Preparing for an EASA audit is not simply about gathering documents a few days before the auditor arrives.
An EASA audit is designed to verify that what your organisation says it does in its exposition, procedures and management systems corresponds to what is actually done in day-to-day operations.
The auditor will therefore compare:
The best way to successfully prepare for an EASA audit is therefore simple in theory: identify your own gaps before the auditor identifies them for you.
In this article, we look at the main stages of an EASA audit, the areas commonly examined by auditors and the best practices for preparing your organisation.
An EASA audit is a structured comparison between:
what your organisation says it does
and
what it actually does.
The first element can be found in documents such as:
The second is verified in practice: in a hangar, stores area, compliance office, planning department, training centre, aerodrome or through the IT systems used by the organisation.
The auditor’s objective is to identify any gaps between the two.
An audit therefore relies primarily on evidence.
To raise a non-compliance finding, the auditor must be able to link what has been observed to a regulatory requirement or to a requirement contained in your own approved documentation.
This also means that an audit is primarily concerned with the organisation’s systems, rather than individual mistakes.
If a work card has not been signed, the question is not simply why one person forgot to sign it.
The organisation should also understand how its system allowed an unsigned work card to remain undetected.
Not all audits are conducted in the same way.
A desktop audit is carried out using documents provided to the competent authority.
It may include:
In this case, the quality and organisation of the documentation submitted become particularly important.
During an on-site audit, the inspector physically visits the organisation’s facilities.
Depending on the audit scope, the inspector may examine:
An audit may also be conducted remotely.
Documents are shared electronically and certain visits or demonstrations may be performed using video.
The organisation must therefore be able to retrieve and present requested information quickly.
One of the most common mistakes is starting the preparation too late.
An effective approach can be organised around a 90 / 30 / 7 / 1-day audit preparation schedule.
Around three months before the audit, the objective is to identify any structural issues.
It is important to understand which areas are likely to be examined.
For routine oversight, the inspector may select several areas for sampling.
For an audit associated with a change, the focus will generally be on the change itself and the processes directly affected by it.
Your own compliance monitoring function should review the relevant scope before the external auditor arrives.
This should include, where applicable:
An effective internal audit programme is one of the best ways to detect compliance drift before an external EASA audit.
Your MOE, CAME, MTOE or other applicable organisation exposition must accurately reflect current practices.
This is essential.
A procedure may have worked perfectly when it was originally written but gradually become disconnected from operational reality.
The organisation then effectively develops two systems:
An EASA audit is specifically designed to identify this type of gap.
Findings from the previous oversight cycle should also be reviewed.
It is not enough for a corrective action to have been declared complete.
You should verify that the action continues to work effectively.
Around one month before the audit, preparation should gradually move from documentation to operational reality.
The Accountable Manager may be asked about:
The objective is not to recite the manual.
The Accountable Manager should be able to explain how the organisation operates in their own words.
Each responsible manager should also be able to explain:
Walk through your facilities as an auditor would.
Depending on your activity, review areas such as:
The objective is to look at your own organisation with an external perspective.
One week before the audit, structural problems should already have been identified.
The focus should now be on ensuring that the organisation is ready.
Check that:
You can also organise mock interviews.
The objective is not to teach people scripted answers, but to make sure they understand their responsibilities and can clearly explain their practices.
Competence management is an important area during EASA audits.
Training someone does not automatically demonstrate that they are competent.
The organisation must be able to demonstrate that personnel are capable of safely and correctly performing the tasks assigned to them.
Depending on the role, a competence record may include:
An auditor may, for example, ask:
Show me the competence record for this person.
But the auditor may go further:
How does the supervisor know today that this person is competent and authorised to perform this task?
A competence matrix is only useful if it is kept up to date and actually used in day-to-day operations.
Although each audit has its own scope, the audit process generally follows a relatively predictable structure.
The opening meeting is used to confirm:
It establishes the framework for the audit.
The inspector may review the organisation’s documents, data, procedures, facilities and operational practices.
Personnel may also be asked to explain how they perform their tasks.
The simplest rule is often the best:
If you know, answer. If you do not know, say so and find the information.
Do not guess.
The auditor is looking for evidence, not an improvised answer.
The closing meeting is used to present the audit conclusions and any findings that may have been raised.
For each finding, it is important to understand:
This is also the appropriate time to clarify any factual misunderstanding.
EASA requirements generally distinguish between two levels of findings.
A Level 1 finding is a significant non-compliance that lowers safety or seriously hazards flight safety.
The competent authority may therefore take immediate and appropriate action, which may affect the organisation’s privileges.
The organisation’s response must be immediate.
A Level 2 finding is a non-compliance that could lower safety or possibly hazard flight safety.
A period is provided for the organisation to implement appropriate corrective actions.
The finding must therefore be monitored carefully.
Failure to address a finding within the agreed timeframe can lead to much more serious consequences.
A properly written finding can generally be broken down into three elements:
Requirement → Evidence → Gap
Which requirement has not been complied with?
This may be:
What did the auditor actually observe?
For example:
How does the evidence fail to meet the requirement?
Before starting corrective action, make sure that these three elements are clearly understood.
The wrong approach is simply to correct what the auditor saw.
The right approach is to understand why the system allowed the gap to occur in the first place.
A corrective action plan may include:
Root Cause Analysis (RCA) is intended to go beyond the immediate symptom.
Take a simple example:
A person did not follow a procedure.
Immediately concluding that this was “human error” does not necessarily prevent the problem from happening again.
You need to investigate further:
Methods such as the 5 Whys or an Ishikawa diagram can help structure the analysis.
The objective is to correct the system rather than simply the symptom.
This point is often underestimated.
A finding is not necessarily closed simply because an action has been completed.
For example:
We updated the procedure.
or:
We provided additional training.
These actions demonstrate that something has been done.
They do not yet demonstrate that the action is effective.
Proper closure therefore involves confirming that:
Effectiveness may, for example, be verified through a follow-up audit or by sampling a defined number of cases after implementation.
There is another risk: preparing your organisation perfectly against requirements that have changed in the meantime.
The EASA regulatory framework evolves regularly.
A regulatory change may affect:
These changes may then require:
If a regulatory change is not identified or assessed early enough, the resulting gap may only be discovered during an audit.
Regulatory monitoring is therefore an integral part of continuous EASA audit readiness.
ComplyAir supports organisations upstream of the audit by making it easier to monitor the regulatory changes applicable to their activities.
The platform can help you:
During an audit, the question is therefore no longer simply:
Did we see this regulatory change?
but rather:
How was this change assessed, and what decision did we make?
This traceability makes it easier to demonstrate how your regulatory monitoring process operates in practice.
The objective is not to start preparing for an audit when it is announced, but to keep the organisation audit-ready throughout the year.
To prepare effectively for an EASA audit:
An organisation that is genuinely prepared for an EASA audit is not one that becomes compliant a few days before the inspector arrives.
It is an organisation whose compliance system is capable, throughout the year, of detecting its own drift before an external auditor does.
