IOSA AUDIT READINESS · By Ferhan Bugay, Executive Director, Aero Support Group FZCO · Updated 21 October 2026
What is risk-based IOSA and how is the audit scope set?
Risk-based IOSA (RBI) is the audit model IATA moved to in 2024. The audit no longer gives every ISARP the same weight. IATA describes it as a scope “tailored for each airline”, combining a baseline of industry-wide standards with operator-specific elements.
The operator-specific part is driven by the airline’s operational profile (routes, fleet, complexity), its recent safety events and occurrence data, its IOSA history including repeat findings, and its regulatory environment. Two airlines audited in the same month can therefore face very different scopes. An airline with past findings in ground handling oversight should expect deeper sampling there; an operator flying into demanding aerodromes should expect more attention on FLT and DSP.
The practical consequence is that you need to know your own risk profile before the audit organisation does. Preparing every section to the same depth wastes effort and leaves the high-risk areas thin.
What changed in ISM Edition 18 Rev 1?
IATA states that maturity assessment criteria are now fully integrated into Edition 18 Rev 1. The other changes IATA lists, section by section, are:
- ORG: ORG 2.4.2 and ORG 3.4.1 upgraded from Recommended Practices to Standards. ORG 3.3.1 and 3.3.2 updated for the new ICAO aircraft weight thresholds for FDA. ORG 2.1.4 auditor actions now require validation of implementation. ORG 2.2.3 recognises ISSA registration.
- FLT: GPS jamming and spoofing added to training guidance (FLT 1.12.2, also DSP 1.12.2). Volcanic ash training widened from routes to areas (FLT 2.2.16B). Flexibility for State-specific flight crew age limits (FLT 3.3.5). Sterile cockpit and turbulence policy updates (FLT 3.11.17, 3.11.50B).
- DSP: new Standard for a safety risk assessment at the flight planning stage (DSP 3.2.8C). Incremental values for dispatch planning aligned with EASA and FAA (DSP 3.2.9C).
- MNT: training material requirements clarified (MNT 1.11.6), guidance on taxiing by maintenance personnel (MNT 4.5.7), and a new ROAAS requirement with an implementation deadline in MNT Table 4.11.
- CAB: security added to service provider selection criteria (CAB 1.10.1A), supervised line flying during initial training clarified (CAB 2.3.1), cabin door operation and ground staff roles revised (CAB 3.2.4A).
- GRH: GRH 3.4.14A, 3.4.16 and 3.4.17 upgraded to Standards for ULD and dangerous goods incident handling. “Appropriate screening” introduced in GRH 3.7.10.
- CGO: training now includes assessment and the revenue/non-revenue distinction is removed (CGO 2.2.4). New Recommended Practice on PEDs in cargo (CGO 3.6.2).
- SEC: SEC 1.1.1 to 1.12.2 updated to reference SSPs, ESPs and SeMS. More emphasis on competencies and controlled areas (SEC 1.5.2, 1.5.3). DG incident reporting and crew baggage handling revised (SEC 3.6.6).
The ORG upgrades are the ones most airlines feel first. What used to be advisory on compliance monitoring and SMS integration is now auditable, and a finding there tends to cascade into other disciplines.
How does the IOSA maturity assessment work?
Under the conventional model the auditor’s question was binary: conformity or finding. Under RBI the auditor also forms a view on how mature each safety-critical system is. An airline can conform to a standard and still receive a weak maturity rating, for example an SMS with documented processes but little evidence that hazard reports change anything, or a compliance monitoring programme that runs audits but does not close findings on time.
Preparation therefore has to reach operational evidence. Typical items auditors ask for are SPI trends with targets and the decisions taken on them, hazard register activity, SRB minutes with tracked follow-up, corrective action closure and effectiveness checks, competency assessment results, and examples of risk-based decisions in operational control.
What are risk-based audits finding?
IATA reports that the first 100-plus risk-based audits found on average twice as many non-conformities as conventional audits, while auditing fewer standards. Deeper sampling in the high-risk areas finds what the old broad-but-shallow audit missed.
Airlines that use their last IOSA result as a guide to readiness are likely to underestimate their exposure. The safety case for doing this well is clear in IATA’s 2025 Safety Report: IOSA-registered carriers had an accident rate of 0.98 per million sectors against 2.55 for non-IOSA carriers.
Where should each discipline focus its preparation?
- ORG: show that compliance monitoring and SMS integration work in practice now that ORG 2.4.2 and 3.4.1 are Standards. Management review, SRB governance and management of change will be sampled.
- FLT: current SOPs that crews actually follow, an FDM programme with analysis and follow-up action, and fatigue risk management evidence. Check GNSS interference training content.
