21.B.25 Management system

GENERAL

(a)The competent authority should be organised in such a way that:

(1)there is specific and effective management authority in the conduct of all relevant activities;

(2)the functions and processes described in the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, AMC, CSs, and GM are be properly implemented;

(3)the competent authority’s policy, organisation and operating procedures for the implementation of the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, AMC, CSs, and GM are properly documented and applied;

(4)all the competent authority’s personnel who are involved in the related activities are provided with training where necessary;

(5)specific and effective provision is made for communicating and interfacing as necessary with EASA and other competent authorities; and

(6)all the functions related to implementing the applicable requirements are adequately described.

(b)A general policy in respect of the activities related to the applicable requirements of Regulation (EU) 2018/1139 and the delegated and implementing acts activities should be developed, promoted and implemented by the manager at the highest appropriate level; for example the manager at the top of the functional area of the competent authority that is responsible for such activities.

(1)Appropriate steps should be taken to ensure that the policy is known and understood by all the personnel involved, and all the necessary steps should be taken to implement and maintain the policy.

(2)The general policy should, in particular, take into account:

(a)the provisions of Regulation (EU) 2018/1139

(b)the provisions of the applicable delegated and implementing acts, AMC, CSs, and GM;

(c)the needs of industry; and

(d)the needs of EASA and of the competent authority.

(3)The policy should define specific objectives for the key elements of the competent authority organisation and processes for implementating the related activities, including the corresponding control procedures and the measurement of the achieved standard.

ORGANISATIONAL STRUCTURE

(a)In deciding upon the required organisational structure, the competent authority should review:

(1)the number of certificates, approvals, authorisations and letters of agreements to be issued;

(2)the number, complexity and sizes of the Part 21 organisations under its oversight obligations;

(3)the possible use of qualified entities and of the resources of the competent authority of other Member States to fulfil the continuing oversight obligations;

(4)the complexity of the aviation industry, taking into consideration the diversity of the products and parts; and

(5)the potential growth of activities in the field of civil aviation.

(b)The competent authority should retain effective control of the important surveillance functions and not delegate them in such a way that Part 21 organisations, in effect, regulate themselves in airworthiness matters.

(c)The set-up of the organisational structure should ensure that the various tasks and obligations of the competent authority do not solely rely on individuals. The continuous and undisturbed fulfilment of these tasks and obligations of the competent authority should also be guaranteed in cases of illness, accidents or leave of individual employees.

GENERAL – RELEVANT ACTIVITIES For the purpose of the AMC and GM to point 21.B.25, the activities referred to are those activities related to the certification and surveillance of design or production organisations.

DOCUMENTED POLICIES AND PROCEDURES

(a)The various elements of the organisation involved with the activities related to Regulation (EU) 2018/1139 and its delegated and implementing acts should be documented in order to establish a reference source for the establishment and maintenance of this organisation.

(b)The documented procedures should be established in a way that facilitates their use. They should be clearly identified, kept up to date and made readily available to all the personnel involved in the related activities.

(c)The documented procedures should cover, as a minimum, all of the following aspects:

(1)policies and objectives;

(2)the organisational structure;

(3)responsibilities and the associated authority;

(4)processes and procedures;

(5)internal and external interfaces;

(6)internal control procedures;

(7)the training of personnel;

(8)cross-references to associated documents; and

(9)assistance from other competent authorities or EASA (where required).

(d)It is likely that the information may be held in more than one document or series of documents, and suitable cross-referencing should be provided. For example, the organisational structure and the job descriptions are not usually in the same documentation as the detailed working procedures. In such cases, it is recommended that the documented procedures should include an index of cross-references to all such other related information, and the related documentation should be readily available when required.

SUFFICIENT PERSONNEL

(a)This GM on the determination of the required personnel is limited to the performance of certification and oversight tasks, excluding any personnel who are required to perform tasks that are subject to any national regulatory requirements.

