ADR.OR.D.005 Management system

INTEGRATED MANAGEMENT SYSTEM To ensure the implementation of an integrated management system, the aerodrome operator should identify the following elements in its management system’s structure and documentation:

(a)the organisations certified or declared under Regulation (EU) 2018/1139, and its delegated and implementing acts, that are covered by its management system;

(b)the domains that are integrated in its management system, with the proper interfaces that enable effective functioning and communication between them; and

(c)applicable requirements for each domain. [applicable from 27 March 2028 — ED Decision 2025/009/R]

SAFETY MANAGEMENT SYSTEM The safety management system of an aerodrome operator should encompass safety by establishing an organisational structure for the management of safety proportionate and appropriate to the size of the aerodrome operator, and the nature and type of operations. The organisational structure should include a Safety Review Board, and depending on its organisational complexity and structure, a Safety Services Office to assist the work of the safety manager, in accordance with paragraph (a) and (b) below:

(a)Safety Services Office

(1)The safety manager (see ADR.OR.D.015 and AMC1 ADR.OR.D.015(c)) should be responsible for the operation of the Safety Services Office which should be independent and neutral in terms of the processes and decisions made regarding the delivery of services by the line managers of operational units.

(2)The function of the Safety Services Office should be to:

(i)manage and oversee the hazard identification system;

(ii)monitor safety performance of operational units directly involved in aerodrome operations;

(iii)advise senior management on safety management matters; and

(iv)assist line managers with safety management matters.

(3)Operators of multiple aerodromes should either establish a central Safety Services Office and appropriate safety departments/functions at all aerodromes or separate Safety Services Office at each aerodrome. Arrangements should be made to ensure continuous flow of information and adequate coordination.

(b)Safety Review Board

(1)The Safety Review Board should be a high level committee that considers matters of strategic safety in support of the accountable manager’s safety accountability.

(2)The Safety Review Board should be chaired by the accountable manager, and be composed of heads of functional areas.

(3)The Safety Review Board should monitor:

(i)safety performance against the safety policy and objectives;

(ii)that any safety action is taken in a timely manner; and

(iii)the effectiveness of the organisation’s safety management processes.

(4)The Safety Review Board should ensure that appropriate resources are allocated to achieve the established safety performance.

(5)The safety manager or any other relevant person may attend, as appropriate, Safety Review Board meetings. He/she may communicate to the accountable manager all information, as necessary, to allow decision making based on safety data.

(6)Operators of multiple aerodromes should either establish a central Safety Review Board, or separate Safety Review Boards for each aerodrome or group of aerodromes. In the case of central or group Safety Review Groups, they should ensure that all aerodromes are represented in the Safety Review Board, at the appropriate management level. Arrangements should be made to ensure continuous flow of information and adequate coordination. In less complex aerodrome organisations/operations, the aerodrome operator should nominate a person who fulfils the role of safety manager, and who is responsible for coordinating the safety management system (see ADR.OR.D.015 and AMC1 ADR.OR.D.015(c)).

SAFETY REVIEW BOARD — SAFETY ACTION GROUP

(a)Safety Review Board Depending on the size of the organisation, the type and complexity of operations, the responsibilities of the Safety Review Board may be included in other high level committees of the organisation.

(b)Safety Action Group

(1)A Safety Action Group may be established as a standing group, or as an ad hoc group to assist or act on behalf of the Safety Review Board.

(2)More than one safety action group may be established depending on the scope of the task and specific expertise required.

(3)A Safety Action Group should report to, and take strategic direction from the Safety Review Board, and should be comprised of managers, supervisors, and personnel from operational areas.

(4)The Safety Action Group should:

(i)monitor operational safety;

(ii)resolve identified risks;

(iii)assess the impact on safety of operational services;

(iv)ensure that safety actions are implemented within agreed timescales.

(5)The Safety Action Group should review the effectiveness of previous safety recommendations and safety promotion.

SAFETY SERVICES OFFICE — SAFETY REVIEW BOARD — SAFETY ACTION GROUP Different titles may also be used for the Safety Services Office, the Safety Review Board, and the Safety Actions Group.

