145.B.305 Oversight programme

ANNUAL REVIEW

(a)The oversight planning cycle and the related oversight programme for each organisation should be reviewed annually to ensure that they remain adequate regarding any changes in the nature of the organisation, the complexity of its activities or the safety performance of the organisation.

(b)When reviewing the oversight planning cycle and the related oversight programme, the competent authority should also consider any relevant information collected in accordance with points 145.A.60 and 145.B.300(f).

SPECIFIC NATURE OF THE ORGANISATION AND COMPLEXITY OF ITS ACTIVITIES — RESULTS OF PAST CERTIFICATION OR OVERSIGHT ACTIVITIES When determining the oversight programme, including the product audits, the competent authority should consider in particular the following elements, as applicable:

(1)the effectiveness of the organisation’s management system in identifying and addressing non-compliances and safety hazards;

(2)the implementation by the organisation of any industry standards that are directly relevant to the organisation’s activities subject to this Regulation;

(3)the procedure applied for and the scope of changes not requiring prior approval;

(4)any specific procedures implemented by the organisation that are related to any alternative means of compliance used;

(5)the number of approved locations and the activities performed at each location;

(6)the number and type of any subcontractors that perform maintenance tasks; and

(7)the volume of activity for each A, B, C and D class rating, as applicable.

SUBCONTRACTED ACTIVITIES If a Part-145 organisation subcontracts maintenance tasks, the competent authority should determine whether the subcontracted organisation needs to be audited and included in the oversight programme, taking into account the specific nature and complexity of the subcontracted activities, the results of previous oversight activities of the approved organisation, and the assessment of the associated risks. For such audits, competent authority inspectors should ensure that they are accompanied throughout the audit by a senior technical member of the Part-145 organisation. NOTE: If a Part-145 organisation subcontracts maintenance tasks, the competent authority should ensure that the Part-145 organisation manages the risks related to, and that it has sufficient control over, the subcontracted activities (see AMC1 145.A.75(b)).

AUDIT

(a)The oversight programme should indicate which aspects of the approval will be covered by each audit.

(b)Part of each audit should concentrate on the audit reports produced by the organisation’s compliance monitoring function, to determine whether the organisation has been identifying and correcting its problems.

(c)At the conclusion of the audit, the auditing inspector should complete an audit report that identifies the areas and processes that were audited, and includes all the findings that were raised.

(d)At the completion of each oversight planning cycle, a new EASA Form 6 should be issued.

OVERSIGHT PLANNING CYCLE — AUDIT AND INSPECTION

(a)When determining the oversight planning cycle and defining the oversight programme, the competent authority should assess the risks related to the activity and set-up of each organisation, and adapt the oversight to the level of risk identified and to the effectiveness of the organisation’s management system, in particular its ability to effectively manage safety risks.

(b)The competent authority should establish a schedule of audits and inspections that is appropriate to each organisation. The planning of audits and inspections should take into account the results of the hazard identification and the risk assessment conducted and maintained by the organisation as part of the organisation’s management system. Inspectors should work in accordance with the schedule provided to them.

(c)When the competent authority, having regard to the level of risk identified and the effectiveness of the organisation’s management system, varies the frequency of an audit or inspection, it should ensure that all aspects of the organisation’s activity are audited and inspected within the applicable oversight planning cycle.

OVERSIGHT PLANNING CYCLE — AUDIT

(a)For each organisation certified by the competent authority, all applicable requirements including relevant processes should be audited at periods that do not exceed the applicable oversight planning cycle. The beginning of the first oversight planning cycle is normally determined by the date of issue of the first certificate. If the competent authority wishes to align the oversight planning cycle with the calendar year, it should shorten the first oversight planning cycle accordingly.

(b)Audits should include at least one on-site audit within each oversight planning cycle. For organisations that carry out their regular activities at more than one site, the determination of the sites and the requirements at these sites to be audited should consider the results of past oversight activities and the volume of activities at each site, as well as the main risk areas identified.

(c)For organisations that hold more than one certificate under Regulation (EU) 2018/1139, the competent authority may define an integrated oversight schedule that includes all the applicable audit items. In order to avoid any duplication of audits, credit may be granted for specific audit items that have already been completed during the current oversight planning cycle, provided that:

(1)the specific audit item is the same for all the certificates under consideration;

(2)there is satisfactory evidence on record that those specific audit items were carried out, and that all the related corrective actions have been implemented to the satisfaction of the competent authority;

(3)the competent authority is satisfied that there is no evidence that standards have deteriorated regarding those specific audit items for which credit is granted.

The expression ‘shall not exceed 24 months’ does not imply that 24 months is a minimum duration for the oversight cycle. Based on the elements specified in 145.B.300(c) and 145.B.305(b) (e.g. safety priorities, assessment of the risks, complexity of activities), the competent authority may decide to apply a cycle of less than 24 months (e.g. 12 months).

EXTENSION OF THE OVERSIGHT PLANNING CYCLE BEYOND 24 MONTHS

(a)If the competent authority applies an oversight planning cycle that exceeds 24 months, it should, at a minimum, perform one focused inspection of the organisation (inspection of a specific area, element or aspect of the organisation) within each 12-month segment of the applicable oversight planning cycle to support the extended oversight programme.

(b)If the results of this inspection indicate a decrease in the safety performance or regulatory compliance of the organisation, the competent authority should revert back to a 24-month (or less) oversight planning cycle and review the oversight programme accordingly.

(c)In order to be able to apply an oversight planning cycle beyond 36 months, the competent authority should agree on the format and contents of the continuous reporting to be made by the organisation on its safety performance and regulatory compliance.

ORGANISATION’S CONTROL OVER THE CHANGES For the purpose of extending the oversight planning beyond 24 months, the continuous compliance of the organisation with 145.A.85 and the full control over all changes referred to in point 145.B.305(d)(2) includes in particular the ability of the organisation to manage adequately the changes not requiring prior approval foreseen in 145.A.85(c).