(b)The elements to be considered when determining who are the required personnel and when planning their availability may be divided into quantitative and qualitative elements:

(1)Quantitative elements

(i)the estimated number of initial certificates to be issued;

(ii)the number of organisations to be certified by the competent authority;

(iii)the estimated number of subcontracted organisations used by certified organisations.

(2)Qualitative elements

(i)the size, nature, and complexity of the activities of certified organisations, taking into account:

(A)the privileges of each organisation;

(B)the types of approval and the scopes of approval;

(C)possible certification to industry standards;

(D)the number of personnel; and

(E)the organisational structure and the existence of subsidiaries;

(ii)the safety priorities identified;

(iii)the results of past oversight activities, including audits, inspections and reviews, in terms of risks and regulatory compliance, taking into account:

(A)the number and the levels of findings;

(B)the time frame for the implementation of corrective actions;

(C)the maturity of the management systems implemented by organisations, and their ability to effectively manage safety risks; and

(iv)the size and complexity of the Member States’ aviation industry, and the potential growth of activities in the field of civil aviation, which may be an indication of the number of new applications, and changes to existing certificates to be expected.

(c)Based on existing data from previous oversight planning cycles, and taking into account the situation within the Member State’s aviation industry, the competent authority may estimate:

(1)the standard working time required for processing applications for new certificates, approvals, authorisations or letters of agreement;

(2)the number of new certificates, approvals, authorisations or letters of agreement to be issued for each planning period; and

(3)the number of changes to existing certificates, approvals, authorisations or letters of agreement to be processed for each planning period.

(d)In line with the competent authority’s oversight policy, the following planning data should be determined:

(1)the standard number of audits to be performed per oversight planning cycle;

(2)the standard duration of each audit;

(3)the standard working time for audit preparation, on-site audit, reporting, and follow-up per inspector;

(4)the standard number of unannounced inspections to be performed;

(6)the standard duration of inspections, including preparation, reporting, and follow-up per inspector; and

(7)the minimum number and the required qualifications of the inspectors for each audit/inspection.

(e)The standard working time could be expressed either in working hours per inspector, or in working days per inspector. All planning calculations should, then, be based on the same units (working hours or days).

(f)The use of a spreadsheet application is recommended to process the data defined under (c) and (d), to assist in determining the total number of working hours/days per oversight planning cycle required for certification, oversight and enforcement activities. This application could also serve as a basis for implementing a system for planning the availability of personnel.

(g)The number of working hours/days per planning period for each qualified inspector that may be allocated for certification, oversight and enforcement activities should be determined, taking into account:

(1)purely administrative tasks not directly related to certification and oversight;

(2)training;

(3)participation in other projects;

(4)planned absences; and

(5)the need to include a reserve for unplanned tasks or unforeseeable events.

(h)The determination of working time available for certification, oversight and enforcement activities should also consider, if applicable:

(1)the use of qualified entities;

(2)cooperation with other competent authorities for approvals that involve more than one Member State; and

(3)oversight activities under a bilateral aviation safety agreement.

(i)Based on the elements listed above, the competent authority should be able to:

(1)monitor the dates when audits and inspections are due, and when they were carried out;

(2)implement a system to plan the availability of personnel; and

(3)identify possible gaps between the number and the qualifications of personnel and the required volume of certification and oversight. Care should be taken to keep planning data up to date in line with changes in the underlying planning assumptions, with a particular focus on risk-based oversight principles.

QUALIFICATIONS AND TRAINING — GENERAL

(a)It is essential for the competent authority to have the full capability to adequately assess the compliance and performance of an organisation by ensuring that the whole range of activities is assessed by appropriately qualified personnel.

(b)For each inspector, the competent authority should:

(1)define the competencies required to perform the allocated certification and oversight tasks;

(2)define the associated minimum qualifications that are required;

(3)establish initial and recurrent training programmes in order to maintain and to enhance the competency of inspectors at the level that is necessary to perform the allocated tasks; and

(4)ensure that the training provided meets the established standards, and is regularly reviewed and updated as necessary.