SAFETY POLICY

(a)The safety policy should:

(1)be endorsed by the accountable manager;

(2)clearly identify safety as the highest organisational priority over commercial, operational, environmental, or social pressures;

(3)reflect organisational commitments regarding safety and its proactive and systematic management;

(4)be communicated, with visible endorsement, throughout the organisation;

(5)include safety-reporting principles; and

(6)be periodically reviewed to ensure that it remains relevant and appropriate to the organisation.

(b)The safety policy should:

(1)include a commitment:

(i)to improve towards the highest safety standards;

(ii)to comply with all applicable legal requirements, meet all applicable standards, and consider best practices;

(iii)to provide appropriate resources;

(iv)to enforce safety as one primary responsibility of all managers and staff; and

(v)to apply ‘just culture’ principles in accordance with Regulation (EU) No 376/2014, and, in particular, not to make available or use the information on occurrences:

(A)to attribute blame or liability to front line personnel or other persons for actions, omissions or decisions taken by them that are commensurate with their experience and training; or

(B)for any purpose other than the maintenance or improvement of aviation safety;

(2)include the safety-reporting procedures;

(3)with reference to a ‘just culture’, clearly indicate which types of operational behaviours are unacceptable, and include the conditions under which disciplinary action would not apply; and

(4)be periodically reviewed to ensure that it remains relevant and appropriate.

(c)Senior management should:

(1)continually promote the safety policy to all personnel, and demonstrate their commitment to it;

(2)provide necessary human and financial resources for its implementation; and

(3)establish safety objectives and performance standards.

SAFETY POLICY Safety policy — General The safety policy is the means whereby the aerodrome operator states its intention to maintain and, where practicable, improve safety levels in all its activities, and to minimise its contribution to the risk of an aircraft accident as far as reasonably practicable. It reflects the management’s commitment to safety, demonstrates the aerodrome operator’s philosophy of safety management, and becomes the foundation on which the aerodrome operator’s management system is built. It serves as a reminder of ‘how we do business here’. The creation of a positive safety culture begins with the issuance of a clear and unequivocal direction. The commitment to apply ‘just culture’ principles forms the basis for the aerodrome operator’s internal rules describing how ‘just culture’ principles are guaranteed and implemented, as required by Article 16(11) of Regulation (EU) No 376/2014.

HAZARD IDENTIFICATION PROCESS

(a)Hazard identification should be based on a combination of reactive, proactive, and predictive methods of safety data collection. Reactive, proactive, and predictive schemes for hazard identification should be the formal means of collecting, recording, analysing, acting on, and generating feedback about hazards and the associated risks that affect safety.

(b)All reporting systems, including confidential reporting schemes, should include an effective feedback process.

HAZARD IDENTIFICATION

(a)Hazard identification — General

(1)Hazard identification may include the following factors and processes:

(i)design factors, including equipment and task design;

(ii)procedures and operating practices, including their documentation and checklists, and their validation under actual operating conditions;

(iii)communications, including means, terminology, and language;

(iv)personnel factors, such as company policies for recruitment, training, remuneration, and allocation of resources;

(v)organisational factors, such as the compatibility of production and safety goals, the allocation of resources, operating pressures, and the corporate safety culture;

(vi)work environment factors, such as ambient noise and vibration, temperature, lighting, and the availability of protective equipment and clothing;

(vii)regulatory oversight factors, including the applicability and enforceability of regulations, the certification of equipment, personnel, and procedures, and the adequacy of oversight;

(viii)defences, including such factors as the provision of adequate detection and warning systems, the error tolerance of equipment, and the resilience of equipment to errors and failures; and

(ix)human performance, restricted to medical conditions and physical limitations.

(2)Hazard identification may use internal and external sources.

(i)Internal sources:

(A)voluntary occurrence reporting schemes;

(B)safety surveys;

(C)safety audits;

(D)normal operations monitoring schemes;

(E)trend analysis;

(F)feedback from training; and

(G)investigation and follow-up of incidents

(ii)External sources:

(A)accident reports;

(B)state mandatory occurrence reporting system; and

(C)state voluntary reporting system.

