21.A.239 Design management system

SAFETY MANAGEMENT ELEMENT Demonstration of compliance with the international industry standard SM-0001 ‘Implementing a Safety Management System in Design, Manufacturing and Maintenance Organisations’, Issue B, 31 March 2022, is an acceptable means to demonstrate compliance with the safety management element of the design management system.

SAFETY MANAGEMENT ELEMENT Safety management seeks to proactively identify hazards and mitigate the related safety risks before they result in aviation accidents and incidents. Safety management enables an organisation to manage its activities in a more systematic and focused manner. When an organisation has a clear understanding of its role in, and contribution to, aviation safety, this enables the organisation to prioritise safety risks and more effectively manage its resources for optimal results. Safety should not be considered the responsibility of a single person or a limited group of people in the organisation. A safety culture should be developed throughout the organisation, which involves all the personnel as active contributors to the safety of the final product, part, or appliance, (see AMC1 21.A.239(c)(1)). The principles of the requirements in points 21.A.3A, 21.A.5, 21.A.239, 21.A.245, and 21.A.247, and the related AMC constitute the EU design management system framework for aviation safety management. This framework addresses the core elements of the International Civil Aviation Organization (ICAO) safety management system (SMS) framework that is defined in ICAO Annex 19, Appendix 2, and facilitates the introduction of the additional safety management element. This approach is intended to encourage organisations to embed safety management and risk-based decision-making into all their activities, instead of superimposing another system onto their existing management system and governance structure. In addition, if the organisation holds multiple organisation certificates that are issued under Regulation (EU) 2018/1139, it may choose to implement a single management system to cover all of its activities. An integrated management system may be used not only to capture multiple management system requirements resulting from Regulation (EU) 2018/1139, but also to cover for other regulatory provisions requiring compliance with ICAO Annex 19 or for other business management systems, such as security, occupational health, and environmental management systems. Integration will remove duplication and exploit synergies by managing safety risks across multiple activities. Organisations may determine the best means to structure their management systems to suit their business and organisational needs. It is important to recognise that safety management will be a continuous activity, as hazards, risks, as well as the effectiveness of safety risk mitigations, will change over time. The safety management capability of an organisation should be commensurate with the safety risks to be managed, which can be at the product, part, and appliance level or at the organisational level. The risks that are inherent in a complex structure require a robust safety risk management process (e.g. complex interfaces with different partners that participate in the design of a product may pose hazards that are complex to mitigate). As a consequence, scalability and suitability of the safety management element should be a function of the inherent safety risk capability of the organisation. For instance, for organisations with a lower risk level:

(a)the risk assessment model that is used may be very simple in cases in which the identified hazards are easy to mitigate;

(b)expert judgement might be sufficient to measure the efficiency of safety barriers;

(c)the collection of data, safety information, and occurrences might be very limited;

(d)there might be no need for software or tools to manage the SMS; and

(e)the communication policy might be limited.

SAFETY POLICY & OBJECTIVES

(a)The safety policy should:

(1)reflect organisational commitments regarding safety, and its proactive and systematic management, including the promotion of a positive safety culture;

(2)include internal reporting principles by fostering the reporting of organisational threats as well as events, as defined in AMC3 21.A.3A(a);

(3)be endorsed by the head of the design organisation (HDO);

(4)be communicated, with visible endorsement, throughout the organisation; and

(5)be periodically reviewed to ensure that it remains relevant and appropriate to the organisation.

(b)The safety policy should include the commitment:

(1)to comply with all the applicable legislation, meet all the applicable requirements, and adopt practices to improve safety standards;

(2)to provide the necessary resources for the implementation of the safety policy;

(3)to apply human factors (HF) principles;

(4)to enforce safety as a primary responsibility of all managers; and

(5)to apply ‘just culture’ principles and, in particular, not to make available or use the information on occurrences:

(i)to attribute blame or liability to personnel for actions, omissions, or decisions that are commensurate with their experience and training; or

(ii)for any purpose other than the improvement of aviation safety.

(c)Senior management should continuously promote the safety policy to all personnel, demonstrate their commitment to it, and provide the necessary human and financial resources for its implementation.

(d)Taking due account of its safety policy, the organisation should define safety objectives. The safety objectives should:

(1)form the basis for safety performance monitoring and measurement;

(2)reflect the organisation’s commitment to maintaining and continuously improving the overall effectiveness of safety management;

(3)be communicated throughout the organisation; and

(4)be periodically reviewed to ensure that they remain relevant and appropriate to the organisation.

