21L.B.16 Management system

GENERAL

(a)In deciding upon the required airworthiness organisational structure, the competent authority should review:

(1)the number of certificates, approvals and their scope, declarations and authorisations to be issued;

(2)the number, complexity and size of the organisations under its oversight obligations;

(3)the possible use of qualified entities and of the resources of the competent authorities of other Member States to fulfil the continuing oversight obligations;

(4)the complexity of the aviation industry, taking into consideration the diversity of the products and parts; and

(5)the potential growth of activities in the field of civil aviation.

(b)The competent authority should retain effective control of the important surveillance functions and not delegate them in such a way that organisations, in effect, regulate themselves in airworthiness matters.

(c)The set-up of the organisational structure should ensure that the various tasks and obligations of the competent authority do not solely rely on individuals. The continuous and undisturbed fulfilment of these tasks and obligations of the competent authority should also be guaranteed in cases of illness, accidents or leave of individual employees.

GENERAL

(a)The competent authority should be organised in such a way that:

(1)there is specific and effective management authority in the conduct of all the relevant activities;

(2)the functions and processes described in the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, acceptable means of compliance (AMC), certification specifications (CSs), detailed technical specifications and guidance material (GM) may be properly implemented;

(3)the competent authority policies, organisation and operating procedures for the implementation of the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, AMC, CSs and GM are properly documented and applied;

(4)all the personnel of the competent authority involved in the related activities are provided with training where necessary;

(5)specific and effective provision is made for the communication and interface as necessary with EASA and other competent authorities; and

(6)all the functions related to implementing the applicable requirements are adequately described.

(b)A general policy in respect to the activities related to the applicable requirements of Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on its basis should be developed, promoted and implemented by the manager at the highest appropriate level — for example, the manager at the top of the functional area of the competent authority that is responsible for such activities.

(c)Appropriate steps should be taken to ensure that the policy is known and understood by all the personnel involved, and all the necessary steps should be taken to implement and maintain the policy.

(d)The general policy should, in particular, take into account:

(1)the provisions of Regulation (EU) 2018/1139;

(2)the provisions of the applicable delegated and implementing acts and also the associated AMC, CSs and GM;

(3)the needs of industry; and

(4)the needs of EASA and of the other competent authorities.

(e)The policy should define specific objectives for the key elements of the competent authority’s organisation and processes for implementing the related activities, including the corresponding control procedures and the measurement of the achieved standard.

OVERSIGHT OF DECLARED ORGANISATIONS The following are the activities which should be covered by the competent authority management system for the oversight of declared organisations (declared production organisations under Section A Subpart G, and declared design organisations under Section A Subpart J of Annex Ib (Part 21 Light)):

(a)appointment of the declared organisation team leader and the team;

(b)verification of the declaration received;

(c)registration of the declaration;

(d)establishment of an oversight programme;

(e)performance of oversight activities;

(f)follow-up of corrective actions;

(g)recommendation on the continuation of the activities conducted by the declared organisation;

(h)registration of the changes notified by the declared organisations under point 21L.A.128 or point 21L.A.178 respectively; and

(i)enforcement measures under point 21L.B.22.

DOCUMENTED POLICIES AND PROCEDURES

(a)The various elements of the organisation for the activities related to Regulation (EU) 2018/1139 and its delegated and implementing acts should be documented in order to establish a reference source for the establishment and maintenance of such organisation.

(b)The documented procedures should be established in a way that facilitates their use. They should be clearly identified, kept up to date and made readily available to all the personnel involved in the related activities.

(c)The documented procedures should cover, as a minimum, all the following aspects:

(1)policies and objectives;

(2)the organisational structure;

(3)responsibilities and the associated authority;

(4)processes and procedures;

(5)internal and external interfaces;

(6)internal control procedures;

(7)the training of personnel;

(8)cross references to associated documents; and

(9)assistance from other competent authorities or EASA (where required).

(d)It is likely that the information may be held in more than one document or series of documents, and suitable cross-referencing should be provided. For example, the organisational structure and the job descriptions are not usually in the same documentation as the detailed working procedures. In such cases, it is recommended that the documented procedures should include an index of cross references to all such other related information, and the related documentation should be readily available when required.

