The annual compliance monitoring audit plan, step by step

What the rules ask for

ORO.GEN.200(a)(6) asks every operator for "a function to monitor compliance of the operator with the relevant requirements", including "a feedback system of findings to the accountable manager". ORA.GEN.200(a)(6) asks the same of an ATO. The detail sits in AMC1 ORO.GEN.200(a)(6): your documentation includes a compliance monitoring programme that reflects

• a schedule of the monitoring programme;
• audit procedures, "including an audit plan that is implemented, maintained, and continually reviewed and improved";
• reporting procedures;
• follow-up and corrective action procedures; and
• a recording system AMC1 ORO.GEN.200(a)(6)(d)(2)(vi).

Two things the rules do not give you: a fixed audit interval and a fixed list of audit areas. The programme is "structured according to the size of the operator and the complexity of the activities to be monitored" AMC1 ORO.GEN.200(a)(6)(a)(2). The example checklist for non-complex operators in GM3 is headed "Year:", so a 12-month cycle is the natural starting point. Part-CAMO is the exception with a fixed annual check, covered in the compliance monitoring toolkit.

Build the plan in eight steps

1. List what the programme must cover

AMC1 ORO.GEN.200(a)(6)(b) sets the minimum, "where appropriate":

• the privileges of the operator;
• manuals, logs and records;
• training standards;
• management system procedures and manuals (from 1 January 2028 this includes the flight data monitoring procedures, where such a programme is required);
• the activities carried out under the supervision of the nominated persons ORO.GEN.210(b);
• any outsourced activities, "for compliance with the contract" ORO.GEN.205.

Complex operators get a longer subject list in GM2 ORO.GEN.200(a)(6): actual flight operations, ground de-icing, load control, flight and duty time limitations, use of the MEL, dangerous goods, security and more. It is a useful menu for a small operator too.

2. Turn the scope into audit areas

Group the scope into six to ten areas, each small enough to audit in a day. For a small AOC that could be: flight operations; crew licensing, training and checking; flight and duty time; ground handling, fuel and dangerous goods; mass and balance; the maintenance interface; the management system (safety risk management, occurrence reporting, management of change); manuals, records and document control; contracted activities. Add information security if Part-IS applies to you (see the Part-IS starter kit).

3. Decide how often each area is checked

Every area at least once in the cycle. Then look at risk: an area with open or repeat findings, a recent change such as a new aircraft type, a new base or a new nominated person, or a busy season deserves an earlier or a second look. The rules leave the frequency to you, so write down why you chose it. That short reasoning is what you show an inspector who asks how the programme was built.

4. Pick an auditor for each area and check independence

Audits and inspections are "carried out by personnel not responsible for the function, procedure or products being audited" AMC1 ORO.GEN.200(a)(6)(c)(6). In a small team that takes planning:

• The compliance monitoring manager may do all audits personally or appoint auditors with the related competence, from inside or outside the operator GM1 ORO.GEN.200(a)(6)(a).
• External auditors work under the responsibility of the compliance monitoring manager, and the operator "retains the ultimate responsibility" for the effectiveness of the function and the follow-up of all corrective actions GM1 ORO.GEN.200(a)(6)(c), (d).
• In a non-complex operator the accountable manager may act as compliance monitoring manager after showing the related competence AMC1 ORO.GEN.200(a)(6)(c)(4).
• One person may be both compliance monitoring manager and safety manager, if the accountable manager makes sure both functions have enough resources AMC1 ORO.GEN.200(a)(6)(c)(5).

The gap to watch is the areas the compliance monitoring manager runs personally. Somebody else has to audit those: a trained colleague from another area, or an external auditor once a year.

5. Spread the audits over the year

Put one or two areas in each month rather than all of them in the quiet season. Keep the busy months light, leave room to repeat an audit that raised findings, and plan the look at the compliance monitoring function itself near the end of the cycle. When an audit moves, record the new month and the reason. The plan is meant to be "continually reviewed and improved", so a moved audit with a reason is normal. An audit that quietly disappears is the problem.

6. Prepare a checklist and a sample for each audit

For non-complex operators GM3 ORO.GEN.200(a)(6) gives a ready layout: audits "may be documented on a 'Compliance Monitoring Checklist', and any findings recorded in a 'Non-compliance Report'". Its example items sample real records, for instance "Minimum five flight plans checked and verified for proper and correct information". Write down what you sampled, so the next auditor can pick different records.

7. Report every audit to the accountable manager

The rule asks for "a feedback system of findings to the accountable manager to ensure effective implementation of corrective actions as necessary" ORO.GEN.200(a)(6). A one-page report per audit is enough: scope, what was sampled, findings with their numbers, and observations. Each finding then gets a root cause, a corrective action plan and a due date. How to do that well is in How to close a finding.

8. Review the plan and carry it into next year

At the end of the cycle compare planned against done, list the audits that moved and why, and let the year's findings set next year's frequencies. Training is part of the same programme: those managing compliance monitoring should be trained on "the requirements of compliance monitoring, manuals and procedures related to the task, audit techniques, reporting and recording" AMC1 ORO.GEN.200(a)(6)(e)(2).

A sample year for a small AOC

An example only, for a non-complex operator with one base. Change the areas and months to fit your operation, your season and last year's findings, and pick an auditor for each row who does not run that area.

The free annual audit plan template has these columns ready: area, scope and reference, auditor, an independence check, last audited, and a 12-month grid for planned, done and moved. Excel or Word, no sign-in.

ATOs and the organisational review

An ATO follows the same structure under ORA.GEN.200(a)(6). One shortcut exists: an ATO training only for the LAPL, PPL, SPL or BPL and the associated ratings or certificates may cover safety risk management and compliance monitoring by "an organisational review, to be performed at least once every calendar year", and tells the authority the results "without undue delay" ORA.GEN.200(c).

• The review programme may be checklists plus a schedule "with each item being checked at least once within any 12-month period". One full review a year or several partial ones are both allowed GM1 ORA.GEN.200(c).
• Results, with all findings and new risks, go to the accountable manager and the nominated persons before the authority is notified. Level 1 findings are notified immediately AMC1 ORA.GEN.200(c).
• Evidence can come from training records, internal safety reports, the risk register, sample checks of courses, witnessed examinations, interviews and student feedback GM1 ORA.GEN.200(c).

A DTO has no compliance monitoring function. It runs an annual internal review and an annual activity report instead DTO.GEN.270. The DTO template is in the toolkit.

What the inspector looks at

The authority's own guidance for its audits: "Part of an audit should concentrate on the organisation's compliance monitoring reports produced by the compliance monitoring personnel to determine if the organisation is identifying and correcting its problems" AMC1 ARO.GEN.305(b)(1). A plan that was followed, with audit reports and findings closed on time, is that evidence.

It also pays off. The authority's oversight planning cycle for a certified organisation is up to 24 months. It may be extended to 36 months when, over the previous 24 months, the organisation has shown effective hazard identification and risk management, has shown under ORO.GEN.130 that it has full control over all changes, has had no level 1 findings, and has implemented all corrective actions within the accepted or extended time ARO.GEN.305(c).

Sources: EASA Easy Access Rules for Air Operations (March 2026): ORO.GEN.200, AMC1, GM1 to GM3 ORO.GEN.200(a)(6), ARO.GEN.305 and AMC1 ARO.GEN.305(b)(1). EASA Easy Access Rules for Aircrew (October 2026): ORA.GEN.200(c), AMC1 and GM1 ORA.GEN.200(c), DTO.GEN.270. Rule text checked 31 October 2026; where this guide and the Official Journal differ, the Official Journal text prevails.