SAFETY POLICY The safety policy is the means for the organisation to state its intention to maintain and, where practicable, to improve the safety levels of all its activities, and to minimise its contribution to the risk of an aircraft accident or serious incident occurring, as far as reasonably practicable. The safety policy reflects the management’s commitment to safety and the organisation’s philosophy of safety management. It is the foundation on which the organisation’s management system is built and serves as a reminder of ‘how we do business here’. The creation of a positive safety culture begins with issuing a clear, unequivocal policy statement. The commitment to apply ‘just culture’ principles forms the basis for the organisation’s internal rules that describe how ‘just culture’ principles are guaranteed and implemented. Regulation (EU) No 376/2014 defines the ‘just culture’ principles to be applied (refer, in particular, to Article 16(11) of that Regulation).

ORGANISATION AND ACCOUNTABILITY

(a)The management system should encompass safety by including a safety manager and a safety review board in the organisational structure. The functions of the safety manager are defined in AMC1 21.A.245(b).

(b)Safety review board

(1)The safety review board (the ‘board’), sometimes referred to as ‘high-level safety committee’, considers matters of strategic safety in support of the safety accountability of the head of the design organisation (HDO).

(2)The board should be normally chaired by the HDO and be generally composed of the person or group of persons nominated under point 21.A.245(b). Its composition can be adapted to its needs, considering point 21.A.245(b).

(3)The board should monitor:

(i)the organisation’s safety performance against its safety policy and objectives;

(ii)whether any safety action is taken in a timely manner; and

(iii)the effectiveness of the organisation’s management system processes.

(4)The board may also be tasked with:

(i)reviewing the results of compliance monitoring; and

(ii)monitoring the implementation of related corrective and preventive action.

(c)The board should ensure that appropriate resources are allocated to achieve the established safety objectives.

(d)Notwithstanding point (a), if justified by the size of the organisation and the nature and complexity of its activities, and subject to a risk assessment and/or mitigation measures, as well as the competent authority’s agreement, the organisation may not need to establish a board. In that case, the tasks that are normally allocated to the board should be allocated to the safety manager.

SAFETY ACTION GROUP

(a)Depending on the size of the organisation and the nature and complexity of its activities, a safety action group may be established as a standing group or as an ad hoc group to assist, or act on behalf of, the safety manager or the safety review board.

(b)More than one safety action group may be established, depending on the scope of the task and the specific expertise that is required.

(c)The safety action group usually reports to, and takes strategic direction from, the safety review board, and may be composed of managers, supervisors, and personnel from operational areas.

(d)The safety action group may be tasked with or assist in the following:

(1)monitoring safety performance;

(2)defining action to control risks to an acceptable level;

(3)assessing the impact of organisational changes on safety;

(4)ensuring that safety action is implemented within the agreed timescales; and

(5)reviewing the effectiveness of previous safety action and safety promotion.

SAFETY MANAGEMENT KEY PROCESSES

(a)Hazard identification processes

(1)Hazard identification should be based on a combination of reactive and proactive methods.

(2)The organisation should focus in particular on hazards that may result from non-compliance or errors in the design of a product, part, or appliance.

(b)Safety risk management processes

(1)The organisation should develop and maintain a safety risk management process that ensures a reactive, proactive, and predictive approach composed of the following elements:

(i)analysis (e.g. in terms of the probability or likelihood as well as severity of the consequences of hazards and occurrences)

(ii)assessment (in terms of tolerability); and

(iii)control (in terms of mitigation) of risks to an acceptable level.

(2)The organisation should specify, within the risk management process, who has the authority to make decisions, considering point (b)(1) of this AMC.

(c)Regardless of the approval status of the subcontracted organisations, the design organisation (DO) is responsible for ensuring that hazard identification and risk management activities are performed on subcontracted activities, as required by point 21.A.239(d)(3), as well as for the monitoring of their compliance and adequacy, as required by point 21.A.239(e).

(d)Internal investigation

(1)In line with ‘just culture’ as part of the safety policy, the organisation should define how to investigate events such as errors or near misses, in order to understand not only what happened, but also how it happened, as well as to prevent or reduce the probability and/or the consequences of any future recurrence.

(2)The scope of internal investigations should extend beyond the scope of the occurrences that are required to be investigated in accordance with point 21.A.3A.