(c)The competent authority should ensure that training is provided by qualified trainers with appropriate training skills.

QUALIFICATIONS AND TRAINING — INSPECTORS

(a)Competent authority inspectors should have:

(1)practical experience and expertise in the application of aviation safety standards and safe operating practices;

(2)comprehensive knowledge of:

(i)relevant parts of Regulation (EU) 2018/1139 and its delegated and implementing acts and the related AMC, CSs and GM;

(ii)the competent authority’s procedures;

(iii)the rights and obligations of an inspector;

(iv)safety management systems based on the EU management system requirements and ICAO Annex 19, and compliance monitoring;

(v)design or production standards, as applicable;

(vi)design-related or production-related human factors and human performance principles, as appropriate;

(3)training on auditing techniques and assessing and evaluating management systems and safety risk management processes;

(4)5 years of relevant work experience to be allowed to work without supervision as an inspector. This may include experience gained during training to obtain the qualifications described in point (a)(5) below; and

(5)a relevant engineering degree with additional education. ‘Relevant engineering degree’ means an engineering degree from aeronautical, mechanical, electrical, electronic, avionics or other studies relevant to the design and production of aircraft/aircraft components.

(b)In addition to technical competency, inspectors should have a high degree of integrity, be impartial in carrying out their tasks, be tactful, and have a good understanding of human nature.

(c)A programme for recurrent training should be developed that ensures that the inspectors remain competent to perform their allocated tasks. As a general policy, it is not desirable for the inspectors to obtain technical qualifications from those entities that are under their direct regulatory oversight.

INITIAL AND RECURRENT TRAINING — INSPECTORS

(a)Initial training programme The initial training programme for inspectors should include, to an extent appropriate to their role, current knowledge, experience and skills in at least the following:

(1)aviation legislation, organisation, and structure;

(2)the Chicago Convention, the relevant ICAO Annexes and Documents;

(3)Regulation (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation;

(4)overview of Regulation (EU) 2018/1139 and its delegated and implementing acts and the related AMC, CSs, and GM;

(5)Regulation (EU) No 748/2012 as well as any other applicable requirements;

(6)management systems, including the assessment of the effectiveness of a management system, in particular hazard identification and risk assessment, and non-punitive reporting techniques in the context of the implementation of a ‘just culture’;

(7)auditing techniques;

(8)procedures of the competent authority that are relevant to the inspectors’ tasks;

(9)human factors principles;

(10)the rights and obligations of inspecting personnel of the competent authority;

(11)on-the-job training relevant to the inspector’s tasks;

(12)technical training that is appropriate to the role and tasks of the inspector, in particular for those areas that require approvals. NOTE: The duration of the on-the-job training should take into account the scope and complexity of the inspector’s tasks. The competent authority should assess whether the required competency has been achieved before an inspector is authorised to perform a task without supervision.

(b)Recurrent training programme Once qualified, the inspector should undergo training periodically, as well as whenever it is deemed necessary by the competent authority, in order to remain competent to perform the allocated tasks. The recurrent training programme for inspectors should include, as appropriate to their role, at least the following topics:

(1)changes in aviation legislation, the operational environment and technologies;

(2)procedures of the competent authority that are relevant to the inspector’s tasks;

(3)technical training that is appropriate to the role and tasks of the inspector; and

(4)results from past oversight.

(c)Assessments of an inspector’s competency should take place at regular intervals that do not exceed 3 years. The results of these assessments, as well as any actions taken following these assessments, should be recorded.

