ONGOING COMPLIANCE MONITORING · Aero Support Group FZCO · Updated 22 October 2026
Why compliance needs continuous monitoring
An organisation is typically audited externally every one or two years, by IATA, its authority or its customers. Between those audits, the internal checks that should catch drift often lose priority to operations. Findings remain open, new regulatory requirements are not picked up, and the organisation discovers the gaps when the next external audit arrives.
The regulations anticipate this. The management system requirements in ORO.GEN.200, 145.A.200 and CAMO.A.200 include a function to monitor compliance with the applicable requirements and to feed findings back to the accountable manager. ICAO Annex 19 places continuous monitoring within safety assurance. IOSA and ISAGO assess the quality assurance programme as part of the ORG and ORM sections.
The elements of a working programme
- Requirements register: every applicable requirement, from regulations, audit standards and customer contracts, at the current edition, with its owner and the procedure that addresses it.
- Compliance status: a record for each requirement showing whether it is met, the evidence, and when it was last checked.
- Audit and inspection schedule: a rolling programme based on risk, rather than a single annual round.
- Finding management: root cause, corrective action, owner, due date, evidence and effectiveness check for every finding, internal or external.
- Regulatory change management: a process for identifying amendments, assessing their impact and planning implementation before the applicability date.
- Management review: regular reporting of status, overdue actions and trends to the accountable manager.
What ASG's retained support includes
The service is scoped to each organisation, and normally combines:
- maintenance of the requirements register and regulatory change tracking for the frameworks that apply (EASA, UK CAA, FAA, ICAO, IOSA, ISAGO);
- periodic review of compliance status and open findings, with a short report to management;
- support in planning and carrying out internal audits, or audits carried out by ASG where independence or specialist knowledge is needed;
- review of corrective action plans and closure evidence before submission;
- preparation for external audits, including a mock audit or readiness review;
- access to ASG consultants for questions on interpretation, authority correspondence and changes.
Under our RADAR model the organisation keeps ownership of its compliance monitoring function. ASG supports it with external expertise and a second view.
Where compliance monitoring falls short
- The requirements register was built for the last audit and has not been updated since.
- Internal audits cover the same areas every year and miss those with the most change.
- Findings are closed on a promise rather than evidence.
- Regulatory amendments are noticed only when an auditor cites them.
- Compliance monitoring and the SMS report separately and never compare notes.
- Management receives a list of open findings but not the trends that show where the system is weak.
Conclusion
Compliance monitoring is what keeps an organisation audit-ready between audits. When the requirements register is current, audits follow risk and findings close with evidence, the next external audit confirms what management already knows. ASG supports organisations in keeping that cycle running.
Frequently asked questions
Internal audit is one tool within compliance monitoring. Compliance monitoring also covers the requirements register, regulatory change, finding management and reporting to management.
Yes for EASA-approved organisations. The management system rules (for example ORO.GEN.200, 145.A.200 and CAMO.A.200) include a compliance monitoring function. IOSA and ISAGO assess the equivalent quality assurance programme.
SMS RADAR focuses on the safety management system: SPIs, the risk register and safety review board follow-up. Compliance monitoring support covers conformity with all applicable requirements. Many organisations use both, and the two programmes share data.
The organisation must keep the function and its accountability. Parts of the work, such as audits or regulatory tracking, can be contracted, provided the organisation oversees the contractor.
Building the requirements register and audit schedule usually takes a few weeks. The programme then needs a full cycle of audits and reviews to show that it works.
Key takeaways
- EASA management system rules include a compliance monitoring function
- A working programme has a current requirements register and a risk-based audit schedule
- Findings close on evidence, not promises
- Regulatory change tracking is part of compliance
- The organisation keeps ownership; ASG supports with expertise and a second view
Want to stay audit-ready between audits?
Tell us your approvals and audit calendar. ASG will propose a retained support package that fits your compliance monitoring function.