(e)Safety performance monitoring and measurement

(1)Safety performance monitoring and measurement should be the processes through which the safety performance of the organisation is verified against the safety policy and the safety objectives.

(2)This process may include, as appropriate to the size, nature, and complexity of the organisation, the following elements:

(i)safety reporting that also addresses the status of compliance with the applicable requirements;

(ii)safety reviews, including trend reviews, which should be conducted during the introduction of new technologies, the implementation of new or changed procedures, or in cases of organisational changes that may have an impact on safety;

(iii)safety audits that focus on the integrity of the organisation’s management system, and that periodically assess the status of safety risk controls;

(iv)safety surveys that examine particular elements or procedures of a specific area, such as the following:

(A)the problem areas identified;

(B)bottlenecks in the daily design management activities,

(C)the perceptions and opinions of the design management personnel; and

(D)any areas of dissent or confusion; and

(v)other indicators relevant to safety performance.

(f)Management of change Changes to the design management system may pose new hazards or decrease the effectiveness of existing safety risk controls. The organisation should manage any safety risks that are related to change in that organisation. The management of change should be a documented process to identify external or internal change that may have an adverse effect on safety. The management of change should use of the organisation’s existing processes for hazard identification, risk assessment, and risk mitigation.

(g)Continuous improvement The organisation should continuously seek to improve its safety performance and the effectiveness of its design management system. Continuous improvement may be achieved through review of the following elements:

(1)compliance monitoring and audits;

(2)assessments, including assessments of the effectiveness of the safety culture and of the management system, to assess in particular the effectiveness of the safety risk management processes;

(3)staff surveys, including safety culture surveys, that can provide useful feedback on how engaged the staff are in the design management system;

(4)the monitoring of events and their recurrence;

(5)the evaluation of the safety performance indicators as well as reviews of all the available safety performance information; and

(6)the identification of lessons learned.

MANAGEMENT OF CHANGE This AMC provides a means to consider organisational changes for their potential impact on safety. Organisational changes should also be evaluated for their significance, as required by point 21.A.247. In addition, necessary changes should be introduced into the handbook, as per point 21.A.243(c). The design management system should be designed such that all the above points are taken into account.

(a)Organisational changes should be proactively considered for their safety implications. The magnitude of a change, its safety criticality, and its potential impact on human performance (HP) should be assessed in any process for the management of change. Certain non-complex organisational changes may not require additional assessment.

(b)Special consideration, including human factors (HF) issues, should be given to the transition period during which the change becomes effective.

(c)During the process for the management of change, relevant previous risk assessments and existing hazards should be reviewed for their possible effects.

MANAGEMENT OF CHANGE Unless properly managed, changes in the organisational structure, facilities, scope of work, personnel, documentation, policies and procedures, etc. may result in inadvertently creating new hazards, which may expose the organisation to new or greater risks. Effective organisations seek to improve their processes, while being conscious of the fact that changes may expose the organisation to potential hazards and risks if they are not properly and effectively managed. The process for the management of change typically provides principles and a structured framework for managing all aspects of changes. The disciplined implementation of management of change may maximise the effectiveness of change, engage staff, and minimise the risks that are inherent in change. Change may have the potential to raise new HF issues, or to exacerbate existing ones. For example, changes in computer systems, equipment, technology, personnel changes (including changes in management personnel), procedures, the organisation of work, or work processes are likely to affect performance. Effective management of change is supported by the following elements:

(a)the implementation of a process for hazard identification/risk analysis and assessment for major operational changes, major organisational changes, changes in key personnel, and changes that may affect the way in which design management is carried out;

(b)the identification of changes that may have a considerable impact on:

(1)resources (material and human);

(2)management direction (policies, processes, procedures, training); and

(3)management control;

(c)safety cases/risk assessments that are aviation-safety focused; and

(d)the involvement of key stakeholders in the process for the management of change, as appropriate.

SAFETY COMMUNICATION

(a)The organisation should establish communication to the staff, as appropriate to their safety responsibilities, regarding safety matters, which:

(1)ensures awareness of safety management activities;

(2)conveys safety-critical information, especially related to assessed risks and analysed hazards;

(3)explains why particular action is taken; and

(4)explains why safety procedures are established or changed.

(b)Regular meetings with staff, during which information, action, and procedures are discussed, may be used to communicate safety matters.