(3)The methods used for hazard identification depends on the resources and constraints of each particular aerodrome operator, and on the size and the complexity of the operations. Nevertheless, hazard identification, regardless of implementation, complexity and size, is part of the aerodrome operator’s safety documentation. Under mature safety management practices, hazard identification is a continuous, on-going daily activity. It is an integral part of the aerodrome operator’s processes. There are three specific conditions under which special attention to hazard identification should be paid. These three conditions should trigger more in depth and far reaching hazard identification activities and include:

(i)any time that the aerodrome operator experiences an unexplained increase in safety related events or regulatory infractions;

(ii)any time major operational changes are foreseen, including changes to key personnel or other major equipment or systems; and

(iii)before and during periods of significant organisational change, including rapid growth or contraction, corporate mergers, acquisitions, or downsizing.

(4)Hazard identification may use the following tools and techniques:

(i)brainstorming which is an unbounded but facilitated discussion with a group of experts;

(ii)Hazard and Operability (HAZOP) Study which is a systematic and structured approach using parameter and deviation guidewords. This technique relies on a very detailed system description being available for study, and usually involves breaking down the system into well-defined subsystems and functional or process flows between subsystems. Each element of the system is then subject to discussion within a multidisciplinary group of experts, against the various combinations of the guidewords and deviations;

(iii)checklists, which are lists of known hazards or hazard causes that have been derived from past experience. The past experience could be previous risk assessments, or similar systems, or operations, or from actual incidents that have occurred in the past. The technique involves the systematic use of an appropriate checklist, and the consideration of each item on the checklist for possible applicability to a particular system. Checklists should always be validated for applicability prior to use;

(iv)Failure Modes and Effects Analysis (FMEA), which is a ‘bottom up’ technique, used to consider ways in which the basic components of a system can fail to perform their design intent. The technique relies on a detailed system description, and considers the ways in which each sub-component of the system could fail to meet its design intent, and what the consequences could be for the overall system. For each sub-component of a system the FMEA should consider:

(A)all the potential ways that the component could fail;

(B)the effects that each of these failures would have on the system behaviour;

(C)the possible causes of the various failure modes; and

(D)how the failures might be mitigated within the system or its environment. The system level at which the analysis is applied can vary, and is determined by the level of detail of the system description used to support the analysis. Depending on the nature and complexity of the system, the analysis could be undertaken by an individual system expert, or by a team of system experts acting in group sessions.

(v)the Structured What-If Technique (SWIFT) is a simple and effective alternative technique to HAZOP and involves a multidisciplinary team of experts. It is a facilitated brainstorming group activity, but is typically carried out on a higher level system description, having fewer sub-elements, than for HAZOP and with a reduced set of prompts.

(5)Identified hazards should be registered in a hazard log (hazard register). The nature and format of such a hazard log may vary from a simple list of hazards to a more sophisticated relational database linking hazards to mitigations, responsibilities, and actions. The following information should be included in the hazard log:

(i)unique hazard reference number against each hazard;

(ii)hazard description;

(iii)indication of the potential causes of the hazard;

(iv)qualitative assessment of the possible outcomes and severities of consequences arising from the hazard;

(v)qualitative assessment of the risk associated with the possible consequences of the hazard;

(vi)description of the existing risk controls for the hazard; description of additional actions that are required to reduce safety risks, as well as target date of completion; and

(vii)indication of responsibilities in relation to the management of risk controls.

(6)Additionally, the following information may also be included in the hazard log:

(i)a quantitative assessment of the risk associated with the possible consequences of the hazard;

(ii)record of actual incidents or events related to the hazard, or its causes;

(iii)risks tolerability statement;

(iv)statement of formal system monitoring requirements;

(v)indication of how the hazard was identified;

(vi)hazard owner;

(vii)assumptions; and

(viii)third party stakeholders.

(b)Hazard identification — Indicators

(1)Reactive (lagging) indicators: Metrics that measure events that have already occurred and that impact on safety performance. As reactive indicators only reflect system failures, their use can only result in determining a reactive response. Although they do measure failure to control hazards, they do not normally reveal why the system failed, or if there are any latent hazards.

(2)Proactive (leading) indicators: Metrics that measure inputs to the safety system (either within an organisation, a sector, or across the total aviation system) to manage and improve safety performance. Proactive indicators indicate good safety practices being introduced, developed, and adapted which by their inclusion seek to establish a proactive safety environment that engenders continuous improvement. They provide useful information when accident and incident rates are low to identify latent hazards and potential threats, and consequent opportunities for improvement. There should always be a connection between a proactive indicator and the unwanted outcomes (or reactive indicators) that their monitoring is intended to warn against.

