21.B.222 Oversight programme

ANNUAL REVIEW

(a)The oversight planning cycle and the related oversight programme for each organisation should be reviewed annually to ensure that they remain adequate regarding any changes in the nature of the organisation, the complexity of its activities or the safety performance of the organisation.

(b)When reviewing the oversight planning cycle and the related oversight programme, the competent authority should also consider any relevant information collected in accordance with points 21.A.3A and 21.B.215(d).

OVERSIGHT PLANNING

(a)When defining the oversight programme, the competent authority should assess the risks related to the activity and set-up of each organisation and adapt the oversight to the level of risk identified and to the effectiveness of the organisation’s management system, in particular its ability to effectively manage safety risks.

(b)The competent authority should establish a schedule of assessments, audits and inspections that is appropriate to each organisation. The planning of assessments, audits and inspections should take into account the results of the hazard identification and risk assessment conducted and maintained by the organisation as part of the organisation’s management system. Inspectors should work in accordance with the schedule provided to them.

(c)When the competent authority, having regard to the level of risk identified and the effectiveness of the organisation’s management system, varies the frequency of an audit or inspection, it should ensure that all the aspects of the organisation’s activities are audited and inspected within the applicable oversight planning cycle.

SPECIFIC NATURE OF THE ORGANISATION AND COMPLEXITY OF ITS ACTVITIES — RESULTS OF PAST OVERSIGHT ACTIVITIES When determining the oversight programme, including a relevant sample of production activities under the scope of the organisation as product audits, the competent authority should consider in particular the following elements, as applicable:

(a)the effectiveness of the organisation’s management system in identifying and addressing non-compliances and safety hazards;

(b)the implementation by the organisation of any industry standards that are directly relevant to the organisation’s activity subject to Part 21;

(b)the procedures for the management and the scope of non-significant changes;

(c)any specific procedures implemented by the organisation that are related to any alternative means of compliance used;

(d)the number of approved locations and the activities performed at each location;

(e)the number and scope of subcontractors that perform production activities; and

(f)the volume of activity for each product or parts.

SUBCONTRACTED ACTIVITIES If a production organisation subcontracts production activities, the competent authority should determine whether the subcontracted organisations need to be audited and include this in the oversight programme, taking into account the specific nature and complexity of the subcontracted activities, the results of previous oversight activities of the production organisation, and assessment of the associated risks. For such an audit, the competent authority inspectors should ensure that they are accompanied throughout the audit by a representative of the production organisation. NOTE: If a production organisation subcontracts production activities, the competent authority should verify that the production organisation has sufficient control over the subcontracted activities and manages the related risks.

ASSESSMENTS, AUDIT AND INSPECTIONS

(a)The oversight programme should indicate which aspects of the approval will be covered by each assessment, audit or inspection.

(b)Audits may be complemented by a review of the independent monitoring function results related to the topic of the audit.

(c)At the conclusion of the assessment, audit or inspection, the POA team should complete a report that identifies the areas and processes that were covered and includes all the findings and observations that were raised.

(d)At the completion of each oversight planning cycle, the POATL responsible for the POA should complete an EASA Form 56 (see GM1 21.B.220) as a summary report for the continued surveillance, including the recommendation for a continuation of the POA, as applicable. EASA Form 56 should be countersigned by the person responsible within the competent authority for the acceptance. At this stage, there is no limitation on the number of level 2 findings that may be open, provided that they are within the time limits of the respective corrective action plans.

GUIDE TO THE CONDUCT OF MONITORING PRODUCTION STANDARDS

(a)Point 21.B.222(b)(1)(ii) identifies the need for a sample investigation of products, parts or appliances, their associated conformity determinations and the certifications made by a POA holder. For this to be performed effectively and efficiently, the competent authority should integrate a sampling plan as part of the planning of the investigation and continued surveillance activities that are appropriate to the scope and size of the relevant applicant.

(b)The sample investigation could, for example, include:

(1)a modification (or change);

(2)the installation, testing, or operation of a major part or system;

(3)the accuracy and generation of the flight test report data;

(4)the accuracy and generation of the weighing report data;

(5)an engine test bed run;

(6)the traceability of records;

(7)the accuracy and generation of the statement of conformity data and the associated safe operation determination; and

(8)the accuracy and generation of EASA Form 1 data.

OVERSIGHT PLANNING CYCLE — AUDIT

(a)For each organisation approved by the competent authority, all applicable requirements including processes should be audited at periods that do not exceed the applicable oversight planning cycle. The beginning of the first oversight planning cycle is normally determined by the date of issue of the first approval. If the competent authority wishes to align the oversight planning cycle with the calendar year, it should shorten the first oversight planning cycle accordingly.

(b)The oversight planning should include at least one on-site audit within each oversight planning cycle. For organisations that carry out their regular activities at more than one site, the determination of the sites and the requirements to be audited at these sites should consider the results of past oversight activities and the volume of activity at each site, as well as the main risk areas identified.

(c)For organisations that hold more than one approval under Regulation (EU) 2018/1139, the competent authority may define an integrated oversight schedule to include all the applicable audit items. In order to avoid any duplication of audits, credit may be granted for any specific audit items already completed during the current oversight planning cycle, provided that:

(1)the specific audit item is the same for all the approvals under consideration;

(2)there is satisfactory evidence on record that the specific audit items were carried out and that all corrective actions have been implemented to the satisfaction of the competent authority; and

(3)the competent authority should be satisfied that there is no evidence that standards have deteriorated regarding those specific audit items for which credit is granted.

STANDARD OVERSIGHT PLANNING CYCLE The expression ‘shall not exceed 24 months’ does not imply that 24 months is a minimum duration for the oversight cycle. Based on the elements specified in 21.B.221(c) and 21.B.222(b) (e.g. safety priorities, assessment of the risks, complexity of activities), the competent authority may decide to apply a cycle of less than 24 months (e.g. 12 months).

EXTENSION OF THE OVERSIGHT PLANNING CYCLE BEYOND 24 MONTHS

(a)Regardless of planning cycle length, the competent authority should perform at least one focused inspection of the organisation (inspection of a specific area, element or aspect of the organisation) within each 12-month segment of the applicable oversight planning cycle, to support the determined length of the planning cycle.

(b)If the oversight planning was beyond 24 months and the results of the focused inspection indicate a decrease in the safety performance of the organisation, the competent authority should revert to a 24-month (or shorter) oversight planning cycle and review the oversight programme accordingly.

(c)In order to be able to apply an oversight planning cycle of up to 36 months, the competent authority should agree on the format and contents of the continuous reporting to be made by the organisation on its safety performance and regulatory compliance.

(d)To enable the competent authority to apply an oversight planning cycle of up to 48 months, the competent authority should establish, implement and maintain a methodology to evaluate the safety performance of the organisation, focusing on the organisation’s ability to effectively identify aviation safety hazards and manage the associated risks.

ORGANISATION’S CONTROL OVER THE CHANGES For the purpose of extending the oversight planning beyond 24 months, the continuous compliance of the organisation with 21.A.147 and 21.A.148, and the full control over all changes referred to in point 21.B.222(d)(2), includes in particular the ability of the organisation to manage adequately the changes not requiring prior approval foreseen in 21.A.147 and 21.A.148.