SAFETY PROMOTION

(a)Safety training, combined with safety communication and information sharing, is part of safety promotion.

(b)Safety promotion activities support the following:

(1)the organisation’s policies, encouraging a positive safety culture, thus creating an environment that is favourable to the achievement of the organisation’s safety objectives;

(2)organisational lessons learned; and

(3)the implementation of an effective safety reporting scheme and the development of a ‘just culture’.

(c)Depending on the particular safety issue, safety promotion may also constitute or complement risk mitigation action.

SAFETY TRAINING

(a)The design management staff, as described in points 21.A.245(a) and (b), should receive initial and recurring safety training, as appropriate to their responsibilities, including in safety management principles and the associated safety objectives, to ensure their continued competency.

(b)The organisation should identify the category of other staff to which safety training should be provided, and define the initial and recurrent training programmes, including appropriate timelines.

(c)Adequate records of the safety training that is provided should be kept in accordance with point 21.A.5.

SAFETY TRAINING

(a)The main purpose of the safety training programme is:

(1)to support safety management policies and processes; and

(2)to ensure that personnel at all levels of the organisation develop and maintain their competency to fulfil their safety roles.

(b)Each organisation may adapt its syllabus to its own needs. Typically, depending on the targeted staff, to contribute to a positive safety culture, the following items may be included:

(1)the organisational roles and responsibilities related to safety, including the hazard identification and risk management processes;

(2)the safety objectives and the associated safety performance indicators;

(3)human factors (HF) principles, including human performance (HP) and limitations;

(4)legislation, where applicable;

(5)safety reporting systems and investigations; and

(6)safety issues.

(c)The purpose of the recurrent safety training is:

(1)primarily to ensure that staff are kept abreast notably of changes to safety management system (SMS) principles, processes, and procedures; and

(2)also to share feedback on safety issues that are relevant to the organisation or lessons learned.

(d)The training staff should have sufficient knowledge and experience to teach the topics at the required level, as well as the skills to influence attitudes and behaviours.

DESIGN ASSURANCE ELEMENT

(a)Reserved

(b)Reserved

(c)Design assurance system The complete design process, starting with the type certification basis, operational suitability data (OSD) certification basis, as well as environmental protection requirements and product specifications, and culminating with the issuing of a type certificate (TC), is shown in Figure 1, which identifies the relationships between the design, the certification, and the design assurance processes. Effective design assurance requires a continuing evaluation of all the factors that affect the adequacy of the design for the intended applications. In particular, it should be ensured that the product or part complies with the applicable type certification basis, OSD certification basis, and environmental protection requirements, and that it will continue to comply after any change to the TC or any repair. Planned and systematic tasks should therefore be defined and performed from the very beginning of the design activities up to the continued-airworthiness activities. [Figure or form omitted from this preview — available in the Avioverse workspace library.]

Figure 1 — RELATIONSHIPS’ CONCEPT IN DESIGN AND CERTIFICATION

(1)Planned and systematic tasks For design organisations that carry out the certification process of products, their planned and systematic tasks should cover the following, and the related procedures should be defined accordingly.

(i)General

(A)Issue or, where applicable, supplement, or amend the handbook in accordance with point 21.A.243, in particular to indicate the initiation of design activities on a product.

(B)Assure that all the instructions of the handbook are adhered to.

(C)Conduct the certification process.

(D)Nominate staff as ‘compliance verification engineers’ that are responsible for approving compliance documents as defined in point (c)(1)(iii).

(E)Nominate staff that belong to the Office of Airworthiness and are responsible as defined in point (c)(1)(iv).

(F)In the case of an applicant for an STC, obtain the agreement of the TC holder for the proposed supplemental type certificate (STC) to the extent that is defined in point 21.A.115.

(G)Ensure that there is full and complete liaison between the design organisation and the related organisations that have responsibility for the products and parts that are manufactured according to the type design.

(H)Provide assurance to EASA that any prototype models and test specimens adequately conform to the type design (see point 21.A.33(c).

(ii)Head of the design organisation (or deputy) The head of the design organisation (HDO), or an authorised representative, should sign a declaration of compliance (see points 21.A.20(d) and 21.A.97(b)(3)) with the applicable type certification basis, OSD certification basis, and environmental protection requirements after verifying the satisfactory completion of the certification process. In accordance with point 21.A.20(e), the signature of the HDO on the declaration of compliance confirms that the procedures as specified in the handbook have been followed (see also GM 21.A.265(b)).

