CAO.A.100 Quality system and organisational review

QUALITY SYSTEM — GENERAL

(a)The primary objectives of the quality system are to provide an independent monitoring function on how the organisation ensures compliance with the applicable requirements, policies and procedures, and to request actions where non-compliances are identified.

(b)The independence of the quality system is established by always ensuring that audits are carried out by personnel who are not responsible for the functions, procedures or products that are audited.

QUALITY SYSTEM — FEEDBACK

(a)The quality system should include a feedback system: it should ensure that all findings resulting from the independent audits are properly investigated and corrected in a timely manner. It should address who is required to rectify each non-compliance and the procedure to be followed if rectification is not completed within appropriate timescales. The procedure should enable the accountable manager to be kept informed of any safety issues and the extent of compliance with Part-CAO.

(b)The audit reports referenced in AMC1 CAO.A.100(b) should be sent to the relevant department for rectification action giving target rectification dates. Rectification dates should be discussed with such department before the quality department or nominated auditor confirms such dates in the report. The relevant department is required to rectify findings and inform the quality manager or the auditor of such rectification.

(c)The accountable manager should hold regular meetings with staff to check the progress of any corrective actions. If these meetings are delegated to the quality manager on a day-to-day basis, then the accountable manager should:

(1)meet the senior staff involved at least twice per year to review the overall performance of the compliance monitoring function; and

(2)receive at least a half-yearly summary report on non-compliance findings.

(d)If a non-compliance is detected by the organisation or a finding is notified, the quality system should ensure that the root cause(s) and contributing factor(s) are identified and that corrective actions are defined. Notified findings include those detected during the airworthiness review, as well as findings raised directly by the competent authority.

QUALITY SYSTEM — INDEPENDENT AUDIT

(a)An essential element of the quality system is the independent audit.

(b)The independent audit should be an objective process of routine sample checks of all aspects of the organisation’s ability to carry out continuing airworthiness management and/or maintenance to the standards required by Regulation (EU) No 1321/2014. It should include some product sampling (e.g. product audit) as this is the end result of the process.

(c)The independent audit should provide an objective overview of the complete set of continuing-airworthiness-management- and/or maintenance-related activities.

(d)The organisation should establish an audit plan to show when and how often the activities as required by Part-M, Part-ML and Part-CAO will be audited.

(e)The audit plan should ensure that all aspects of Part-CAO compliance are verified every year, including all the subcontracted activities, and the auditing may be carried out as a complete single exercise or (sub)divided over the annual period. The independent audit should not require each procedure to be verified against each product line when it can be shown that the particular procedure is common to more than one product line and the procedure has been verified every year without resultant findings. Where findings have been identified, the particular procedure should be verified against other product lines until the findings have been rectified, after which the independent audit procedure may revert to a 1-year interval for the particular procedure.

(f)Provided that there are no safety-related findings, the audit planning cycle specified in this AMC may be increased by up to 100 %, subject to agreement by the competent authority.

(g)Where the organisation has more than one location approved, the quality system should include a description of how these locations are integrated into the system, and include a plan to audit each location at a frequency consistent with the extent of activity at the particular location, not exceeding 2 years.

(h)A report should be issued each time an audit is carried out describing what was checked and the resulting non-compliance findings against applicable requirements and procedures.

THE USE OF INFORMATION AND COMMUNICATION TECHNOLOGIES (ICT) FOR PERFORMING REMOTE AUDITS Similar provisions to those in GM1 145.A.200(a)(6) and 145.B.300 apply.

An organisation that holds both maintenance and continuing airworthiness management privileges can be considered to be at the same time: a small CAO for one privilege; and not a small CAO for the other privilege. In these situations, the organisation is not considered to be a small CAO as a whole.

ORGANISATIONAL REVIEW

(a)The primary objectives of organisational review are to provide a monitoring function on how the organisation ensures compliance with the applicable requirements, policies and procedures, and to request actions where non-compliances are identified.

(b)The CAO should identify the:

(1)person responsible for the organisational review;

(2)frequency of the reviews;

(3)scope and content of the reviews;

(4)persons accomplishing the reviews;

(5)procedure for planning, performing and processing review findings; and

(6)procedure for ensuring corrective actions are carried out in the appropriate time frame.

(c)Appendix II to AMC1 CAO.A.100(f) should be used to manage the organisational reviews.

(d)The following continuing airworthiness management activities should not be considered to be subcontracting and, as a consequence, they may be performed without a quality system, although they need to be described in the CAE and be approved by the competent authority:

(1)Subscription to a technical publisher that provides maintenance data (aircraft maintenance manuals, illustrated parts catalogues, service bulletins, etc.).

(2)Contracting the use of a software tool for the management of CAO.A.080 continuing airworthiness data and CAO.A.090 records, provided that:

(i)if the tool is used by several organisations, each organisation has access to its own data only;

(ii)introduction of data can only be performed by personnel of the CAO; and

(iii)the data can be retrieved at any time.