(3)Predictive indicators (precursor events): These metrics can be considered as indicators that do not manifest themselves in accidents or serious incidents. They indicate less severe system failures or ‘near misses’ which when combined with other events may lead to an accident or serious incident. In a large organisation, a mature safety management system should include all of these measures. Risk management effort, however, should be targeted at leading indicators and precursor events.

SAFETY RISK ASSESSMENT AND MITIGATION

(a)A formal safety (risk) assessment and mitigation process should be developed and maintained that ensures analysis (in terms of probability and severity of occurrence), assessment (in terms of tolerability), and control (in terms of mitigation) of risks.

(b)The levels of management who have the authority to make decisions regarding the tolerability of safety risks, in accordance with (a) above, should be specified in the aerodrome manual.

SAFETY RISK ASSESSMENT AND MITIGATION Safety (risk) assessment is the analysis of the safety risks of the consequences of the hazards that have been determined. Safety risk analysis breaks down the risks into two components — the probability of occurrence of a damaging event or condition, and the severity of the event or condition, should it occur. Safety risk decision making and acceptance should be specified through a risk tolerability matrix. The definition and final construction of the matrix should be left to the operator to design, be documented in the aerodrome manual, and be subject to an approval by the Competent Authority.

SAFETY PERFORMANCE MONITORING AND MEASUREMENT

(a)Safety performance monitoring and measurement should be the process by which the safety performance of the aerodrome operator is verified in comparison to the safety policy and objectives, identified safety risks and the mitigation measures.

(b)This process should include the setting of safety performance indicators and safety performance targets, and measuring the aerodrome operator’s safety performance against them.

SAFETY PERFORMANCE MONITORING AND MEASUREMENT

(a)The performance monitoring and measurement process should include:

(1)safety reporting, addressing also the status of compliance with the applicable requirements;

(2)safety studies which are rather large analyses encompassing broad safety concerns;

(3)safety reviews including trends reviews which are conducted during introduction and deployment of new technologies, change or implementation of procedures, or in situations of structural change in operations, or to explore increase in incidents or safety reports;

(4)safety audits which focus in the integrity of the aerodrome operator’s management system, and periodically assess the status of safety risk controls;

(5)safety surveys, which examine particular elements or procedures of a specific operation, such as problem areas or bottlenecks in daily operations, perceptions and opinions of operational personnel, and areas of dissent or confusion; and

(6)internal safety investigations whose scope should extend the scope of occurrences required to be reported to the Competent Authority;

(b)The following generic aspects/areas could be considered:

(1)accountability for management of the operational activities and its ultimate accomplishment;

(2)authority to direct, control, or change the procedures, as well as to make key decisions such as safety risk acceptance decisions;

(3)procedures for operational activities;

(4)controls, including hardware, software, special procedures or procedural steps, and supervisory practices designed to keep operational activities on track;

(5)interfaces, including lines of authority between departments, lines of communication between employees, consistency of procedures, and clear delineation of responsibility between organisations, work units, and employees; and

(6)process measures to provide feedback to responsible parties that required actions are taking place, required outputs are being produced, and expected outcomes are being achieved.

THE MANAGEMENT OF CHANGE The aerodrome operator should manage safety risks related to a change. The management of change should be a documented process to identify external and internal change that may have an adverse effect on safety. It should make use of the aerodrome operator’s existing hazard identification, safety (risk) assessment, and mitigation processes.

THE MANAGEMENT OF CHANGE

(a)Change can introduce new hazards, impact the appropriateness and/or effectiveness of existing safety risk mitigation strategies. Changes may be external to the organisation, or internal.

(b)A formal process for the management of change should take into account the following considerations:

(1)criticality of systems and activities;

(2)stability of systems and operational environments; and

(3)past performance.

(c)System description is one of the fundamental preliminary activities in the planning of the safety management system, to determine a baseline hazard analysis for the baseline system. As part of the formal process of the management of change, the system description and the baseline hazard analysis should be reviewed periodically, even if circumstances of change are not present, to determine their continued validity. When changes to the system are made, and periodically thereafter, the aerodrome operator should go over its system and its actual operational environment, in order to make sure it continues to be fully aware of the circumstances under which the provision of services takes place. With regard to the management of change and safety (risk) assessments related to changes, see also ADR.OR.B.040 and GM1 ADR.OR.B.040(f).

