GM1 Article 18(h) Tasks of the competent authority
ED Decision 2019/021/R
GUIDELINES FOR RISK-BASED OVERSIGHT (RBO)
NOTE: The guidelines below are based on the document ‘Practices for risk-based oversight’, which may be found at the address below, and where further information may also be found:
https://www.easa.europa.eu/document-library/general-publications/practices-risk-based-oversight
That document:
— highlights the relationship between RBO and the (safety) management system, the management of change, the overall performance of the organisation and the oversight cycle;
— describes the interconnection, availability and exchange of data, which will significantly change the relationship between the authority and their regulated entities, as well as their ongoing management of safety;
— does not constitute regulatory material nor means of compliance nor guidance material. It reflects the RBO state of play to date, in an effort to gain a common understanding and to look ahead; and
— can be used as guidelines for competent authorities who have to implement RBO.
(a) General Definitions:
(1) Oversight: the function by means of which a competent authority ensures that the applicable requirements are met by regulated entities.
(2) Risk profile: the element of risks that are inherent to the nature and operations of the regulated entity, this includes the:
— specific nature of the organisation;
— complexity of its activities; and
— risks stemming from the activities carried out.
(3) Safety performance: the demonstration of how effectively a regulated entity can mitigate its risks, substantiated through the proven ability to:
— comply with the applicable requirements;
— implement and maintain effective safety management;
— identify and manage safety risks; and
— achieve and maintain safe operations.
The results of past certification or oversight also need to be taken into account.
(4) RBO: a way of performing oversight, in which:
— planning is driven by the combination of the risk profile and safety performance; and
— execution focuses on the management of risk, besides ensuring compliance.
(b) The RBO scheme is summed-up by the drawing below:
(1) the risk profile and oversight are described in paragraph 3 of the ‘Practices for risk-based oversight’;
(2) the management of safety information and information sharing with other authorities are described in paragraph 4 of ‘Practices for risk-based oversight’;
(3) the training and qualification of inspectors are described in paragraph 4.3 of ‘Practices for risk-based oversight’;
(4) conducting risk-based audits is described in paragraph 5 of ‘Practices for risk-based oversight’.