- DSP: evidence of the flight planning safety risk assessment required by DSP 3.2.8C.
- MNT: training material control and the ROAAS requirement in Table 4.11 (projected full conformance 31 December 2027 under Edition 18, moving to 31 December 2028 under Edition 19).
- GRH: oversight of contracted ground handlers, provider performance monitoring and ground handling risks in the airline SMS.
- CAB: competency assessment records, emergency procedure compliance and the revised door operation roles.
- CGO and SEC: current DG training records with assessment, acceptance checks, PED handling, and the security programme references now required in SEC.
What happens when ISM Edition 19 takes effect?
IATA has released ISM Edition 19. Under the IOSA Program Manual it applies to all audits conducted on or after 1 January 2027. The IAH Edition 19 tables already show the main operator changes: the DSP 4.2.3 parallel conformity option ends, the projected full conformance dates for ADT and ROAAS move to 31 December 2027 and 31 December 2028, CVR and DLR leave the active implementation list, and several security references move into new GRH 3.7 ISARPs. We cover these in IOSA ISM Edition 19: what airlines should do before 1 January 2027.
Seven steps to prepare for your next IOSA audit
- Understand your risk profile. Review operational complexity, occurrence data, previous IOSA findings and your regulatory environment, and decide where the audit is likely to go deep.
- Run a gap analysis against the applicable ISM edition. Start with ORG 2.4.2, ORG 3.4.1 and the new DSP 3.2.8C.
- Assess system maturity. Test whether your SMS, compliance monitoring and training systems produce decisions and results.
- Build the evidence file. SPI trends, hazard register activity, SRB minutes, CAP closure and effectiveness records, competency data.
- Close previous findings for good. RBI scoping looks at your history, so verify that past corrective actions held.
- Brief your post holders. Make sure they can explain the risk-based method and show their own evidence.
- Get an independent pre-audit review. A mock audit using the RBI method shows where the real audit will find gaps.
Conclusion
IOSA preparation in 2026 is about operational evidence. The risk-based model sends auditors to your weakest areas, the maturity assessment asks whether your systems work, and the ORG upgrades in Edition 18 Rev 1 make compliance monitoring and SMS integration auditable Standards. Airlines that start from their own risk profile and build their evidence around it go into the audit knowing where they stand. With Edition 19 effective on 1 January 2027, the time to plan the next delta review is now.
Frequently asked questions
It is the work an airline does to test and strengthen its conformity with the IOSA Standards Manual before the audit. Under the risk-based model it covers the airline’s own risk profile, the maturity of its safety-critical systems and the evidence that those systems work.
ISM Edition 18 Rev 1 applies in 2026. Edition 19 applies to audits conducted on or after 1 January 2027, in line with the IOSA Program Manual.
Maturity assessment criteria are fully integrated. ORG 2.4.2 and ORG 3.4.1 became Standards, DSP 3.2.8C added a safety risk assessment at the flight planning stage, and there are changes in FLT, MNT, CAB, GRH, CGO and SEC. IATA notes that its published list is not exhaustive.
It is the auditor’s evaluation of how well an airline’s safety-critical systems function, beyond conformity with each ISARP. It looks at SMS performance, compliance monitoring, training effectiveness and operational control.
The scope combines baseline standards with operator-specific elements: operational profile, safety events and occurrence data, IOSA audit history and regulatory context.
EASA and the UK CAA look at an operator’s safety performance and oversight evidence when they assess a TCO application. IOSA registration and a strong audit record are useful supporting evidence, though they do not replace the TCO requirements.
Key takeaways
- ISM Edition 18 Rev 1 applies to IOSA audits in 2026; Edition 19 is effective from 1 January 2027
- Risk-based scoping sends auditors to your highest-risk areas, so map your risk profile first
- ORG 2.4.2 and ORG 3.4.1 are now Standards: compliance monitoring and SMS integration must work in practice
- The maturity assessment asks for operational evidence such as SPI trends, SRB decisions and CAP effectiveness
- Risk-based audits have found twice as many non-conformities as conventional audits
Preparing for your next IOSA audit?
Aero Support Group supports airlines from gap analysis and risk profile review to evidence development, mock audits and audit-day support. Our IOSA RADAR service keeps your conformance continuously current between audits.
References
- IATA, IOSA Standards Manual (ISM), Edition 18 Rev 1: revision highlights
- IATA, IATA Operational Safety Audit (IOSA) and risk-based IOSA
- IATA Store, IOSA Standards Manual (ISM): Edition 19 Rev 1, effective 1 January 2027
- IATA, 2025 Safety Report
- ICAO, Annex 19 Safety Management
- SKYbrary, IATA Operational Safety Audit