CONTINUOUS IMPROVEMENT OF THE SAFETY MANAGEMENT SYSTEM The aerodrome operator should continuously seek to improve its safety performance. The aerodrome operator should develop and maintain a relevant formal process. Continuous improvement should be achieved through:

(a)proactive and reactive evaluation of facilities, equipment, documentation, and procedures;

(b)proactive evaluation of an individual’s performance, to verify the fulfilment of that individual’s safety responsibilities; and

(c)reactive evaluations in order to verify the effectiveness of the system for control and mitigation of safety risks.

CONTINUOUS IMPROVEMENT OF THE SAFETY MANAGEMENT SYSTEM Continuous improvement of the safety management system, as part of the safety assurance, is achieved through the application of:

(a)internal evaluations;

(b)independent audits (both internal and external);

(c)strict document controls; and

(d)continuous monitoring of safety controls and mitigation actions.

SAFETY MANAGEMENT SYSTEM TRAINING

(a)The aerodrome operator should establish a safety management system training programme for all aerodrome operations, rescue and firefighting, and maintenance personnel, including all management personnel of the aerodrome (e.g. supervisors, managers, senior managers, and the accountable manager), regardless of their level in the aerodrome operator’s organisation.

(b)The amount and level of detail of safety training should be proportionate and appropriate to the individual’s responsibility and involvement in the safety management system.

(c)The safety management system training programme should be developed in accordance with AMC1 ADR.OR.D.017(a);(b), and AMC1 ADR.OPS.B.010(b);(c) and be incorporated in the training programme foreseen therein.

STAFF SAFETY MANAGEMENT SYSTEM TRAINING REQUIREMENTS

(a)Operations, rescue and firefighting, and maintenance personnel

(1)Safety training should address safety responsibilities, including adherence to all operating and safety procedures, and recognising and reporting hazards;

(2)The training objectives should include the organisation’s safety policy and safety management system fundamentals, and overview;

(3)The contents should include:

(i)definition of hazards;

(ii)consequences and risks;

(iii)the safety risk management process, including roles and responsibilities; and

(iv)safety reporting and the organisation’s safety reporting system(s) .

(b)Managers and supervisors

(1)Safety training should address safety responsibilities, including promoting the SMS and engaging operational personnel in hazard reporting;

(2)In addition to the training objectives established for operational personnel, training objectives for managers and supervisors should include a detailed knowledge of the safety process, hazard identification and safety risk management and mitigation, and change management;

(3)In addition to the contents specified for operational personnel, the training contents for supervisors and managers should include safety data analysis.

(c)Senior managers

(1)Safety training should include safety responsibilities, including compliance with European Union, national and the organisation’s own safety requirements, allocation of resources, ensuring effective inter-departmental safety communication, and active promotion of the safety management system;

(2)In addition to the objectives of the two previous employee groups, safety training should include safety assurance and safety promotion, safety roles and responsibilities, and establishing acceptable levels of safety.

(d)Accountable manager The training should provide the accountable manager with a general awareness of the organisation’s safety management system, including safety management system roles and responsibilities, safety policy and objectives, safety risk management, and safety assurance.

SAFETY COMMUNICATION

(a)The aerodrome operator should communicate safety management system objectives and procedures to all operational personnel, and the safety management system and its application should be evident in all aspects of operations.

(b)Communication should flow between the safety manager and operational personnel throughout the organisation. The safety manager should communicate the performance of the organisation’s safety management system through suitable means. The safety manager should, also, ensure that lessons learned from investigations, safety related events, or other safety related experiences, both internally and from other organisations, are distributed widely.

(c)Safety communication should aim to:

(1)ensure that all staff are fully aware of the safety management system;

(2)convey safety-critical information;

(3)explain why particular actions are taken; and

(4)explain why safety procedures are introduced or changed.

SAFETY COMMUNICATION

(a)An aerodrome operator, may use the following tools to communicate safety information:

(1)Safety Management System Manual;

(2)safety processes and procedures;

(3)safety newsletters, notices, and bulletins; and

(4)websites or emails;

(b)Regular meetings with personnel where information, actions, and procedures are discussed may be used to communicate safety matters.

