the example below, to capture the two elements mentioned above. This matrix is intended to be a living document to be customised by each particular organisation depending on its scope of work and its structure. This matrix should represent the overall compliance of the audit system, and needs to be amended, as necessary, based upon any change to the applicable regulations, the procedures of the organisation or the functional areas of the organisation (e.g. a change in the scope of work to include line maintenance, etc.)
[…]
(g)The audit of each operational area will review all the topics that are applicable to the relevant functional area. For each topic, the audit should check that the particular Part-145 requirement is documented in the corresponding procedure in the exposition, and that the procedure is effectively implemented in the operational area that is being audited. In addition, the audit should also identify any practice/process implemented in the operational area which has not been documented in any procedure in the exposition.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
GM2's two elements are the topics, each tied to its requirement and exposition procedure, and the functional areas, including subcontracting. The matrix proves "all aspects"; a schedule of real hangars, workshops and suppliers against months proves "every year". Point (g) adds a check that is easy to skip: practice that no procedure describes.
How the annual cycle works
(e)Except as specified in points (h) and (j), the audit plan should ensure that all aspects of Part-145 compliance are verified every year, including all the subcontracted activities. The auditing may be carried out as a complete single exercise or subdivided over the annual period. The independent audit should not require each procedure to be verified against each product line when it can be shown that the particular procedure is common to more than one product line and the procedure has been verified every year without resultant findings. Where findings have been identified, compliance with the particular procedure should be verified against other product lines until the findings have been closed, after which the independent audit procedure may revert back to a yearly interval for the particular procedure.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
A procedure common to two product lines, verified every year without findings, need not be checked on each line. Once it draws a finding, it is checked on the other lines until the finding closes.
(f)Except as specified otherwise in point (h), the independent audit should sample check one product (such as one aircraft or engine or component) while undergoing maintenance on each product line every year as a demonstration of compliance with the maintenance procedures and requirements associated with that specific product. This should include in particular the verification of:
the maintenance data and compliance with the organisation procedures, including consideration of human factors issues;
the facility and maintenance environment;
the standard of inspection and precautions;
the completion of work cards/worksheet;
the tools and material;
the authorisation of the person carrying out maintenance.
For the purpose of this AMC, a product line includes any product under an Appendix II approval class rating as specified in the terms of approval issued to the particular organisation.
It therefore follows, for example, that a Part-145 maintenance organisation approved to maintain aircraft, engines, brakes and autopilots would need to carry out at least four complete product audits each year, except as specified otherwise in points (f), (h) or (j).
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Count product lines from the terms of approval, not the organisation chart. The six items in (f) are a ready-made product audit checklist.
(h)Except as specified otherwise in point (j), where the organisation contracts the independent audit element of the compliance monitoring function in accordance with point (l), the audit should be carried out twice every year.
(i)Except as specified otherwise in point (j), where the organisation has line stations listed as per point 145.A.75(d), the compliance monitoring documentation should include a description of how these line stations are integrated into the monitoring and include a plan to audit each listed line station at a frequency consistent with the extent of flight activity at the particular line station and the related safety hazards identified. Except as specified otherwise in point (j), the maximum period between audits of a particular line station should not exceed 2 years.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Line-station frequency is a reasoned choice under that ceiling; the sample programme below shows one.
Extending the cycle by up to 100 %
(j)Except as specified otherwise in point (f), provided that there are no safety-related findings, the audit planning cycle specified in this AMC may be increased by up to 100 %, subject to a risk assessment and/or mitigation actions, and agreement by the competent authority.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Three conditions and a ceiling: no safety-related findings, a risk assessment and/or mitigation actions, the competent authority's agreement, and no more than 100 %. An annual cycle increased by 100 % becomes 24 months, and nothing extends by default. Point (j) opens with an exception for point (f), which cross-refers to (h) and (j), so agree with your authority how an extension applies to product audits. The case rests on audit history; point (f) of AMC4 145.A.200(a)(6) ties record retention to changes in the audit planning cycle.
The CAMO version
COMPLIANCE MONITORING — INDEPENDENT AUDIT
[…]
(b)The independent audit should be an objective process of routine sample checks of all aspects of the CAMO ability to carry out continuing airworthiness management to the standards required by this Regulation. It should include some product sampling as this is the end result of the process.
[…]
(e)The audit plan should ensure that all aspects of Part-CAMO compliance are verified every year, including all the subcontracted activities, and the auditing may be carried out as a complete single exercise or subdivided over the annual period.
[…]
(f)Provided that there are no safety-related findings, the audit planning cycle specified in this AMC may be increased by up to 100 %, subject to a risk assessment and/or mitigation actions, and agreement by the competent authority.
