ATM/ANS.AR.C.015 Oversight programme

Regulation (EU) 2017/373

(a)     The competent authority shall establish and update annually an oversight programme taking into account the specific nature of the service providers, the complexity of their activities, the results of past certification and/or oversight activities and shall be based on the assessment of associated risks. It shall include audits, which shall:

(1)     cover all the areas of potential safety concern, with a focus on those areas where problems have been identified;

(2)     cover all the service providers under the supervision of the competent authority;

(3)     cover the means implemented by the service provider to ensure the competency of personnel;

(4)     ensure that audits are conducted in a manner commensurate with the level of the risk posed by the service provider operations and services provided; and

(5)     ensure that for service providers under its supervision, an oversight planning cycle not exceeding 24 months is applied.

The oversight planning cycle may be reduced if there is evidence that the safety performance of the service provider has decreased.

For a service provider certified by the competent authority, the oversight planning cycle may be extended to a maximum of 36 months if the competent authority has established that, during the previous 24 months:

(i)      the service provider has demonstrated an effective identification of aviation safety hazards and management of associated risks;

(ii)     the service provider has continuously demonstrated compliance with the change management requirements under points ATM/ANS.OR.A.040 and ATM/ANS.OR.A.045;

(iii)     no level 1 findings have been issued;

(iv)     all corrective actions have been implemented within the time period accepted or extended by the competent authority as defined in point ATM/ANS.AR.C.050.

         If, in addition to the above, the service provider has established an effective continuous reporting system to the competent authority on the safety performance and regulatory compliance of the service provider, which has been approved by the competent authority, the oversight planning cycle may be extended to a maximum of 48 months;

(6)     ensure follow-up of the implementation of corrective actions;

(7)     be subject to consultation with the service providers concerned and notification thereafter;

(8)     indicate the envisaged interval of the inspections of the different sites, if any.

(b)     The competent authority may decide to modify the objectives and the scope of pre-planned audits, including documentary reviews and additional audits, wherever that need arises.

(c)      The competent authority shall decide which arrangements, elements, services, functions, physical locations, and activities are to be audited within a specified time frame.

(d)     Audit observations and findings issued in accordance with point ATM/ANS.AR.C.050 shall be documented. The latter shall be supported by evidence, and identified in terms of the applicable requirements and their implementing arrangements against which the audit has been conducted.

(e)     An audit report, including the details of the findings and observations, shall be drawn up and communicated to the service provider concerned.