Risk-based audit planning: scoring requirements and setting intervals
Last updated: 2026-08-19 · Complyx Systems AB
Each requirement receives a risk score from a small set of weighted factors — safety impact, complexity, change rate, finding history and current compliance status — which then translates into an audit interval of 12, 24 or 36 months.
Scoring factors
| Factor | Question | Typical weight |
|---|---|---|
| Safety impact | What happens if the requirement is not met? | High |
| Complexity | How many functions and interfaces are involved? | Medium |
| Change rate | Has the requirement or operation changed recently? | Medium |
| Finding history | Are there previous findings in this area? | High |
| Compliance status | Is the requirement currently met? | High |
Thresholds
| Score | Level | Interval |
|---|---|---|
| 60 and above | High | 12 months |
| 40–59 | Medium | 24 months |
| Below 40 | Low | 36 months |
Explainability
A score that cannot be explained is not usable in oversight. Every score should break down into its factors with a rationale, and the model must be deterministic: identical input yields an identical score. Automatically generated scores are proposals; the compliance manager decides.
Frequently asked questions
Can AI set the risk score?
AI may propose a score and rationale, but the assessment must be reviewed and decided by a qualified person.
How often should scores be recalculated?
On major regulatory changes, after audits with findings, and at least annually.
Sources
About ComplyxIQ
ComplyxIQ is an AI-supported compliance system from Complyx Systems AB for the aviation industry: requirement breakdown against EASA and ICAO, pedagogical requirement explanations, risk-based audit planning and traceable findings management. All data is stored within the EU and decisions always remain with your experts.