SUFFICIENT PERSONNEL

(a)This GM on the determination of the required personnel is limited to the performance of certification and oversight tasks, excluding any personnel that are required to perform tasks subject to any national regulatory requirements.

(b)The elements to be considered when determining the required personnel and planning their availability may be divided into quantitative and qualitative elements, and there should be, at least:

(1)quantitative elements in accordance with AMC1 21L.B.16; and

(2)the following qualitative elements:

(i)the size, nature and complexity of the activities of overseen organisations, taking into account:

(A)the privileges of the organisation (if applicable);

(B)the type of the approval (if applicable) and the scope of the approval/declaration;

(C)possible certification to industry standards;

(D)the number of personnel; and

(E)the organisational structure and the existence of subcontractors;

(ii)the safety priorities identified;

(iii)the results of past oversight activities, including audits, inspections and reviews, in terms of risks and regulatory compliance, taking into account:

(A)the number and the levels of findings;

(B)the time frame for the implementation of corrective actions; and

(C)the maturity of the management systems implemented by the organisation, and their ability to effectively manage safety risks; and

(iv)the size and complexity of the Member States’ aviation industry, and the potential growth of activities in the field of civil aviation, which may be an indication of the number of new applications, and of changes to existing certificates, approvals, declarations, and authorisations to be expected.

(c)Based on existing data from previous oversight planning cycles, and taking into account the situation within the Member States’ aviation industry, the competent authority may estimate:

(1)the standard working time required for processing applications for new certificates, approvals and authorisations, or registration of declarations;

(2)the number of new certificates and approvals to be issued, or registrations of declarations for each oversight planning period; and

(3)the number of changes to existing certificates, approvals, authorisations and declarations to be processed for each oversight planning period.

(d)In line with the competent authority’s oversight policy, the following planning data should be determined:

(1)the standard number of audits to be performed per oversight planning cycle;

(2)the standard duration of each audit;

(3)the standard working time for audit preparation, on-site auditing, reporting, and follow-up, per inspector;

(4)the standard number of unannounced inspections to be performed;

(5)the standard duration of inspections, including the preparation, reporting, and follow-up, per inspector; and

(6)the minimum number and required qualifications of inspectors for each audit/inspection.

(e)Standard working time could be expressed either in working hours per inspector, or in working days per inspector. All planning calculations should, then, be based on the same units (hours or working days).

(f)It is recommended to use a spreadsheet application to process the data defined under points (c) and (d) to assist in determining the total number of working hours/days per oversight planning cycle required for certification, oversight and enforcement activities. This application could also serve as a basis for implementing a system for planning the availability of personnel.

(g)The number of working hours/days per planning period for each qualified inspector that may be allocated for certification, oversight and enforcement activities should be determined, taking into account:

(1)purely administrative tasks not directly related to certification and oversight;

(2)training;

(3)participation in other projects;

(4)planned absences; and

(5)the need to include a reserve for unplanned tasks or unforeseeable events.

(h)The determination of working time available for certification, oversight and enforcement activities should also consider, if applicable:

(1)the use of qualified entities;

(2)cooperation with other competent authorities for approvals that involve more than one Member State; and

(3)oversight activities under a bilateral aviation safety agreement.

(i)Based on the elements listed above, the competent authority should be able to:

(1)monitor the dates when audits and inspections are due, and when they were carried out;

(2)implement a system to plan the availability of personnel; and

(3)identify possible gaps between the number and the qualifications of personnel and the required volume of certification and oversight. Care should be taken to keep planning data up to date in line with changes in the underlying planning assumptions, with a particular focus on risk-based oversight principles.

QUALIFICATIONS AND TRAINING — GENERAL

(a)It is essential for the competent authority to have the full capability to adequately assess the compliance and performance of an organisation by ensuring that the whole range of activities is assessed by appropriately qualified personnel.