COORDINATION OF THE AERODROME EMERGENCY RESPONSE PLAN The coordination of the aerodrome emergency response plan, established in accordance with the requirements contained in Part-ADR.OPS, with the safety management system should ensure continuous improvement of the systems and procedures contained within the plan.

COORDINATION OF THE AERODROME EMERGENCY RESPONSE PLAN Continuous improvement of the systems and procedures contained within the aerodrome emergency response plan may, amongst others, be obtained by:

(a)conducting a review of the relevant parts of the emergency response plan after a full or partial exercise;

(b)debriefing and analysing the emergency response operations after an emergency situation; and

(c)developing new emergency procedures or systems as part of the emergency response plan when new hazards are identified by the safety management system, to ensure, amongst others, the coordination with the emergency response plans of other interfacing organisations.

COMPLIANCE MONITORING

(a)Compliance monitoring

(1)The implementation and use of a compliance monitoring function should enable the aerodrome operator to monitor compliance with the relevant requirements of this Part, Part-ADR.OPS, as well as any other applicable regulatory requirements, or requirements established by the aerodrome operator. The aerodrome operator should specify the basic structure of the compliance monitoring applicable to the activities conducted. The compliance monitoring should be properly implemented, maintained and continually reviewed and improved as necessary. Compliance monitoring should be structured according to the size of organisation and the complexity of the activities to be monitored, including those which have been subcontracted.

(2)An aerodrome operator should monitor compliance with the procedures it has designed, to ensure safe activities. In doing so, an aerodrome operator should as a minimum, and where appropriate, monitor compliance with:

(i)privileges of the aerodrome operator;

(ii)manuals, logs, and records;

(iii)training standards;

(iv)required resources; and

(v)management system procedures and manuals.

(b)Organisational set-up

(1)A person should be responsible for compliance monitoring. The accountable manager, with regards to his/her direct accountability for safety, should ensure, in accordance with ADR.D.015(a), that sufficient resources are allocated for compliance monitoring. In the case the person responsible for the compliance monitoring acts also as safety manager, the accountable manager should ensure that sufficient resources are allocated to both functions, taking into account the size of the aerodrome operator, and the nature and complexity of its activities.

(2)The independence of the compliance monitoring should be established by ensuring that audits and inspections are carried out by personnel not responsible for the function, procedure, etc. being audited.

(3)Personnel involved in compliance monitoring should have access to any part of the aerodrome organisation, and any contracted organisation as required.

(c)Compliance monitoring documentation

(1)Relevant documentation should include the relevant part(s) of the aerodrome operator’s management system documentation.

(2)In addition, relevant documentation should also include the following:

(i)terminology;

(ii)specified activity standards;

(iii)a description of the organisation of the aerodrome operator;

(iv)the allocation of duties and responsibilities;

(v)procedures to ensure regulatory compliance;

(vi)the compliance monitoring programme, reflecting:

(A)schedule of the monitoring programme;

(B)audit procedures;

(C)reporting procedures;

(D)follow-up and corrective action procedures; and

(E)recording system;

(vii)the training syllabus referred to in (d)(2); and

(viii)document control.

(d)Training

(1)Correct and thorough training is essential to optimise compliance in every aerodrome operator. In order to achieve significant outcomes of such training, the operator should ensure that all personnel understand the objectives as laid down in the operator’s management system documentation.

(2)Those responsible for managing the compliance monitoring should receive training on this task. Such training should cover the requirements of compliance monitoring, manuals and procedures related to the task, audit techniques, reporting, and recording.

(3)Time should be provided to train the personnel involved in compliance management, and for briefing the remaining of the personnel.

(4)The allocation of time and resources should be based on the volume and complexity of the activities concerned.

(e)Compliance monitoring — audit scheduling

(1)A defined audit schedule to be completed during a specified calendar period and a periodic review cycle for each area should be established. The compliance monitoring itself should also be audited according to a defined audit schedule. The schedule should allow for unscheduled audits when trends are identified. Follow-up audits should be scheduled to verify that corrective action was carried out, and that it was effective and completed, in accordance with the policies and procedures specified in the aerodrome manual.

(2)The aerodrome, its management system key processes, procedures and its operation should be audited within the first 12 months since the date of the issuance of the certificate.