(iii)Compliance verification

(A)Approval through the signing of all the compliance documents, including test programmes and data that are necessary for the verification of compliance with the applicable type certification basis, OSD certification basis and environmental protection requirements, as defined in the certification programme.

(B)Approval of the technical content (completeness, technical accuracy, etc.), including any subsequent revisions of the manuals to be approved by EASA (aircraft flight manual (AFM), airworthiness limitations section of the instructions for continued airworthiness (ICA), and certification maintenance requirements (CMRs) document, where applicable).

(iv)Airworthiness function The airworthiness function is commonly performed by the Office of Airworthiness and should cover the following tasks as relevant*:

(A)liaison between the design organisation (DO) and EASA with respect to all aspects of the certification programme;

(B)ensuring that a handbook and the flight test operations manual, when relevant, are prepared and updated as required by point 21.A.243;

(C)cooperation with EASA in developing procedures to be used for the type certification process;

(D)issuing of guidelines for documenting compliance;

(E)cooperation in issuing guidelines for the preparation of the manuals that are required by the applicable requirements, service bulletins (SBs), drawings, specifications, and standards;

(F)ensuring procurement and distribution of the applicable type certification basis, OSD certification basis, as well as environmental protection requirements and other specifications;

(G)cooperating with EASA in proposing the type certification basis, OSD certification basis, and environmental protection requirements;

(H)the interpretation of the type certification basis, OSD certification basis, and environmental protection requirements, and requesting EASA to take decisions in case of doubt;

(I)advising all the departments of the DO on any question regarding airworthiness, operational suitability, environmental protection approvals, and certification;

(J)the preparation of the certification programme, including a proposal for EASA involvement in the verification of compliance demonstration activities and data, and coordination of all the tasks related to the certification process in agreement with EASA;

(K)regular reporting to EASA about the progress of the certification process, including any difficulty or event that may necessitate a change of the previously notified EASA level of involvement, and announcing scheduled activities (e.g. tests) in due time;

(L)ensuring cooperation in preparing the inspection and test programmes needed for demonstration of compliance;

(M)establishing the compliance checklist and updating it with any changes;

(N)checking that all the compliance documents that are necessary to demonstrate compliance with the type certification basis, OSD certification basis, and environmental protection requirements are prepared and complete, and signing the documents for release;

(O)checking the required type design definition documents that are described in point 21.A.31 and ensuring that they are provided to EASA for approval when required;

(P)preparation, if necessary, of a draft of a type certification data sheet (TCDS) and/or a modification to a TCDS;

(Q)providing verification to the HDO that all the activities that are required for the certification process have been properly completed;

(R)managing the exercise of the DO privileges in accordance with point 21.A.263(c);

(S)monitoring significant events on other aeronautical products, as far as they are relevant, to determine their effect on the airworthiness or operational suitability of the products that are designed by the DO;

(T)ensuring that there is cooperation in preparing SBs and the structural repair manual, and any subsequent revisions, with special attention to the manner in which the contents affect airworthiness and environmental compatibility, and granting the approval on behalf of EASA;

(U)ensuring the initiation of activities in response to a failure (accident/incident/in-service occurrence) evaluation and to complaints from the operation, and providing information to EASA if airworthiness or operational suitability are impaired (continuing airworthiness and continued operational suitability);

(V)advising EASA on the issuing of airworthiness directives in general based on SBs; and

(W)ensuring that the manuals that are approved by EASA, including any subsequent revisions, (AFM, airworthiness limitations section of the ICA, and CMR document, where applicable) are checked, to determine whether they meet their respective requirements, and that they are provided to EASA for approval. * Some of the above tasks may be carried out through a different organisational function.

