21.B.432 Oversight programme

ANNUAL REVIEW

(a)The oversight planning cycle and the related oversight programme for each organisation should be reviewed annually to ensure that they remain adequate regarding any changes in the nature of the organisation, the complexity of its activities or the safety performance of the organisation.

(b)When reviewing the oversight planning cycle and the related oversight programme, the competent authority should also consider any relevant information collected in accordance with point 21.B.431(c).

OVERSIGHT PLANNING

(a)When defining the oversight programme, the competent authority should assess the risks related to the activity and set-up of each organisation, and adapt the oversight to the level of risk identified and to the effectiveness of the organisation’s management system, in particular its ability to effectively manage safety risks.

(b)The competent authority should establish a schedule of assessments, audits and inspections that is appropriate to each organisation. The planning of assessments, audits and inspections should take into account the results of the hazard identification and the risk assessment conducted and maintained by the organisation as part of the organisation’s management system.

SPECIFIC NATURE OF THE ORGANISATION AND COMPLEXITY OF ITS ACTIVITIES — RESULTS OF PAST OVERSIGHT ACTIVITIES When determining the oversight programme, including a relevant sample of design activities under the scope of the organisation as product audits, the competent authority should consider in particular the following elements, as applicable:

(a)the effectiveness of the organisation’s management system in identifying and addressing non-compliances and safety hazards;

(b)the implementation by the organisation of any industry standards that are directly relevant to the organisation’s activity subject to Part 21;

(c)the procedure for the management and the scope of non-significant changes;

(d)the number of locations and the activities performed at each location;

(e)the number and scope of subcontractors that perform design activities; and

(f)the overall volume of activity and, as applicable, per specific product.

SUBCONTRACTED ACTIVITIES If a design organisation subcontracts design activities, the competent authority should determine whether the subcontracted organisations need to be audited and include this in the oversight programme, taking into account the specific nature and complexity of the subcontracted activities, the results of previous oversight activities of the design organisation, and assessment of the associated risks. For such an audit, the competent authority inspectors should ensure that they are accompanied throughout the audit by a representative of the design organisation. NOTE: If a design organisation subcontracts design activities, the competent authority should verify that the design organisation has sufficient control over the subcontracted activities and manages the related risks.

ASSESSMENTS, AUDITS AND INSPECTIONS

(a)The oversight programme should indicate which aspects of the approval will be covered by each assessment, audit or inspection.

(b)Audits may be complemented by a review of the independent monitoring function results related to the topic of the audit.

(c)At the conclusion of the assessment, audit, or inspection, the DOA team should complete a report that identifies the areas and processes that were covered and includes all the findings and observations that were raised.

OVERSIGHT PLANNING CYCLE — AUDIT

(a)The beginning of the first oversight planning cycle is determined by the date of issue of the first approval.

(b)The oversight planning should include at least one on-site audit within each oversight planning cycle. For organisations that carry out their regular activities at more than one site, the determination of the sites to be audited should consider the results of past oversight activities and the volume of activity at each site, as well as the main risk areas identified.

EXTENSION OF THE OVERSIGHT PLANNING CYCLE BEYOND 24 MONTHS

(a)When at the time before applicability of Commission Delegated Regulation (EU) 2022/201 the oversight planning cycle was determined to be 36 months, the oversight planning cycle can continue to be 36 months unless the criteria of point (b) would apply.

(b)If the results of the oversight activities indicate an overall decrease in the safety performance or regulatory compliance of the organisation, the competent authority should consider reverting back to a 24-month oversight planning cycle or adapt the oversight planning accordingly.

(c)In order to be able to apply an oversight planning cycle beyond 36 months, the competent authority should agree on the format and contents of regular reporting to be made by the organisation on its safety performance and regulatory compliance.