(g)Where the organisation has more than one location approved, the audit plan should ensure that each location is audited every year or at an interval determined through a risk assessment agreed by the competent authority and not exceeding the applicable audit planning cycle.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Two differences from Part-145 stand out. A CAMO is asked for "some product sampling" rather than one product per product line; one aircraft's records traced from the maintenance programme to the last release is a sample that fits. And in a CAMO's own plan, its approved locations are the natural counterpart to a Part-145 organisation's line stations; that is a planning analogy, not wording from the AMC. The CAMO guide quotes CAMO.A.200 itself.
A sample 12-month programme for ExampleMRO
Illustration only. ExampleMRO is fictional, and so are its areas, months and people. Your programme follows your own terms of approval, exposition and competent authority.
ExampleMRO does aircraft base maintenance in one hangar, runs a brake workshop, has two listed line stations and subcontracts NDT. It has two product lines: aircraft and brakes. The compliance monitoring manager does most audits. Auditor A is a brake-workshop engineer trained as an auditor; Auditor B is an external auditor. The layout follows GM2 145.A.200(a)(6)(f): operational areas against a timetable, with planned and completed dates.
ExampleMRO compliance monitoring programme, January–December 2027 (illustration)
Key: A = area audit · P = product audit · N = night shift · U = unannounced · R = accountable manager review
Who audits what
Each choice traces to a quote. Two product lines, two product audits: one at night because the hangar works nights, one unannounced. Line station 2 was last audited in November 2025, so October 2027 stays inside the 2-year maximum. Reviews in June and December give the accountable manager the twice-yearly meeting and the half-yearly summary.
By 30 June 2027 the same plan, as a record, reads:
The planned column never changes. A moved audit gets its new date and reason beside it. That is the difference between a programme and a calendar.
When the organisation changes mid-cycle
GM2 point (e), quoted above, names three triggers for amending the matrix: a change to the regulations, the procedures or the functional areas. For ExampleMRO: a third line station, an amended Part-145 point, a new NDT supplier. Change the matrix first, then add the row or move the date, with the reason written down. Keep the old row; what was planned, and why it changed, is evidence.
Findings feed the next cycle
COMPLIANCE MONITORING — FEEDBACK SYSTEM
[…]
(c)When a non-compliance is found, the compliance monitoring function should ensure that the root cause(s) and contributing factor(s) are identified (see GM1 145.A.95), and that corrective actions are defined. The feedback part of the compliance monitoring function should define who is required to address any non-compliance in each particular case, and the procedure to be followed if the corrective action is not completed within the defined time frame.
[…]
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
Grading a finding is covered in EASA Level 1 and Level 2 findings. Reaching the root cause and writing the corrective action plan is covered in root cause and corrective action for EASA findings.
Findings also reshape next year's plan, through two points already quoted. Under AMC2 point (e), a finding against a procedure common to two product lines puts it back on both until it closes. Under point (j), a safety-related finding removes the basis for a longer cycle. If ExampleMRO's shelf-life finding is safety-related, it undercuts any case for a longer cycle in 2028. Plan a follow-up sample as well: the 2028 stores audit checks whether the shelf-life fix held.
Reporting to the accountable manager
(e)Unless the review of the results from compliance monitoring is given to the safety review board (ref. AMC1 145.A.200(a)(1) point (b)(4)), the accountable manager should hold regular meetings with staff to check the progress of corrective actions. These meetings may be delegated to the compliance monitoring manager on a day-to-day basis, provided that the accountable manager:
(1)meets the senior staff involved at least twice per year to review the overall performance of the compliance monitoring function; and
(2)receives at least a half-yearly summary report on non-compliance findings.
Quoted word for word from Regulation (EU) No 1321/2014, Easy Access Rules for Continuing Airworthiness, 2 Sep 2025 revision.
A useful half-yearly summary fits on one page: audits planned against completed, findings by area and level, overdue corrective actions, repeat findings, coverage gaps, and proposed plan changes with reasons. The compliance monitoring manager's role, including the audit plan, is set in AMC1 145.A.30(c);(ca); the rule itself is quoted in the Part-145 personnel guide. For a CAMO, the equivalent reporting text is point (e) of AMC4 CAMO.A.200(a)(6).
Air operators: ORO.GEN.200(a)(6)
The Air Operations AMC lists what to monitor and what the programme document holds. Point (b)(4) has two dated versions; the one quoted is in force on 25 September 2026.
COMPLIANCE MONITORING — GENERAL
[…]
(b)Organisations should monitor compliance with the procedures they have designed to ensure safe activities. In doing so, they should as a minimum, and where appropriate, monitor compliance with the following:
(1)privileges of the operator;
(2)manuals, logs, and records;
(3)training standards;
(4)management system procedures and manuals;
[…]
(5)activities of the organisation carried out under the supervision of the nominated persons in accordance with ORO.GEN.210(b); and
(6)any outsourced activities in accordance with ORO.GEN.205, for compliance with the contract.