(v)Maintenance and operating instructions

(A)Ensuring the preparation and updating of all the maintenance and operating instructions (including ICA and SBs) that are needed to maintain airworthiness (i.e. continuing airworthiness) in accordance with the relevant certification specifications (CSs). For that purpose, the applicant should:

(a)establish the list of all the documents they produce to comply with CS 2X.1581 (CS 23.2620) and with the Appendix that is referred to in CS 2X.1529, CS-E 20/25, or CS-P 30/40, or CS 23.2625;

(b)establish a system to collect in-service experience to be used for the improvement of the instructions; and

(c)define the procedures and the organisation for producing and issuing those documents, taking into account the obligation of point 21.A.265(h); those procedures should cover the following elements:

(1)preparation, including format and language (available industrial standards can be referred to and used);

(2)proofreading (checking for clarity, readability, typos, etc.);

(3)verification of technical consistency with the corresponding approved change(s), repair(s) or approved data, including effectivity, description, effects on airworthiness and environmental compatibility, especially when limitations are changed;

(4)verification of feasibility in practical applications, when relevant and feasible; and

(5)responsibilities and authorised signatories. Note: Compliance verification, as described in point (c)(1)(iii) of this AMC, applies to the manuals that are approved by EASA (AFM, airworthiness limitations section of the ICA, and CMR document, where applicable); for the other ICA or other maintenance instructions, the procedure that is required by (c)(1)(v) of this AMC provides a sufficient level of verification and does not require specific compliance verification unless, as per point 21.A.90C, additional work to demonstrate compliance is required; in that case, where additional compliance demonstration is required, points 21.A.91 to 21.A.109, as well as the independent checking function of compliance demonstration as per point 21.A.239(b), apply.

(B)In accordance with points 21.A.6 and 21.A.7 and, where applicable, point 21.A.609, ensuring that those documents are made available as per point 21.A.7(b).

(vi)Operational suitability data

(A)Ensuring the preparation and updating of all OSD in accordance with the relevant CSs. For that purpose, the applicant should:

(a)establish the list of all the documents that they produce to comply with CS-MMEL or CS-GEN-MMEL, CS-FCD, CS-CCD, CS-SIMD, and CS-MCSD, as applicable; and

(b)define the procedures and the organisation for producing and issuing those documents, taking into account the obligation of point 21.A.265(h); those procedures should cover the aspects that are described in (c)(1)(v)(A).

(B)In accordance with points 21.A.6, 21.A.62, 21.A.108, and 21.A.120B, ensuring that those documents are provided to all the affected operators and training organisations, as well as to all the authorities involved.

DESIGN ASSURANCE ELEMENT FOR MINOR CHANGES TO TYPE DESIGN OR MINOR REPAIRS TO PRODUCTS

(a)Purpose This AMC outlines some basic principles and objectives in order to comply with the design assurance element for organisations designing only minor changes to type design or minor repairs to products.

(b)Design assurance system The design assurance system should include the following: an organisational structure: to control the design; to demonstrate compliance with the applicable type certification basis, operational suitability data (OSD) certification basis, and environmental protection requirements; to independently check demonstrations of compliance; to liaise with EASA; to continuously evaluate the design organisation; and To control subcontractors; and procedures and responsibilities associated with the functions listed above, taking due account of Part 21 requirements applicable to design and approval of minor changes to type design or minor repairs to products.

DESIGN ASSURANCE ELEMENT

(a)Purpose This GM outlines some basic principles and objectives of the design assurance element.

(b)Definitions 1 The design assurance element includes the organisational structure, responsibilities, procedures, and resources to ensure the proper functioning of the design organisation. 2 ‘Design assurance’ refers to all planned and systematic action necessary to provide adequate confidence that the organisation has the capability to: design products or parts in accordance with the applicable type certification basis, the operational suitability data (OSD) certification basis, and the environmental protection requirements; demonstrate and verify compliance with the type certification basis, the OSD certification basis, and the environmental protection requirements; and demonstrate to EASA that compliance. 3 ‘Type investigation’ refers to the tasks of the organisation in support of the type certificate (TC), supplemental type certificate (STC) or other design approval processes necessary to demonstrate, verify and maintain compliance with the applicable type certification basis, OSD certification basis, and environmental protection requirements.

INDEPENDENT VERIFICATION FUNCTION OF THE DEMONSTRATION OF COMPLIANCE

(a)The independent verification function of the demonstration of compliance should consist of the verification by a person that did not create the compliance data. Such a person may work in conjunction with the individuals that prepare compliance data.

(b)The verification should be shown by signing compliance documents, including test programmes and data.

(c)For a product, there is normally only one compliance verification engineer that is nominated for each relevant subject. A procedure should cover the non-availability of nominated persons and their replacement, when necessary.

(d)For STC cases, when compliance statement and associated documentation are produced by the TC holder, and when this data is approved under the system of the authority of TC holder, then the STC applicant does not need to provide, within its own DOA, the independent verification function that is required in point 21.A.239(d)(2) for that data.

