Building an internal audit programme for an aerodrome
Last updated: 2026-08-19 · Complyx Systems AB
The programme must cover all applicable requirements within a defined cycle, apply risk-based frequency, be carried out independently of the audited area, and manage findings with root cause analysis and verified closure.
Start from the requirements, not the org chart
Every applicable requirement in Regulation (EU) No 139/2014, Part-IS and national rules should map to at least one planned audit within the cycle. Only then group requirements into audit areas that match how the operation is organised.
Risk-based intervals
The overall audit cycle may not exceed 36 months; every applicable requirement must be audited at least once within that period. Risk-based planning shortens the interval for selected requirements, with 36 months as the ceiling.
| Risk level | Typical interval | Example |
|---|---|---|
| High | 12 months | Direct safety impact or history of findings |
| Medium | 24 months | Indirect impact, stable compliance |
| Low | 36 months | Administrative requirements, low change rate |
Findings and follow-up
- Classify findings consistently
- Require root cause analysis before deciding corrective action
- Assign an owner and due date to every action
- Close the audit only when all findings are verified as resolved
- Reschedule the next occurrence when the audit is closed
Frequently asked questions
How long may the audit cycle be?
36 months at most. All applicable requirements must be covered within that period, and risk-based audits are scheduled more frequently — typically 12 or 24 months for higher-risk requirements.
Can the same person be auditor and auditee?
Not for the same area — independence is a prerequisite.
Sources
About ComplyxIQ
ComplyxIQ is an AI-supported compliance system from Complyx Systems AB for the aviation industry: requirement breakdown against EASA and ICAO, pedagogical requirement explanations, risk-based audit planning and traceable findings management. All data is stored within the EU and decisions always remain with your experts.