[…]
(d)Compliance monitoring documentation
[…]
(2)In addition, relevant documentation should also include the following:
[…]
(vi)the compliance monitoring programme, reflecting:
(A)schedule of the monitoring programme;
(B)audit procedures including an audit plan that is implemented, maintained, and continually reviewed and improved;
(C)reporting procedures;
(D)follow-up and corrective action procedures; and
(E)recording system.
Quoted word for word from Regulation (EU) No 965/2012, Easy Access Rules for Air Operations, 27 Mar 2026 revision.
Point (d)(2)(vi) is a checklist for the programme document. This text sets no product-line or line-station frequencies, so an operator sets its own from the subjects in (b) and its risk picture. The Part-ORO management system guide covers ORO.GEN.200 as a whole.
Doing this in Avioverse
In Audits, the Programmes tab holds the plan: Programme title, Period start and Period end, Programme objective, Scope and boundaries and Applicable criteria. Each coverage requirement names an Activity, Location or Contractor, the Required audits, a Target date, and Why this coverage and frequency are appropriate. Requirements show Covered, Partly covered, Planned, Not planned, Overdue gap or Excluded. Only completed audits count, and a team audit counts once it is approved: "Planned audits alone do not close a gap." A programme closes only when every requirement is covered or excluded with a reason.
Checklists are versioned (Lock version, Edit (new version)). Add from regulation builds items from the regulation text, and when an amendment changes that text, the checklist warns you and shows In your checklist (frozen) beside In force today. The Documented / Implemented response scale fits GM2 point (g).
Schedules are One-time or Repeating; the planned date stays when you enter the actual one, and a changed date asks for a reason. Team audits have a Lead auditor, Auditor, Independent reviewer and Observer; the independent reviewer records an independence statement, approves the report and cannot review their own work. Reopening a completed audit needs a reason and keeps the earlier issue as a Preserved audit report.
The Avioverse library holds 13 checklists, including a Part-CAMO compliance checklist but no Part-145 compliance checklist; for Part-145 you build your own. Scope, independence and any extension stay with the compliance monitoring manager and the competent authority.
Where to read it yourself
Part-145 and Part-CAMO are in the EASA Easy Access Rules for Continuing Airworthiness (checked against the 2025-09-02 revision); Part-ORO is in the Easy Access Rules for Air Operations (2026-03-27 revision). Both are free from EASA. On this site, AMC and GM sit under their rule: 145.A.200 (with AMC2 and GM2 145.A.200(a)(6)), CAMO.A.200 and ORO.GEN.200.
Educational content, not regulatory compliance advice. Verify against the current regulation text before relying on it.
In this series
Frequently asked questions
How often does a Part-145 organisation have to audit itself?
AMC2 145.A.200(a)(6) says the audit plan should ensure all aspects of Part-145 compliance are verified every year, including all the subcontracted activities, either as one exercise or spread over the year. Contracted audits, line stations and the extension clause have their own points in the same AMC.
Can the compliance monitoring audit cycle be extended beyond a year?
Point (j) of AMC2 145.A.200(a)(6) and point (f) of AMC2 CAMO.A.200(a)(6) allow the audit planning cycle to be increased by up to 100 %, provided there are no safety-related findings, subject to a risk assessment and/or mitigation actions, and agreement by the competent authority. For Part-145, point (j) opens with an exception for point (f), the product audit point.
How many product audits does a Part-145 organisation need each year?
One product sampled while undergoing maintenance on each product line every year, under point (f) of AMC2 145.A.200(a)(6). The AMC gives its own example: an organisation approved for aircraft, engines, brakes and autopilots would need at least four complete product audits each year, except as specified otherwise in points (f), (h) or (j).
Can the compliance monitoring manager audit the compliance monitoring function?
The AMC says audits should be carried out by personnel who are not responsible for what is audited, and GM1 145.A.200(a)(6) says the compliance monitoring function itself should be subject to independent monitoring. In practice, someone other than the compliance monitoring manager audits it.
What does the accountable manager need to receive from compliance monitoring?
Unless the safety review board reviews compliance monitoring results, AMC4 145.A.200(a)(6) has the accountable manager hold regular meetings on corrective actions. If those are delegated to the compliance monitoring manager, the accountable manager still meets senior staff at least twice per year and receives at least a half-yearly summary report on non-compliance findings.
Related
- EASA Level 1 and Level 2 Findings: Rules and DeadlinesGuide · 17 min
- Root Cause Analysis and CAPs for EASA Audit FindingsGuide · 16 min
- Part-145 Certifying and Support StaffGuide · 7 min
- CAMO and CAO Continuing Airworthiness BodiesGuide · 5 min
- Part-ORO Operations Manual and Management SystemGuide · 5 min
- AI for EASA Compliance Monitoring ManagersArticle · 9 min
Written by Dionysis Kefalas. Retired Hellenic Air Force Captain and founder of Avioverse. About the author
Metis opens with Avioverse in October 2026 · request early access.