SAFETY RISK MANAGEMENT PROCESS

(a)The safety risk management process required by point (a)(5) of point 21.B.25 should be documented. The following should be defined in the related documentation:

(1)means for hazard identification and the related data sources, taking into account data that comes from other competent authorities with which the competent authority interfaces in the State or from the competent authorities of other Member States;

(2)risk management steps including:

(i)analysis (in terms of the probability and the severity of the consequences of hazards and occurrences);

(ii)assessment (in terms of tolerability); and

(iii)control (in terms of mitigation) of risks to an acceptable level;

(3)who holds the responsibilities for hazard identification and risk management;

(4)who holds the responsibility for the follow-up of risk mitigation actions;

(5)the levels of management who have the authority to make decisions regarding the tolerability of risks;

(6)means to assess the effectiveness of risk mitigation actions; and

(7)the link with the compliance monitoring function.

(b)To demonstrate that the safety risk management process is operational, competent authorities should be able to provide evidence that:

(1)the persons involved in internal safety risk management activities are properly trained;

(2)hazards that could impact the authority’s capabilities to perform its tasks and discharge its responsibilities have been identified, and the related risk assessment is documented;

(3)regular meetings take place at appropriate levels of management of the competent authority to discuss the risks identified and to decide on the risk tolerability and possible risk mitigations;

(4)in addition to the initial hazard identification exercise, the risk management process is triggered as a minimum whenever changes occur that may affect the competent authority’s capability to perform any of the tasks required by Part 21;

(5)a record of the actions taken to mitigate risks is maintained, showing the status of each action and the owner of the action;

(6)there is follow-up on the implementation of all risk mitigation actions;

(7)risk mitigation actions are assessed for their effectiveness;

(8)the results of risk assessments are periodically reviewed to check whether they remain relevant.

SAFETY RISK MANAGEMENT PROCESS The purpose of safety risk management as part of the management system framework for competent authorities is to ensure the effectiveness of the management system. As for any organisation, hazard identification and risk management are expected to contribute to effective decision-making, to guide resource allocation and contribute to organisational success. The safety risk management process required by point 21.B.25 is intended to address the safety risks that are directly related to the competent authority’s organisation and processes, and which may affect its capability to perform its tasks and discharge its responsibilities. This process is not intended to be a substitute for the State safety risk management SARPs defined in ICAO Annex 19, Chapter 3. This does not mean, however, that the competent authority may not use information and data that is obtained through its State Safety Programme (SSP), including oversight data and information, for the purpose of safety risk management as part of its management system. The safety risk management process is also to be applied to the management of changes (point 21.B.35), which is intended to ensure that the management system remains effective whenever changes occur.

PROCEDURES AVAILABLE TO EASA

(a)Copies of the procedures related to the management system of the competent authority of the Member State, and their amendments, that should be made available to EASA for the purpose of standardisation, should provide at least the following information:

(1)the competent authority’s organisational structure for the continuing oversight functions that it undertakes, with a description of the main processes. This information should demonstrate the allocation of responsibilities within the competent authority, and that the competent authority is capable of carrying out the full range of tasks regarding the size and complexity of the Member State’s aviation industry. It should also consider the overall proficiency and the scope of authorisation of the competent authority’s personnel;

(2)for personnel who are involved in oversight activities, the minimum required professional qualification and amount of experience, and the principles that guide their appointment (e.g. assessment);

(3)how the following are carried out: assessments of applications and evaluations of compliance; the issuance of certificates, approvals, authorisations and letters of agreement; continuing oversight activities; the follow-up of findings; enforcement measures; and the resolution of safety concerns;

(4)the principles used to manage exemptions and derogations;

(5)the processes that are in place to distribute applicable safety information for timely reaction to a safety problem;

(6)the criteria for planning continuing oversight activities (i.e. an oversight programme), including the management of interfaces when conducting continuing oversight activities;

(7)an outline of the initial training of newly recruited oversight personnel (taking future activities into account), and the basic framework for the recurrent training of oversight personnel.

(b)As part of the continuous monitoring of a competent authority, EASA may request details of the working methods used, in addition to a copy of the procedures of the competent authority’s management system (and any amendments). These additional details are the procedures and related guidance material that describe the working methods for the personnel of the competent authority who conduct oversight activities.

(c)Information related to the competent authority’s management system may be submitted in an electronic format.