CAMO.B.200 Management system

ORGANISATIONAL STRUCTURE

(a)In deciding upon the required organisational structure, the competent authority should review:

(1)the number of certificates to be issued, and the number and size of the potential CAMOs within that Member State;

(2)the possible use of qualified entities and of the resources of the competent authorities of other Member States to fulfil the continuing oversight obligations;

(3)the level of civil aviation activity, number and complexity of aircraft and the size of the Member State’s aviation industry; and

(4)the potential growth of activities in the field of civil aviation.

(b)The competent authority should retain effective control of important surveillance functions and should not delegate them in such a way that CAMOs, in effect, regulate themselves in airworthiness matters.

(c)The set-up of the organisational structure should ensure that the various tasks and obligations of the competent authority do not solely rely on individuals. The continuous and undisturbed fulfilment of these tasks and obligations of the competent authority should also be guaranteed in case of illness, accident or leave of individual employees.

GENERAL

(a)The competent authority designated by each Member State should be organised in such a way that:

(1)there is specific and effective management authority in the conduct of all the relevant activities;

(2)the functions and processes described in the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, AMC, Certification Specifications (CSs), and Guidance Material (GM) may be properly implemented;

(3)the competent authority’s organisation and operating procedures for the implementation of the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts are properly documented and applied;

(4)all the competent authority’s personnel who are involved in the related activities are provided with training where necessary;

(5)specific and effective provision is made for communicating and interfacing as necessary with EASA and the competent authorities of other Member States; and

(6)all the functions related to implementing the applicable requirements are adequately described.

(b)A general policy in respect of the activities related to the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts should be developed, promoted, and implemented by the manager at the highest appropriate level; for example, the manager at the top of the functional area of the competent authority that is responsible for such activities.

(c)Appropriate steps should be taken to ensure that the policy is known and understood by all the personnel involved, and all the necessary steps should be taken to implement and maintain the policy.

(d)The general policy, whilst also satisfying the additional national regulatory responsibilities, should, in particular, take into account:

(1)the provisions of Regulation (EU) 2018/1139;

(2)the provisions of the applicable implementing rules and their AMC, CSs, and GM;

(3)the needs of industry; and

(4)the needs of EASA and of the competent authority.

(e)The policy should define specific objectives for the key elements of the organisation and processes for implementing the related activities, including the corresponding control procedures and the measurement of the achieved standard.

DOCUMENTED POLICIES AND PROCEDURES

(a)The various elements of the organisation involved with the activities related to Regulation (EU) 2018/1139 and its delegated and implementing acts should be documented in order to establish a reference source for the establishment and maintenance of this organisation.

(b)The documented procedures should be established in a way that facilitates their use. They should be clearly identified, kept up to date, and made readily available to all the personnel who are involved in the related activities.

(c)The documented procedures should cover, as a minimum, all of the following aspects:

(1)policy and objectives;

(2)organisational structure;

(3)responsibilities and associated authority;

(4)procedures and processes;

(5)internal and external interfaces;

(6)internal control procedures;

(7)the training of personnel;

(8)cross-references to associated documents;

(9)assistance from other competent authorities or EASA (where required).

(d)It is likely that the information may be held in more than one document or series of documents, and suitable cross-referencing should be provided. For example, the organisational structure and job descriptions are not usually in the same documentation as the detailed working procedures. In such cases, it is recommended that the documented procedures should include an index of cross references to all such other related information, and the related documentation should be readily available when required.

SUFFICIENT PERSONNEL

(a)This GM on the determination of the required personnel is limited to the performance of certification and oversight tasks, excluding any personnel who are required to perform tasks that are subject to any national regulatory requirements.

(b)The elements to be considered when determining who are the required personnel and planning their availability may be divided into quantitative and qualitative elements:

(1)Quantitative elements:

(i)the estimated number of initial certificates to be issued;

(ii)the number of organisations to be certified by the competent authority; and

(iii)the estimated number of subcontracted organisations used by certified organisations.

