INTERNAL AUDIT & MOCK AUDITS · Aero Support Group FZCO · Updated 22 October 2026
What the frameworks require
- EASA: the management system of an air operator (ORO.GEN.200), a Part-145 organisation (145.A.200) or a CAMO (CAMO.A.200) includes a function to monitor compliance with the applicable requirements, with feedback of findings to the accountable manager.
- IOSA: the ORG section of the ISM requires a quality assurance programme with audits of operational areas, independent auditors, and tracking of findings to closure. IOSA also expects oversight of external service providers.
- ISAGO: the ORM discipline requires a quality assurance programme at headquarters and at stations, including oversight of subcontracted services.
- ICAO Annex 19: safety assurance covers safety performance monitoring, management of change and continuous improvement of the SMS.
None of these is satisfied by audits that only confirm documents exist. Auditors and authorities look for evidence that the programme finds real problems and that management acts on them.
Building an internal audit programme that works
Scope and frequency based on risk. Every applicable requirement should be covered within the planning cycle, with more frequent audits for areas with higher risk, recent findings or significant change.
Independence. Auditors should not audit their own work. Small organisations can meet this by cross-auditing between departments or by contracting part of the programme.
Audit criteria and checklists. Checklists should be built from the current editions of the requirements and from the organisation’s own procedures, and should ask for evidence of implementation, not just document references.
Findings that can be acted on. A finding states the requirement, what was observed and the evidence. “Procedure 2.14 requires duplicate inspection of control systems; work orders 4471 and 4486 show no second signature” can be acted on. “Procedures not always followed” cannot.
Feedback to management. Results, open findings and trends go to the accountable manager and into the management review, where they inform decisions on resources and priorities.
Mock audits
A mock audit simulates the external audit as closely as possible: the same standard and edition, the same scope, a similar schedule and auditors who question staff the way external auditors do.
- Mock IOSA: across the eight ISM sections (ORG, FLT, DSP, MNT, CAB, GRH, CGO and SEC), using the ISM edition that will apply to the audit.
- Mock ISAGO: at headquarters and at a station, across ORM and the disciplines the station performs (HDL, AGM, PAB, LOD and CGM), with a check of the Operational Portal gap analysis.
- Mock authority audit: against Part-145, Regulation (EU) No 965/2012, Part-TCO or national rules, with interviews of the accountable manager and nominated persons.
The output is a findings report in the format the organisation will receive from the real audit, followed by a debrief and a list of priorities. The best time for a mock audit is when there is still time to fix what it finds, usually some months before the official audit.
Where internal audit programmes fall short
- The programme audits documents and never observes operations or samples records.
- Every area is audited at the same frequency regardless of risk.
- Auditors are drawn from the area being audited.
- Findings are closed when a document is revised, without checking that practice changed.
- External service providers are listed but not audited, or audited only by questionnaire.
- Audit results are not discussed in the management review.
How ASG supports internal audit and mock audits
- Design or review of the audit programme, with a risk-based schedule covering all applicable requirements.
- Audit checklists built from the current editions of the ISM, GOSM, EASA rules or national regulations.
- Auditor training based on ISO 19011 and the relevant aviation standard.
- Outsourced audits where the organisation lacks independent or specialist auditors.
- Full or partial mock IOSA, ISAGO and authority audits, with a report and debrief.
- Follow-up audits to verify that corrective actions have worked.
Conclusion
An internal audit programme proves its value when it finds problems before external auditors do and when management uses its results. A mock audit then tells the organisation where it really stands. ASG builds programmes and runs mock audits that give management that information in time to act.
Frequently asked questions
Often enough to cover every applicable requirement within the planning cycle set by the organisation’s procedures and accepted by its authority, with higher-risk areas audited more frequently. The cycle should be based on risk, findings history and change.
Aviation rules rarely require it by name, but ISO 19011:2018 is the accepted guide to auditing management systems. Auditors trained to it plan better audits and write findings that stand up to review.
Yes, by having departments audit each other or by contracting part of the programme to an external auditor. The point is that no one audits their own work.
An internal audit is part of the organisation’s routine compliance monitoring. A mock audit simulates a specific external audit, such as IOSA or ISAGO, to test readiness shortly before it takes place.
Early enough to fix what it finds. For most organisations that means several months before the official audit, followed by a shorter readiness check closer to the date.
Key takeaways
- EASA, IOSA, ISAGO and Annex 19 all expect the organisation to monitor its own compliance
- Audit scope and frequency should follow risk
- Auditors should be independent of the area audited
- Findings should cite the requirement, the observation and the evidence
- Mock audits are most useful when there is time to act on them
Need an audit programme or a mock audit?
Tell us which standard and when your next external audit is due. ASG will propose a programme review or mock audit to match.