(3)After that, the aerodrome operator should consider the results of its safety (risk) assessments and of its past compliance monitoring activities, in order to adapt the calendar period within which an audit or a series of audits should be conducted, to cover the whole aerodrome, its management system key processes, procedures and its operation in a manner, and at intervals set out in the aerodrome manual. This calendar period, should be consistent with the relevant competent authority’s oversight planning cycle and may be increased, up to 36 months, in coordination with the competent authority, provided that there are no level 1 findings, and subject to the aerodrome operator having a good record of rectifying findings in a timely manner.

RESPONSIBILITY FOR COMPLIANCE MONITORING

(a)The responsibility for the compliance monitoring should:

(1)be with a person who has direct access to, and is responsible to the accountable manager;

(2)not be with one of the persons referred to in point ADR.OR.D.015(b), except that in less complex aerodrome organisations/operations, it may also be with the accountable manager.

(b)Persons allocated the responsibility for the compliance monitoring should have:

(1)adequate experience and expertise in aerodrome operations, or aerodrome maintenance, or similar area;

(2)adequate knowledge of, and experience in safety management and quality assurance;

(3)knowledge of the aerodrome manual; and

(4)comprehensive knowledge of the applicable requirements in the area of aerodromes.

COMPLIANCE MONITORING — GENERAL

(a)The organisational set-up of the compliance monitoring should reflect the size of the aerodrome operator, and the nature and complexity of its activities. The person responsible for the compliance monitoring may perform all audits and inspections himself/herself, or appoint one or more auditors by choosing personnel having the related competence as defined in paragraph (b) of AMC2 ADR.OR.D.005(b)(11) either from within, or outside the aerodrome operator.

(b)Regardless of the option chosen, it must be ensured that the independence of the audit function is not affected, in particular, in cases where those performing the audit or inspection are also responsible for other functions for the aerodrome operator.

(c)In case external personnel are used to perform compliance audits or inspections:

(1)any such audits or inspections are performed under the responsibility of the person responsible for the compliance monitoring; and

(2)the aerodrome operator remains responsible to ensure that the external personnel has relevant knowledge, background, and experience as appropriate to the activities being audited or inspected, including knowledge and experience in compliance monitoring.

(d)The aerodrome operator retains the ultimate responsibility for the effectiveness of the compliance monitoring, in particular for the effective implementation and follow-up of all corrective actions.

AERODROME OPERATOR MANAGEMENT SYSTEM DOCUMENTATION The aerodrome operator should ensure that the documented management system key processes include a process for making personnel aware of their responsibilities, as well as its amendment procedure. The aerodrome operator’s management system documentation should, at least, include the following information:

(a)a statement signed by the accountable manager to confirm that the aerodrome operator will continuously work in accordance with the applicable requirements and the operator’s documentation;

(b)the aerodrome operator’s scope of activities;

(c)the titles and names of persons referred to in ADR.OR.D.015 and AMC2 ADR.OR.D.005(b)(11);

(d)an organisation chart showing the lines of responsibility between the nominated persons;

(e)a general description and location of the facilities;

(f)procedures specifying how the aerodrome operator ensures compliance with the applicable requirements;

(g)the amendment procedure for the operator’s management system documentation; and

(h)safety management system outputs.

AERODROME OPERATOR SAFETY MANAGEMENT MANUAL

(a)In cases where safety management is set out in a Safety Management Manual, it should be the key instrument for communicating the approach to safety for the aerodrome operator. The Safety Management Manual should document all aspects of safety management, including the safety policy, objectives, procedures, and individual safety responsibilities.

(b)The contents of the Safety Management Manual should include:

(1)scope of the safety management system;

(2)safety policy and objectives;

(3)safety responsibilities of key safety personnel;

(4)documentation control procedures;

(5)safety assessment process, including hazard identification and risk management schemes;

(6)monitoring of implementation and effectiveness of safety actions, and risk mitigation measures;

(7)safety performance monitoring;

(8)safety reporting (including hazard reporting) and investigation;

(9)coordination of emergency response planning;

(10)management of change (including organisational changes with regard to safety responsibilities);

(11)safety promotion; and

(12)safety management system outputs.

AERODROME OPERATOR MANAGEMENT SYSTEM DOCUMENTATION It is not required to duplicate information in several manuals. The Safety Management Manual is considered to be a part of the aerodrome manual.