(2)Qualitative elements:

(i)the size, nature, and complexity of the activities of certified organisations, taking into account:

(A)the privileges of each organisation;

(B)the types of approval and the scope of approval;

(C)possible certification to industry standards;

(D)the number of personnel; and

(E)the organisational structure and the existence of subsidiaries;

(ii)the safety priorities identified;

(iii)the results of past oversight activities, including audits, inspections and reviews, in terms of risks and regulatory compliance, taking into account:

(A)the number and the level of findings;

(B)the time frame for implementation of corrective actions; and

(C)the maturity of the management systems implemented by organisations, and their ability to effectively manage safety risks; and

(iv)the size and complexity of the Member State’s aviation industry, and the potential growth of activities in the field of civil aviation, which may be an indication of the number of new applications and changes to existing certificates to be expected.

(c)Based on the existing data from previous oversight planning cycles, and taking into account the situation within the Member State’s aviation industry, the competent authority may estimate:

(1)the standard working time required for processing applications for new certificates;

(2)the number of new certificates to be issued for each planning period; and

(3)the number of changes to existing certificates to be processed for each planning period.

(d)In line with the competent authority’s oversight policy, the following planning data should be determined:

(1)the standard number of audits to be performed per oversight planning cycle;

(2)the standard duration of each audit;

(3)the standard working time for audit preparation, on-site audit, reporting, and follow-up, per inspector;

(4)the standard number of unannounced inspections to be performed;

(5)the standard duration of inspections, including preparation, reporting, and follow-up, per inspector; and

(6)the minimum number and the required qualification of the inspectors for each audit/inspection.

(e)The standard working time could be expressed either in working hours per inspector, or in working days per inspector. All planning calculations should then be based on the same unit (hours or working days).

(f)It is recommended that the competent authority use a spreadsheet application to process the data defined under (c) and (d), to assist in determining the total number of working hours/days per oversight planning cycle required for certification, oversight and enforcement activities. This application could also serve as a basis for implementing a system for planning the availability of personnel.

(g)The number of working hours/days per planning period for each qualified inspector that may be allocated for certification, oversight and enforcement activities should be determined, taking into account:

(1)purely administrative tasks that are not directly related to certification and oversight;

(2)training;

(3)participation in other projects;

(4)planned absence; and

(5)the need to include a reserve for unplanned tasks or unforeseeable events.

(h)The determination of the working time available for certification, oversight and enforcement activities should also consider, as applicable:

(1)the use of qualified entities;

(2)cooperation with other competent authorities for approvals that involve more than one Member State; and

(3)oversight activities under a bilateral aviation safety agreement.

(i)Based on the elements listed above, the competent authority should be able to:

(1)monitor the dates when audits and inspections are due, and when they were carried out;

(2)implement a system to plan the availability of personnel; and

(3)identify possible gaps between the number and qualification of personnel and the required volume of certification and oversight. Care should be taken to keep planning data up to date in line with changes in the underlying planning assumptions, with particular focus on risk-based oversight principles.

QUALIFICATION AND TRAINING — GENERAL

(a)It is essential for the competent authority to have the full capability to adequately assess the compliance and performance of an organisation by ensuring that the whole range of activities is assessed by appropriately qualified personnel.

(b)For each inspector, the competent authority should:

(1)define the competencies required to perform the allocated certification and oversight tasks;

(2)define the associated minimum qualifications that are required;

(3)establish initial and recurrent training programmes in order to maintain and to enhance the competency of inspectors at the level that is necessary to perform the allocated tasks; and

(4)ensure that the training provided meets the established standards, and is regularly reviewed and updated whenever necessary.

(c)The competent authority may provide training through its own training organisation with qualified trainers, or through another qualified training source.

(d)If training is not provided through an internal training organisation, adequately experienced and qualified persons may act as trainers, provided that their training skills have been assessed. If required, an individual training plan should be established that covers specific training skills. Records should be kept of such training, and of the assessment, as appropriate.

