Request a demo
Free — no form, no email required

38 checks before the auditor arrives

A practical audit-readiness list for AOC holders, written from the operating end of the process rather than the regulatory end. Print it, work through it, ignore the parts that do not apply to you.

Most findings are not surprises. They are the same handful of gaps, found again, because the evidence existed but could not be produced in the order and the timeframe the auditor wanted it.

This list is ordered the way an audit tends to run. Nothing here is exotic — the value is in going through it two weeks early rather than discovering it on the day.

Management system and accountability

Part-ORO.GEN.200
The Accountable Manager can state, without preparation, where the management system currently stands.
The single most common opening question. If the answer requires a week of gathering, that itself is the finding.
Nominated persons are current, and each one can describe their own scope of responsibility.
The organisation chart in the manual matches who actually does the work today.
Reorganisations that never reached the manual are found in minutes.
Management review meetings have happened at the stated frequency, with minutes and actions.
Not just held — recorded, with owners and closure dates against each action.
Safety and compliance responsibilities are separated where the size of the organisation requires it.
Changes since the last audit have been notified where notification was required.

Safety management

ICAO Annex 19 · Part-ORO.GEN.200(a)(3)
Every occurrence in the reporting period has a recorded classification and an owner.
Occurrences that were closed show evidence of the investigation, not just a closure date.
A closure with no investigation record is the single most reliable finding an auditor can write.
Mandatory occurrence reports were filed within the required timescale, and you can show when.
The risk register reflects live occurrences rather than a document last touched a year ago.
Risk assessments use the matrix that is actually in your manual, at the version in force.
Safety performance indicators have targets, and someone has looked at them recently.
Confidential reporting exists, staff know it exists, and at least one person has used it.
A confidential channel with zero reports in two years reads as a channel nobody trusts.
Safety actions arising from occurrences are tracked to closure with verification.

Compliance monitoring

Part-ORO.GEN.200(a)(6)
The audit programme for the period was completed, or the deviations are documented and justified.
Every finding has a root cause recorded — not a restatement of the finding.
"Crew did not follow procedure" is a description, not a root cause. Auditors know the difference.
Corrective actions have a verification step that happened before the finding was closed.
Verification as a hard gate, not a checkbox. This is where most systems quietly fail.
Overdue corrective actions have a documented reason and a revised date.
Findings are linked to the specific procedure or requirement they concern.
Repeat findings across periods have been recognised as repeat findings and escalated.
Subcontracted activities are inside the compliance monitoring programme.
Ground handling and CAMO are the usual gaps.

Document control

Part-ORO.MLR.100
The manual version in the crew's hands is the version currently approved.
Revision history shows what changed, when, who approved it and on what authority.
Distribution is recorded, and read confirmation exists for revisions that required it.
"We emailed it" is not distribution control.
Superseded versions are withdrawn or clearly marked, in every location they exist.
Including the printed copy in the ops room and the PDF on someone's tablet.
Manual content matches what the operation actually does.
The classic failure: a procedure written for an aircraft type you no longer operate.
Forms referenced in the manual exist, at the referenced revision.

Training and currency

Part-ORO.FC · Part-ORO.CC
Every crew member's currency can be evidenced for the whole period under audit, not just today.
Expiries are flagged before they expire, by a system rather than by a person remembering.
Training records show the content delivered, not only that attendance occurred.
Instructor and examiner qualifications are current and recorded.
Recurrent training intervals were met, with any extensions documented against the applicable rule.
Records for crew who have left are retained for the required period.

The week before

Someone has walked the audit as the auditor will: pick three occurrences at random and follow each end to end.
If you cannot produce report, classification, investigation, action and verification for all three in ten minutes, neither can they — and that is the finding.
The evidence pack can be produced as a export, not assembled by hand.
Everyone who will be interviewed knows they will be interviewed, and on what.
Open findings from the previous audit are closed, or have a defensible reason why not.
An open finding from the last audit is the fastest route to a worse outcome in this one.
The person who will sit with the auditor has access to every system they will be asked about.

This is a practical aide, not regulatory advice. Your competent authority's requirements and your own approved procedures take precedence over anything here. If a check does not map onto your organisation, it does not apply to you.

If the list was useful

Most of this stops being manual work

Palladium was built to make the evidence pack a download rather than a fortnight. Bring your worst finding and we will show you how it maps.

Request a demo See the screens first

We read every enquiry personally and reply within one business day. If we are not a fit, we will tell you.