What the rules ask for
For an air operator, ORO.GEN.150 is short: "After receipt of notification of findings, the operator shall: (a) identify the root cause of the non-compliance; (b) define a corrective action plan; and (c) demonstrate corrective action implementation to the satisfaction of the competent authority within a period agreed with that authority as defined in ARO.GEN.350(d)." An ATO has the same three duties in ORA.GEN.150, tied to ARA.GEN.350(d).
A DTO works differently. Its findings have no level. The authority sets "a reasonable period of time" ARA.GEN.350(da)(1), and within it the DTO identifies the root cause, takes the corrective action needed to end the non-compliance and, where relevant, remedy its consequences, and informs the authority of what it did DTO.GEN.150.
Correction, corrective action, root cause
Most weak answers to a finding mix up these words. EASA defines them in GM1 ORO.GEN.150:
| Term | What GM1 ORO.GEN.150 says |
|---|---|
| Correction | "the action to eliminate a detected non-compliance". It fixes this case. |
| Corrective action | "the action to eliminate or mitigate the root cause(s) and prevent recurrence of an existing detected non-compliance or other undesirable condition or situation". It stops the next case. |
| Preventive action | "the action to eliminate the cause of a potential non-compliance or other undesirable potential situation". It deals with a problem that has not happened yet. |
The same GM adds: "Proper determination of the root cause is crucial for defining effective corrective actions to prevent reoccurrence." And the AMC sets the bar for the plan: it "should address the effects of the non-compliance, as well as its root cause" AMC1 ORO.GEN.150(b). A plan that only fixes the case in front of you meets neither.
Level 1, level 2 and the 3-month clock
| Level | When it is issued | What happens |
|---|---|---|
| Level 1 | A significant non-compliance "which lowers safety or seriously hazards flight safety". It always includes: no access for the authority after two written requests, falsified documents to obtain or keep a certificate, malpractice or fraudulent use of the certificate, and the lack of an accountable manager ARO.GEN.350(b). | Immediate action to prohibit or limit activities, up to limiting, suspending or revoking the certificate, until successful corrective action (d)(1). |
| Level 2 | Any non-compliance "which could lower safety or hazard flight safety" ARO.GEN.350(c). | A corrective action period that "initially shall not be more than three months", which the authority may extend "subject to a satisfactory corrective action plan agreed by the competent authority" (d)(2)(i). |
- When the clock starts. "The 3-month period should commence from the date of the communication of the finding to the organisation in writing" GM2 ARO.GEN.350(d). Note that date when the report arrives, not when you first discuss it.
- The authority accepts your plan. It assesses the corrective action and implementation plan you propose and accepts them if they are sufficient (d)(2)(ii).
- Late means level 1. If you fail to submit an acceptable plan, or to perform the corrective action within the period accepted or extended, "the finding shall be raised to a level 1 finding" (d)(3).
- ATOs have the same levels and the same 3-month period in ARA.GEN.350. The authority records every finding, corrective action and date of closure ARO.GEN.350(d)(4), so your dates will be compared with theirs.
From finding to closure in eight steps
- Log it the day it arrives. Reference, requirement, level, the date of the written notice, and the due date it gives you.
- Correct the case. Fix what was found, and say what you checked to make sure there are no other cases like it. That is the correction, not the answer.
- Find the root cause. Ask why the procedure, training, staffing or oversight let this happen, until you reach something your organisation controls. Look in your register: if the same requirement was found before, the earlier corrective action did not work, and the root cause is probably elsewhere. Methods and a worked example: root cause analysis.
- Write the corrective action plan. One or more actions aimed at that root cause, each with an owner and a date, plus anything needed to deal with the effects AMC1 ORO.GEN.150(b).
- Send it in time. The authority has to accept the plan ARO.GEN.350(d)(2)(ii). Use the format your authority asks for: some want correction, root cause and corrective action as three answers, Norway's form has an action table where each line is a correction or a corrective action.
- Implement and keep the evidence. Evidence is anything that shows the action was done: the revised manual page with its revision number and date, the training record, the completed audit item, the signed list. Keep it with the finding, not in someone's inbox.
