Are We Auditing Our Contractors or Auditing Their Competent Authorities?

Contracting vs. Subcontracting in Aviation: A Risk-Based Approach to Auditing

During my years working in airline safety and compliance monitoring, I often questioned the way operators audit their contractors.

There is an important difference between contracting and subcontracting in aviation, particularly when it comes to regulatory responsibilities and the oversight of organisations providing services to an airline.

Contracting vs. Subcontracting – Why Does It Matter?

Take ground handling as an example.

Traditionally, ground handling companies have not held the same type of approval from a Competent Authority as Approved Maintenance Organisations (EASA Part-145) or Approved Training Organisations (EASA Part-ORA/Part-FCL).

The operator therefore retains significant responsibility for ensuring that contracted ground handling activities meet the applicable requirements.

On the other hand, an Approved Maintenance Organisation or an Approved Training Organisation holds its own approval, issued and overseen by a competent authority. These organisations are responsible for complying with the regulations applicable to their approvals.

Of course, this does not remove the operator's responsibility for selecting suitable contractors and monitoring the services they provide.

But does this mean that an airline should perform a full EASA Part-145 audit of every maintenance contractor, or a full Part-ORA/Part-FCL audit of every training organisation?

In my opinion, not necessarily.

My Approach to Auditing Contractors

When I worked for airlines, my approach to auditing approved contractors was different from my approach to auditing activities performed under the operator's own responsibility.

For approved contractors, I focused primarily on:

• The contract and the services provided to the airline.

• The airline's specific procedures and requirements, including maintenance documentation and submission of paperwork.

• The storage and control of the airline's materials and components, where applicable.

• The contractor's Safety Management and Compliance Monitoring Systems.

• Previous audit results, occurrence reports, findings and performance trends.

I did not see the benefit of repeating a complete regulatory audit when the organisation was already approved and regularly overseen by its Competent Authority, unless there was a reason to examine specific areas in more detail.

In fact, my competent authority encouraged and supported this risk-based approach.

Why Did I Look at the Safety Management System?

Some might ask why I placed so much importance on the contractor's Safety Management System (SMS) and Compliance Monitoring system.

For me, these systems provide valuable information about how an organisation operates when nobody is watching.

If employees are comfortable submitting voluntary occurrence reports, if findings from internal audits are taken seriously, and if management takes action to correct problems, these are positive signs.

They indicate that the organisation is willing to identify weaknesses and improve its operation.

That does not guarantee compliance with every regulatory requirement. However, it gives me more confidence in the organisation's ability to manage its own compliance and safety responsibilities.

On the other hand, if occurrence reporting is almost non-existent, internal findings remain open for long periods, or employees appear reluctant to raise concerns, my confidence decreases.

That is when I would consider going deeper into the organisation's activities.

This is what risk-based auditing means to me: using the information available to decide where a closer examination is needed.

Are We Duplicating the Work of Competent Authorities?

Over the years, I have seen operators conduct extensive audits of approved organisations, sometimes using checklists covering almost every regulatory requirement.

I have often wondered what additional assurance these audits provide when there are no previous findings, negative trends or other indications of increased risk.

The competent authority already performs oversight of the approved organisation. The contractor also has its own compliance monitoring responsibilities.

So what is the purpose of another complete regulatory audit by every airline customer?

I am not suggesting that operators should simply accept an approval certificate and stop asking questions. Far from it.

Operators need to verify that contractors are suitable, that contractual requirements are met, and that any risks affecting their operation are properly managed.

However, I believe there is a difference between effective contractor oversight and repeating the competent authority's audit programme.

Consider the Contractor's Position

There is another aspect that I think operators sometimes overlook.

Imagine being the compliance manager of an Approved Maintenance Organisation serving 20 or 30 airline customers.

If every customer requests a full Part-145 audit, how much time must the organisation spend preparing for audits, answering questions, presenting the same evidence and responding to similar observations?

How many working hours are spent demonstrating compliance with requirements that have already been assessed by the competent authority and the organisation's own compliance monitoring system?

And what does that mean for the resources available for actual safety and compliance improvements?

Audits are necessary. But they also consume time and manpower.

We should therefore ask whether every audit adds value or whether some simply repeat work that has already been done.

Audit Deeper When the Risk Justifies It

There will always be situations where a more detailed audit is justified.

A contractor with repeated maintenance errors, poor occurrence reporting, ineffective corrective actions or serious compliance monitoring weaknesses deserves closer attention.

Likewise, a new contractor, an unfamiliar maintenance activity or a significant change in the organisation may justify a broader audit.

But where an approved contractor has a good performance history, effective internal oversight and no significant negative trends, I believe a focused audit can provide sufficient assurance without repeating the entire regulatory framework, provided the applicable oversight requirements are met.

This approach also allows compliance monitoring departments to spend more time on contractors and activities where the risks are greater.

A Question for the Aviation Industry

I know that not everyone agrees with this approach.

Some operators prefer extensive regulatory checklists for every contractor audit. Others may feel more comfortable having their own evidence of compliance with each requirement.

But I would genuinely like to understand the reasoning behind this practice.

If a contractor holds a valid approval, demonstrates an effective safety and compliance monitoring system, and has a satisfactory performance history, what is the added value of performing a complete regulatory audit?

Are we auditing because the risks justify it, or because that is simply how we have always done it?

I would be interested to hear how other operators, maintenance organisations, training organisations, auditors and competent authorities approach this subject.