(b)For each inspector, the competent authority should:

(1)define the competencies required to perform the allocated certification and oversight tasks;

(2)define the associated minimum qualifications that are required;

(3)establish initial and recurrent training programmes in order to maintain and to enhance the competency of inspectors at the level that is necessary to perform the allocated tasks; and

(4)ensure that the training provided meets the established standards and is regularly reviewed and updated as necessary.

(c)The competent authority should ensure that training is provided by qualified trainers with appropriate training skills.

QUALIFICATIONS AND TRAINING — INSPECTORS

(a)Competent authority inspectors should have:

(1)practical experience and expertise in the application of aviation safety standards and safe operating practices;

(2)comprehensive knowledge of:

(i)the relevant parts of Regulation (EU) 2018/1139 and its delegated and implement acts and the related AMC, CSs and GM;

(ii)the competent authority’s procedures;

(iii)their rights and obligations of an inspector;

(iv)systems based on the EU management system requirements (including compliance monitoring) and on ICAO Annex 19;

(v)design or production standards, as applicable; and

(vi)design- or production- (as applicable) related human-factors and human-performance principles;

(3)training in auditing techniques and assessing and evaluating management systems and safety-related processes and procedures;

(4)relevant work experience to be allowed to work without supervision as an inspector; this may include experience gained during training to obtain the qualifications described in following point (5); and

(5)a relevant engineering degree with additional education; ‘relevant engineering degree’ means an engineering degree from aeronautical, mechanical, electrical, electronic, avionics or other studies relevant to the design and production of aircraft / aircraft components.

(b)In addition to their technical competency, inspectors should have a high degree of integrity, be impartial in carrying out their tasks, be tactful, and have a good understanding of human nature.

(c)A programme for recurrent training should be developed to ensure that inspectors remain competent to perform their allocated tasks; as a general policy, it is not desirable for inspectors to obtain technical qualifications from those entities that are under their direct regulatory oversight.

INITIAL AND RECURRENT TRAINING FOR INSPECTORS

(a)Initial training programme The initial training programme for inspectors should include, to an extent appropriate to their role, current knowledge, experience and skills, at least all the following:

(1)aviation legislation, organisation, and structure;

(2)the Chicago Convention, the relevant ICAO annexes and documents;

(3)Regulation (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation;

(4)an overview of Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on its basis, and the related AMC, CSs and GM;

(5)specific knowledge of Regulation (EU) No 748/2012 as well as of any other applicable requirements;

(6)management systems, including the assessment of the effectiveness of a management system, in particular hazard identification and risk assessment, and non-punitive reporting techniques in the context of the implementation of a just culture;

(7)auditing techniques;

(8)procedures of the competent authority that are relevant to the inspector’s tasks;

(9)human-factors principles;

(10)the rights and obligations of inspecting personnel of the competent authority;

(11)on-the-job training relevant to the inspector’s tasks; and

(12)technical training appropriate to the role and tasks of the inspector, in particular for those areas that require approvals. Note: The duration of the on-the-job training should take into account the scope and complexity of the inspector’s tasks. The competent authority should assess whether the required level of competence has been achieved before an inspector is authorised to perform a task without supervision.

(b)Recurrent training programme Once qualified, the inspector should receive training periodically, as well as whenever it is deemed necessary by the competent authority, in order to remain competent to perform their allocated tasks. The recurrent training programme for inspectors should include, as appropriate to their role, at least the following topics:

(1)changes in aviation legislation, the operational environment and technologies;

(2)procedures of the competent authority that are relevant to the inspector’s tasks;

(3)technical training that is appropriate to the role and tasks of the inspector; and

(4)results from past oversight activities.

(c)Assessments of an inspector’s competency should take place at regular intervals that do not exceed 3 years. The results of these assessments, as well as any actions taken following these assessments, should be recorded.