QUALIFICATION AND TRAINING — INSPECTORS

(a)Competent authority inspectors should have:

(1)practical experience and expertise in the application of aviation safety standards and safe operating practices;

(2)comprehensive knowledge of:

(a)the relevant parts of the implementing rules, certification specifications and guidance material;

(b)the competent authority’s procedures;

(c)the rights and obligations of an inspector;

(d)safety management systems based on the EU management system requirements (including compliance monitoring) and ICAO Annex 19;

(e)continuing airworthiness management including maintenance programme development and control;

(f)operational procedures that affect the continuing airworthiness management of the aircraft or its maintenance; and

(g)maintenance-related HF and human performance principles;

(3)training on auditing techniques and assessing and evaluating management systems and safety risk management processes.

(4)5 years of relevant work experience for them to be allowed to work independently as inspectors. This may include experience gained during training to obtain the qualification mentioned below in point (a)(5);

(5)a relevant engineering degree or an aircraft maintenance technician qualification with additional education. ‘Relevant engineering degree’ refers to an engineering degree from aeronautical, mechanical, electrical, electronic, avionic or other studies that are relevant to the maintenance and continuing airworthiness of aircraft/aircraft components;

(6)knowledge of a relevant sample of the type(s) of aircraft gained through a formalised training course. These courses should be at least at a level equivalent to Part-66 Appendix III Level 1 General Familiarisation. ‘Relevant sample’ means that these courses should cover typical aircraft and aircraft systems that are within the scope of work; and

(7)knowledge of maintenance standards, including fuel tank safety (FTS) training as described in Appendix III to AMC4 CAMO.A.305(g).

(b)In addition to technical competency, inspectors should have a high degree of integrity, be impartial in carrying out their tasks, be tactful, and have a good understanding of human nature.

(c)A programme for recurrent training should be developed that ensures that the inspectors remain competent to perform their allocated tasks. As a general policy, it is not desirable for the inspectors to obtain technical qualifications from those entities that are under their direct regulatory oversight.

INITIAL AND RECURRENT TRAINING — INSPECTORS

(a)Initial training programme: The initial training programme for inspectors should include, as appropriate to their role, current knowledge, experience and skills in at least all of the following:

(1)aviation legislation, organisation, and structure;

(2)the Chicago Convention, the relevant ICAO Annexes and Documents;

(3)Regulation (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation;

(4)overview of Regulation (EU) 2018/1139, its delegated and implementing acts and the related AMC, CS, and GM;

(5)Regulation (EU) No 1321/2014 as well as any other applicable requirements;

(6)management systems, including the assessment of the effectiveness of a management system, in particular hazard identification and risk assessment, and non-punitive reporting techniques in the context of the implementation of a ‘just culture’;

(7)auditing techniques;

(8)procedures of the competent authority that are relevant to the inspectors’ tasks;

(9)HF principles;

(10)the rights and obligations of inspecting personnel of the competent authority;

(11)on-the-job training that is relevant to the inspector’s tasks; and

(12)technical training, including training on aircraft-specific subjects, that is appropriate to the role and tasks of the inspector, in particular for those areas that require approvals. NOTE: The duration of the on-the-job training should take into account the scope and complexity of the inspector’s tasks. The competent authority should assess whether the required competency has been achieved before an inspector is authorised to perform a task without supervision.

(b)Recurrent training programme Once qualified, the inspector should undergo training periodically, as well as whenever deemed necessary by the competent authority, in order to remain competent to perform the allocated tasks. The recurrent training programme for inspectors should include, as appropriate to their role, at least the following topics:

(1)changes in aviation legislation, the operational environment and technologies;

(2)procedures of the competent authority that are relevant to the inspector’s tasks;

(3)technical training, including training on aircraft-specific subjects, that is appropriate to the role and tasks of the inspector; and

(4)results from past oversight.

(c)An assessment of an inspector’s competency should take place at regular intervals that do not exceed 3 years. The results of these assessments, as well as any actions taken following the assessments, should be recorded.

