RISK-BASED IOSA · BY ASG
Risk-Based IOSA (RBI) is the evolution of the traditional IATA Operational Safety Audit, introduced under IOSA Standards Manual Edition 18. Rather than auditing all ISARPs in every cycle, RBI focuses audit scope on areas of elevated safety risk — rewarding airlines with mature, high-performing Safety Management Systems with a more targeted assessment. Understanding RBI is essential for any airline approaching IOSA renewal from 2024 onwards.
What Is Risk-Based IOSA?
Risk-Based IOSA (RBI) is a revised audit methodology introduced by IATA in the IOSA Standards Manual (ISM) Edition 18. Unlike the traditional IOSA model — which audited all applicable ISARPs in each of the eight operational disciplines every two-year cycle — RBI uses an airline’s safety performance data, SMS maturity, and historical audit record to determine which ISARPs will be assessed in a given audit cycle.
Under RBI, airlines with a strong safety performance history, a mature SMS, and a consistent record of low non-conformity rates are eligible for a reduced audit scope. High-risk areas or disciplines with previously identified weaknesses receive intensified audit attention. This approach makes the IOSA programme more risk-intelligent and proportionate — focusing auditor time where safety benefit is greatest.
How Does RBI Differ from Classic IOSA?
In Classic IOSA, auditors assess all applicable ISARPs across all eight disciplines on every renewal cycle. The assessment scope is fixed regardless of the airline’s safety performance or SMS maturity level. Classic IOSA provides a comprehensive compliance snapshot but does not differentiate between airlines based on their demonstrated safety performance.
Risk-Based IOSA introduces three key changes: First, airlines are profiled based on their SMS maturity and safety performance data prior to the audit. Second, the audit scope is adjusted based on this profile — airlines with strong profiles receive a focused audit in elevated-risk areas, while areas of demonstrated strength may receive reduced scrutiny. Third, the interval between full-scope audits can be extended for airlines that consistently demonstrate high safety performance, provided their SMS maturity supports this.
The transition from Classic to Risk-Based IOSA requires an airline to demonstrate genuine SMS functionality — not just documented procedures, but evidence of active hazard identification, risk assessment, safety performance monitoring, management review, and continuous improvement. Airlines that have invested in building robust SMS capability are best positioned to benefit from the RBI model. Those with SMS documentation that does not reflect operational reality face a more challenging audit under Edition 18.
IOSA Standards Manual (ISM) Edition 18 (IATA, 2024) governs the Risk-Based IOSA programme. Appendix 1 of the ISM defines the SMS maturity assessment criteria used to determine RBI eligibility. Airlines should also reference ICAO Doc 9859 SMM 4th Edition for SMS implementation guidance aligned to RBI requirements.
RBI Eligibility and SMS Maturity Requirements
SMS Maturity Assessment: To qualify for RBI, an airline must demonstrate SMS maturity at or above a defined threshold across the four SMS components: Safety Policy, Safety Risk Management, Safety Assurance, and Safety Promotion. IATA’s SMS maturity model uses a five-level scale, and RBI eligibility typically requires performance at Level 3 or above — meaning the SMS is operationally implemented and generating performance data, not merely documented.
Maturity is assessed against specific criteria: the quality and completeness of the hazard register, the frequency and rigour of risk assessments, the use of safety performance data in management decisions, the effectiveness of safety investigation processes, and the visibility of safety culture from senior management downward. ASG’s SMS consulting services help airlines assess and improve their maturity level in preparation for RBI eligibility assessment.
Safety Performance Data Requirements: RBI requires an airline to maintain and present quantitative safety performance data — Safety Performance Indicators (SPIs) tracked against Safety Performance Targets (SPTs). This data must demonstrate trends over time and must show evidence of management review and corrective action when performance targets are not met. Airlines that have not established a formal SPI/SPT framework will not qualify for RBI regardless of their operational compliance level.
Audit History Profile: An airline’s historical IOSA audit record contributes to RBI eligibility. Airlines with a consistently low non-conformity rate across previous audits demonstrate compliance stability — a key indicator that reduced-scope auditing is appropriate. Airlines with significant findings in previous cycles, or those undergoing their first IOSA, are not eligible for RBI and will undergo Classic IOSA.