SAFETY RISK MANAGEMENT PROCESS

(a)The safety risk management process required by point 21L.B.16 should be documented. The following should be defined in the related documentation:

(1)the means used for hazard identification and the related data sources, taking into account data that comes from other competent authorities with which the competent authority interfaces in the State or from the competent authorities of other Member States;

(2)risk management steps including:

(i)analysis (in terms of the probability and severity of the consequences of hazards and occurrences);

(ii)assessment (in terms of the tolerability); and

(iii)control (in terms of the mitigation) of risks to an acceptable level;

(3)who has the responsibility for hazard identification and risk management;

(4)who has the responsibility for the follow-up of risk-mitigation actions;

(5)the levels of management that have the authority to make decisions regarding the tolerability of risks;

(6)the means to assess the effectiveness of risk-mitigation actions; and

(7)the link with the compliance-monitoring function.

(b)To demonstrate that the safety risk management process is operational, competent authorities should be able to provide evidence that:

(1)the persons involved in internal safety risk management activities are properly trained;

(2)hazards that could impact on the authority’s capabilities to perform its tasks and discharge its responsibilities have been identified, and the related risk assessment is documented;

(3)regular meetings take place at appropriate levels of management of the competent authority to discuss the risks identified and to decide on the risk tolerability and possible risk-mitigation actions;

(4)in addition to the initial hazard identification exercise, the risk management process is triggered as a minimum whenever changes occur that may affect the competent authority’s capability to perform any of the tasks required by Part 21 Light;

(5)a record of the actions taken to mitigate risks is maintained, showing the status of each action and the owner of the action;

(6)there is follow-up on the implementation of all risk-mitigation actions;

(7)risk-mitigation actions are assessed for their effectiveness;

(8)the results of risk assessments are periodically reviewed to check whether they remain relevant.

SAFETY RISK MANAGEMENT PROCESS The purpose of safety risk management, as part of the management system framework for competent authorities, is to ensure the effectiveness of the management system. As for any organisation, hazard identification and risk management are expected to contribute to effective decision-making, to guide resource allocation and contribute to organisational success. The safety risk management process required by point 21L.B.16 is intended to address safety risks that are directly related to the competent authority’s organisation and processes, and which may affect its capability to perform its tasks and discharge its responsibilities. This process is not intended to be a substitute for the State safety risk management Standards and Recommended Practices (SARPs) defined in ICAO Annex 19 Chapter 3. This does not mean, however, that the competent authority may not use information and data obtained through its State Safety Programme (SSP), including oversight data and information, for the purpose of safety risk management as part of its management system. The safety risk management process is also to be applied to the management of changes (point 21L.B.18), which is intended to ensure that the management system remains effective whenever changes occur.

PROCEDURES AVAILABLE TO THE AGENCY

(a)Copies of the procedures related to the competent authority’s management system, and their amendments, which should be made available to EASA for the purpose of standardisation, should provide at least the following information:

(1)The competent authority’s organisational structure for the continuing oversight functions that it undertakes, with a description of the main processes. This information should demonstrate the allocation of responsibilities within the competent authority, and that the competent authority is capable of carrying out the full range of tasks regarding the size and complexity of a particular Member State’s aviation industry. It should also consider the overall proficiency and the scope of authorisation of the competent authority’s personnel;

(2)For personnel that are involved in oversight activities, the minimum required professional qualification and level of experience, and the principles that guide their appointment (e.g. assessment);

(3)How the following are carried out: assessments of applications and evaluations of compliance; the issuance of certificates, approvals, and authorisations; continuing oversight activities; the follow-up of findings; enforcement measures; and the resolution of safety concerns;

(4)The principles used to manage exemptions and derogations;

(5)The processes that are in place to distribute applicable safety information for timely reaction to a safety problem;

(6)The criteria for planning continuing oversight activities (i.e. an oversight programme), including the management of interfaces when conducting continuing oversight activities; and

(7)An outline of the initial training of newly recruited oversight personnel (taking future activities into account), and the basic framework for the recurrent training of oversight personnel.

(b)As part of the continuous monitoring of a competent authority, EASA may request details of the working methods used, in addition to a copy of the procedures of the competent authority’s management system (and of any amendments to it). These additional details are the procedures and related guidance material that describe the working methods for the personnel of the competent authority that conduct oversight activities.

(c)Information related to the competent authority’s management system may be submitted in an electronic format.