SAFETY RISK MANAGEMENT PROCESS

(a)The safety risk management process required by point CAMO.B.200 should be documented. The following should be defined in the related documentation:

(1)means for hazard identification, and the related data sources, taking into account data that comes from other competent authorities with which the competent authority interfaces in the State, or from the competent authorities of other Member States;

(2)risk management steps including:

(i)analysis (in terms of the probability and the severity of the consequences of hazards and occurrences);

(ii)assessment (in terms of tolerability); and

(iii)control (in terms of mitigation) of risks to an acceptable level;

(3)who holds the responsibilities for hazard identification and risk management;

(4)who holds the responsibilities for the follow-up of risk mitigation actions;

(5)the levels of management who have the authority to make decisions regarding the tolerability of risks;

(6)means to assess the effectiveness of risk mitigation actions; and

(7)the link with the compliance monitoring function.

(b)To demonstrate that the safety risk management process is operational, competent authorities should be able to provide evidence that:

(1)the persons involved in internal safety risk management activities are properly trained;

(2)hazards that could impact the authority’s capabilities to perform its tasks and discharge its responsibilities have been identified and the related risk assessment is documented;

(3)regular meetings take place at appropriate levels of management of the competent authority to discuss the risks identified, and to decide on the tolerability of risks and possible risk mitigations;

(4)in addition to the initial hazard identification exercise, the risk management process is triggered as a minimum whenever changes occur that may affect the competent authority’s capability to perform any of the tasks required by Part-CAMO;

(5)a record of the actions taken to mitigate risks is maintained, showing the status of each action and the owner of the action;

(6)there is a follow-up on the implementation of all risk mitigation actions;

(7)risk mitigation actions are assessed for their effectiveness; and

(8)the results of risk assessments are periodically reviewed to check whether they remain relevant. (Are the assumptions still valid? Is there new information?).

SAFETY RISK MANAGEMENT PROCESS The purpose of safety risk management as part of the management system framework for competent authorities is to ensure the effectiveness of the management system. As for any organisation, hazard identification and risk management is expected to contribute to effective decision-making, to guide the allocation of resources and contribute to organisational success. The safety risk management process required by point CAMO.B.200 is intended to address the safety risks that are directly related to the competent authority’s organisation and processes, and which may affect its capability to perform its tasks and discharge its responsibilities. This process is not intended to be a substitute for the State safety risk management SARPs defined in ICAO Annex 19, Chapter 3, component 3.3. This does not mean, however, that the competent authority may not use information and data that is obtained through its State Safety Programme (SSP), including oversight data and information, for the purpose of safety risk management as part of its management system. The safety risk management process is also to be applied to the management of changes (CAMO.B.210), which is intended to ensure that the management system remains effective whenever changes occur.

PROCEDURES TO BE MADE AVAILABLE TO THE AGENCY

(a)Copies of the procedures related to the competent authority’s management system, and their amendments, that should be made available to the Agency for the purpose of standardisation, should provide at least the following information:

(1)the competent authority’s organisational structure for the continuing oversight functions that it undertakes, with a description of the main processes. This information should demonstrate the allocation of responsibilities within the competent authority, and that the competent authority is capable of carrying out the full range of tasks for the size and complexity of the Member State’s aviation industry. It should also consider the overall proficiency and the scope of authorisation of the competent authority’s personnel;

(2)for personnel who are involved in oversight activities, the minimum required professional qualification and amount of experience, and the principles that are used to guide their appointment (e.g. assessment);

(3)how the following are carried out: assessments of applications and evaluations of compliance, the issuing of certificates, continuing oversight activities, the follow-up of findings, enforcement measures and the resolution of safety concerns;

(4)the principles used for the management of exemptions and derogations;

(5)the processes that are in place to distribute the applicable safety information to enable a timely reaction to a safety problem;

(6)the criteria for planning continuing oversight activities (i.e. oversight programme), including the management of interfaces when conducting continuing oversight activities (of air operations and of continuing airworthiness management, for example); and

(7)an outline of the initial training of newly recruited oversight personnel (taking future activities into account), and the basic framework for the recurrent training of oversight personnel.

(b)As part of the continuous monitoring of a competent authority, the Agency may request details of the working methods used, in addition to a copy of the procedures of the competent authority’s management system (and any amendments). These additional details are the procedures and the related guidance material that describe the working methods for the personnel of the competent authority who conduct oversight activities.

(c)Information related to the competent authority’s management system may be submitted in an electronic format.