- Ask for more time before the date, not after. If an action cannot be done in time, ask for an extension with the reason and an updated plan. The rule only allows an extension "subject to a satisfactory corrective action plan agreed by the competent authority".
- Demonstrate, then check it worked. The authority decides when its finding is closed: you demonstrate implementation "to the satisfaction of the competent authority" ORO.GEN.150(c). A few months later, check that the problem has not come back. The management system already asks you to verify the effectiveness of risk mitigation ORO.GEN.200(a)(3).
A worked example
Illustrative only. Your requirement references and wording will differ.
| Part of the answer | Example |
|---|---|
| Finding (level 2) | Two crew members were flying with an operations manual one revision behind the current one. |
| Correction | Both copies updated the same day; every other holder's copy checked against the current revision, none behind. |
| Root cause | The procedure sends each revision by e-mail but has no step to confirm it was received and read, and nobody checks the list. |
| Corrective action | Add a read-and-confirm step with a holder list to the procedure; the compliance monitoring manager checks the list two weeks after every revision; brief the office staff. |
| Evidence | The revised procedure page with its revision number and date, the completed holder list for the next revision, the briefing record. |
| Effectiveness check | At the next compliance audit, sample three holders' copies. |
Findings from your own audits
Your compliance monitoring programme needs "follow-up and corrective action procedures" AMC1 ORO.GEN.200(a)(6), and "the operator retains the ultimate responsibility ... for the effective implementation and follow-up of all corrective actions" GM1 ORO.GEN.200(a)(6). The GM3 "Non-compliance Report" for non-complex operators shows the fields an inspector expects: level of finding, root cause, suggested correction, corrective action required or not, responsible person, time limitation, corrective action, and two closing boxes, "Correction and corrective action verified" and "Report Closed", signed by the compliance monitoring manager.
No rule sets a deadline for internal findings. You set the time limitation yourself, in your procedure and on each report. What the inspector checks is whether it works: an audit should concentrate partly on your compliance monitoring reports "to determine if the organisation is identifying and correcting its problems" AMC1 ARO.GEN.305(b)(1). Your audit plan decides which areas get looked at; see how to build the annual audit plan.
Why closing on time pays
The authority audits a certified organisation on a cycle of up to 24 months. It may extend the cycle to 36 months if, over the previous 24 months, the organisation has shown effective hazard identification and risk management, has "full control over all changes", has had no level 1 findings, and has implemented "all corrective actions ... within the time period accepted or extended by the competent authority". With an approved continuous reporting system on top, up to 48 months ARO.GEN.305(c), ARA.GEN.305(c). Late corrective actions do not just risk a level 1: they keep the inspector coming back sooner. The change part is covered in management of change at a small operator.
Sources: EASA Easy Access Rules for Air Operations (March 2026: ORO.GEN.150, AMC1 and GM1, ORO.GEN.200, ARO.GEN.305, ARO.GEN.350 and GM2), Easy Access Rules for Aircrew (October 2026: ORA.GEN.150, ARA.GEN.305, ARA.GEN.350, DTO.GEN.150). Rule text checked 31 October 2026; where this guide and the Official Journal differ, the Official Journal text prevails.
Questions we hear
How long do I have to close a level 2 finding?
A period set by the authority that "initially shall not be more than three months", counted from the written communication of the finding ARO.GEN.350(d)(2), GM2. It can be extended with a corrective action plan the authority agrees.
What happens if we miss it?
A finding whose plan is not acceptable, or whose corrective action is not done in the accepted or extended period, "shall be raised to a level 1 finding" ARO.GEN.350(d)(3), with immediate action to limit or prohibit activities.
Do internal findings have a fixed deadline?
No rule sets one. You set it in your follow-up procedure and on each non-compliance report. Many small operators reuse the level 2 period of up to three months; that is a choice, not a rule.
Is "retrain the person" a corrective action?
Only if the root cause really was a training gap. If the procedure let the error through, training one person fixes the case, not the cause. GM1 ORO.GEN.150 asks corrective action to eliminate or mitigate the root cause and prevent recurrence.