ASG Support for Risk-Based IOSA Preparation
Why Choose Aero Support Group for RBI Preparation?
Aero Support Group has supported airlines through the transition from Classic IOSA to Risk-Based IOSA since Edition 18’s introduction. Our consultants include former IATA lead auditors with direct knowledge of the SMS maturity assessment process and the practical evidence requirements for RBI eligibility.
We work with your safety, quality, and operations teams to build the SMS maturity evidence base, establish the SPI/SPT framework, and prepare the documentation package required for RBI eligibility assessment. Our preparation ensures your airline approaches the RBI eligibility review — and the subsequent audit — with confidence.
No. RBI eligibility must be assessed and confirmed by IATA before an airline can undergo a Risk-Based audit. Eligibility depends on SMS maturity level, safety performance data, and audit history. Airlines that do not meet the eligibility criteria undergo Classic IOSA. ASG can conduct an RBI eligibility pre-assessment to determine your airline’s current readiness and identify the specific areas requiring improvement before applying for RBI status.
Airlines on the RBI programme are subject to ongoing eligibility monitoring. If safety performance deteriorates — for example, if SPI targets are consistently missed, or significant audit findings are identified — an airline may be reverted to Classic IOSA. The RBI model is designed to incentivise continuous safety improvement, not to permanently reduce audit burden for eligible airlines regardless of performance changes.
All airlines undergoing IOSA from 2024 onwards are assessed under ISM Edition 18. For Classic IOSA, the changes primarily affect the SMS-related ISARPs — which have been updated to reflect the risk-based approach and ICAO Annex 19 requirements. Airlines should review their existing SMS documentation and practices against Edition 18’s revised SMS requirements, even if they are not pursuing RBI eligibility, to avoid non-conformities in the SMS discipline.
IATA’s SMS maturity model uses a five-level scale: Level 1 (Initial), Level 2 (Managed), Level 3 (Proactive), Level 4 (Predictive), and Level 5 (Optimising). RBI eligibility generally requires SMS maturity at Level 3 or above — meaning the SMS is fully implemented, generating operational safety data, and management is actively using safety performance information in decision-making. Airlines at Level 2 or below are not yet eligible for RBI.
ASG uses IATA’s SMS maturity framework, supplemented by our own assessment tools developed from audit experience, to evaluate an airline’s SMS across all four components. The assessment examines documentary evidence, operational practices, safety data quality, management engagement, and safety culture indicators. The result is a maturity profile with specific improvement recommendations and a realistic timeline for achieving RBI eligibility — typically 6–18 months depending on starting position.
- Reduced audit scope for high-performing airlines
- Incentivises genuine SMS maturity and investment
- Risk-proportionate approach to regulatory oversight
- Potential for extended audit intervals with strong performance
- Signals safety leadership to partners and regulators
- Aligns audit focus to highest-risk operational areas
Prepare for Risk-Based IOSA with ASG
Whether you are assessing your RBI eligibility, building the SMS evidence base for Edition 18, or transitioning from Classic IOSA to the risk-based model, Aero Support Group provides the expertise to guide you through the process. Contact our team to begin with an RBI readiness assessment.
- Risk-Based IOSA
- IOSA Edition 18
- SMS Maturity
- Safety Performance
- Airline Safety Audit
- IATA IOSA
References
- IATA. (2024). IOSA Standards Manual (ISM), Edition 18. Montreal: IATA.
- IATA. (2023). Risk-Based IOSA Implementation Guidance. Montreal: IATA.
- ICAO. (2018). Safety Management Manual (SMM), Doc 9859, 4th Edition. Montreal: ICAO.
- ICAO. (2022). Annex 19 to the Convention on International Civil Aviation, 3rd Edition. Montreal: ICAO.
- IATA. (2024). IOSA Registry and Eligible Airline List. Montreal: IATA.
Subscribe to Global Aviation Safety Radar
Weekly aviation safety and compliance intelligence covering ICAO, IATA, EASA, and UK CAA developments — translated into practical implications for airlines, MROs, airports, ground handlers, and aviation leaders.