CAMO.B.220 Record-keeping

GENERAL

(a)The record-keeping system should ensure that all records are accessible within a reasonable time whenever they are needed. These records should be organised in a manner that ensures their traceability and retrievability throughout the required retention period.

(b)All records that contain sensitive data regarding applicants or organisations should be stored in a secure manner with controlled access to ensure confidentiality.

(c)Records should be kept in paper form or in electronic format or a combination of the two. Records that are stored on microfilm or optical discs are also acceptable. The records should remain legible and accessible throughout the required retention period. The retention period starts when the record is created.

(d)Paper systems should use robust material which can withstand normal handling and filing. Computer record systems should have at least one backup system, which should be updated within 24 hours of any new entry. Computer record systems should include safeguards against any unauthorised personnel from altering the data.

(e)All computer hardware that is used to ensure the backup of data should be stored in a different location from the one that contains the working data, and in an environment that ensures that the data remains in a good condition. When hardware or software changes take place, special care should be taken to ensure that all the necessary data continues to be accessible throughout at least the full period specified in point CAMO.B.220(c).

COMPETENT AUTHORITY MANAGEMENT SYSTEM Records that are related to the competent authority’s management system should include, as a minimum, and as applicable:

(a)the documented policies and procedures;

(b)the personnel files of the competent authority’s personnel, with the supporting documents related to their training and qualifications;

(c)the results of the competent authority’s internal audit and safety risk management processes, including audit findings, and corrective, preventive and risk mitigation actions; and

(d)the contract(s) established with any qualified entities that perform certification or oversight tasks on behalf of the competent authority.

REQUEST BY A COMPETENT AUTHORITY OF ANOTHER MEMBER STATE OR THE AGENCY The cases, when records shall be made available should be limited to: incidents or accidents; findings through the aircraft continuing airworthiness monitoring (ACAM) programme where organisations approved by another competent authority are involved, to determine the root cause; aircraft mainly operated in another Member State; aircraft previously operated in another Member State; organisations having approvals in several Member States. When records are requested from another Member State, the reason for the request should be clearly stated. The records can be made available by sending a copy or by allowing their consultation.