DESIGN ASSURANCE ELEMENT — PARTNERS AND SUBCONTRACTORS In meeting the requirements of point 21.A.239(d)(3), the applicant for a design organisation approval under Subpart J may adopt the following policy:

(a)The satisfactory integration of the partner and subcontractor and applicant’s design assurance systems is demonstrated for the activities that are covered under the applicant’s terms of approval.

(b)In the event that a partner and subcontractor holds a design organisation approval (DOA), then in accordance with point 21.A.239(d)(3), the applicant may take this into account in demonstrating the effectiveness of that integrated system.

(c)When any partner and subcontractor does not hold a DOA, then the applicant will need to establish to its own satisfaction and the satisfaction of EASA, the adequacy of that partner’s/subcontractor’s design assurance system in accordance with point 21.A.243(b).

DESIGN ASSURANCE ELEMENT — PARTNER AND SUBCONTRACTOR ARRANGEMENTS When defining the arrangements between the design organisation (DO) and its partners and subcontractors, both elements of the design management system should be taken into account, i.e. the safety management element and the design assurance element. The following guidance should therefore be considered applicable to both elements.

(a)When the DO subcontracts activities, the arrangements should consider the safety risk management process that is part of its safety management element (see point 21.A.239(c)(3)). When the subcontractor does not have a safety management element, the subcontractor should be integrated into the safety management element of the DO; when the subcontractor has implemented a safety management system (such as for design organisation approval (DOA) or production organisation approval (POA)), the two safety management systems, i.e. of the DO and of the subcontractor, should be harmonised.

(b)Depending on the complexity and criticality of those arrangements, the following elements within the arrangements should be addressed:

(1)coordination and interfaces between all the parties involved;

(2)applicable procedures;

(3)safety culture, including internal safety reporting scheme (see point 21.A.3A).

(4)communication between all the parties involved, including reporting, regular meetings, and feedback channels;

(5)allocation of tasks, of clear accountability, and of responsibilities; and

(6)the qualifications and competency of key personnel with reference to point 21.A.245.

(c)The safety risk management should focus on the needs to exchange safety data and safety information that are deemed significant for the determination of relevant risks in terms of likelihood, severity, impact, and acceptability, such as, wherever appropriate, but not limited to the following:

(1)(at product level) failure, malfunction, defect, or other occurrences, non-conformity or outcome of the compliance monitoring function, component failure analysis, in-service event, etc.;

(2)(at documentation level) key processes (e.g. airworthiness directives, design and certification documentation, design processes); and

(3)(at organisation level) changes, disruptive events, resources’ issues, human performance (HP) issues.

(d)Regular communication should be ensured between all the parties involved, to discuss work progress, risk mitigation measures, changes to the arrangements, as well as any other significant issues.

INDEPENDENT MONITORING FUNCTION

(a)The independent monitoring function should ensure that:

(1)the activities of the design organisation (DO) are monitored for their compliance with the applicable requirements and with any additional requirements as established by the organisation, and that those activities are properly performed under the supervision of the nominated persons that are referred to in point 21.A.245(b); furthermore, compliance with, and the adequacy of, the design management system should be monitored;

(2)all subcontracted design activities are monitored for adequacy and compliance with the applicable arrangements;

(3)an objective review of the complete set of design-management-related activities is provided through independent monitoring activities, such as audits, inspections, reviews;

(4)the independence of the monitoring activities is established by always ensuring that those activities and inspections are performed by staff that are not involved in the function, procedure, or products that they monitor, and that are independent from the operating managers of the function(s) being monitored; however, this should not exclude support by domain experts during monitoring;

(5)a monitoring plan is established to show when and how often the activities that are required by Part 21 will be audited;

(6)the monitoring cycle should not exceed the applicable oversight planning cycle that is established according to point 21.B.432; the determination of the monitoring plan should consider at least the following aspects: the criticality of the items checked; and the safety performance of the organisation, including any previous findings and root causes;

(7)when non-compliance is found, the root cause(s) and contributing factor(s) are identified, and corrective action is defined and followed up; and

(8)feedback is provided to the management of the DO.

(b)The independent monitoring function that is required by point 21.A.239(e) may be undertaken by the existing quality assurance organisation if the DO is part of a larger organisation.

(c)The staff performing an independent monitoring function should have access to all the parts of the DO and, as necessary, to any subcontracted organisations.