From Compliance Checklist to Evidence-Based Safety Maturity
IOSA preparation has changed significantly between ISM Edition 17 and ISM Edition 18. Edition 17 introduced the building blocks for Risk-Based IOSA — maturity assessment markers and the removal of the previous effectiveness assessment tool. IOSA ISM Edition 18 now operationalises that direction, moving the industry toward a fully integrated, risk-based and evidence-driven audit model.
For airlines, this means IOSA readiness can no longer be managed as a documentation update shortly before the audit. Operators must demonstrate that their management system, SMS, compliance monitoring, training, outsourced service provider oversight and operational control processes are not only documented, but implemented, monitored and effective.
IATA confirms IOSA has shifted to a risk-based approach, using operator-specific elements — operational profile, safety events and previous audit history — to shape audit focus.
What Was the Focus of ISM Edition 17?
ISM Edition 17 was a transition edition. It prepared airlines for the Risk-Based IOSA model by introducing the [MA] Maturity Assessment symbol across selected ORG and FLT ISARPs, removing the older [Eff] Effectiveness Assessment Tool, and aligning many provisions with a more structured safety management and system performance approach.
Key themes included:
- Introduction of Maturity Assessment indicators — [MA] symbols added to selected ORG and FLT provisions to identify the ISARPs forming part of the maturity assessment under Risk-Based IOSA.
- Removal of the previous effectiveness assessment tool — the older effectiveness concept was replaced by a more structured maturity-based approach.
- Stronger outsourced service provider control — upgraded provisions for provider selection and monitoring, with stronger alignment across ORG, FLT, DSP, MNT, CAB, GRH, CGO and SEC.
- Additional focus on cargo arrangements and partner airline oversight — requirements for operators with cargo aviation agreements to monitor other operators transporting their cargo.
- More precise operational provisions — stabilised approach, simulator observation, PBN/PBCS/RVSM/NAT HLA, fatigue-related risks, dangerous goods, ground handling and cabin safety provisions refined for auditability.
In short, ISM Edition 17 prepared the ground. It moved IOSA away from a purely checklist-based interpretation and introduced the structure required for deeper risk-based evaluation.
What Changed with ISM Edition 18?
ISM Edition 18 (Revision 1) is the 2026 edition, effective 1 January 2026 to 31 December 2026. It is the practical consolidation of the risk-based IOSA direction. The biggest shift is not the number of changed ISARPs — it is how airlines are expected to prove conformity.
1. Risk-Based IOSA Becomes the Operating Reality
Audit scoping is no longer identical for every operator. IATA states scoping is based on a combination of industry standards and operator-specific elements, including operational profile, safety events and the operator’s IOSA audit history. Airlines must prepare according to their own risk exposure, not a generic checklist.
An operator with previous GRH findings, recurring training issues, unstable provider performance or weak SMS evidence may receive deeper scrutiny in those areas; another with complex routes or recent operational events may face a different focus.
2. Maturity Assessment Becomes More Important
Edition 17 introduced the maturity assessment structure; Edition 18 makes it operationally relevant. The audit question is no longer “Do you have a procedure?” but “Is the system implemented, monitored, measured, reviewed and improved?”
IATA explains maturity assessment provides a more structured and comprehensive way of evaluating safety systems and programmes, while still requiring baseline conformity with IOSA ISARPs. Manual compliance alone is no longer enough — evidence must show the system is functioning.
3. Compliance Monitoring and SMS Integration Become Critical Evidence Areas
Edition 18 places stronger focus on the connection between compliance monitoring, safety risk management, corrective action management, management review, training effectiveness, operational control, outsourced provider oversight and safety performance indicators.
Airlines must show that findings are analysed, root causes addressed, corrective actions verified, trends reviewed and management decisions based on reliable safety and compliance data — consistent with IATA’s wider IOSA XML and digital integration direction.
4. Evidence Quality Matters More Than Document Quantity
Under Edition 18, weak evidence creates exposure. Airlines should not rely only on policies, manuals and forms. Auditors expect records such as:
- Internal audit plans and completed audit reports
- Corrective action closure and root cause analysis records
- Safety Review Board minutes and follow-up actions
- SPI monitoring and trend analysis
- Management of change records
- Training completion and competency records
- Outsourced provider and ground handling oversight records
- FDM / FOQA review evidence, where applicable
- Dangerous goods, cargo and security monitoring records
The key question is whether the airline can demonstrate a working system.
ISM Edition 17 vs Edition 18: Practical Comparison
| Area | ISM Edition 17 | ISM Edition 18 |
|---|---|---|
| Audit philosophy | Transition toward Risk-Based IOSA | Risk-based model becomes the practical audit environment |
| Maturity assessment | [MA] symbol introduced for selected ISARPs | Becomes central to readiness and audit evidence |
| Effectiveness tool | Older [Eff] approach removed | Evidence of system performance becomes more important |
| Preparation style | Gap analysis and transition planning | Risk-profile-based preparation and evidence validation |
| SMS | Integration clarified and strengthened | Effectiveness, review and performance evidence become critical |
| Compliance monitoring | Stronger attention to monitoring processes | Must show closure, trend analysis and management review |
| Outsourced providers | Selection and monitoring provisions strengthened | Oversight evidence becomes a key audit exposure area |
| Operational evidence | Documentation and implementation both important | Demonstrated performance and sustainability become decisive |
| Airline risk profile | Increasing relevance | Directly affects audit scope and depth |
| Best preparation approach | ISM 17 transition gap analysis | ISM 18 maturity, risk and evidence readiness assessment |
What Airlines Should Do Now
Preparation under ISM Edition 18 should not wait until the formal audit window. Begin with a structured transition review from ISM 17 to ISM 18.
- Perform an ISM 17–18 gap assessment — identify all changed, upgraded or newly emphasised provisions and map them against current manuals, procedures and records.
- Build a risk-based audit readiness profile — review previous IOSA findings, internal audit trends, safety events, operational complexity and outsourced provider performance.
- Validate maturity assessment evidence — verify whether the system produces evidence, performance data, decisions and improvements, not just whether procedures exist.
- Strengthen compliance monitoring — connect internal audits, findings, corrective actions, root causes, verification and management review in one controlled process.
- Prepare department-level evidence packs — ORG, FLT, DSP, MNT, CAB, GRH, CGO and SEC each ready with evidence showing implementation and performance.
- Train accountable managers and nominated postholders — senior management must treat Edition 18 as a continuous compliance and safety performance obligation, not a one-off audit event.
How Aero Support Group Supports IOSA ISM Edition 18 Readiness
Aero Support Group supports airlines with practical IOSA readiness solutions, including:
- ISM Edition 17 to Edition 18 gap analysis
- Risk-Based IOSA preparation and audit scoping support
- Maturity assessment readiness review
- IOSA internal audit and mock audit support
- SMS and compliance monitoring system review
- Evidence register development and audit-day support
- Departmental readiness workshops
- Corrective action and root cause review
- Continuous compliance monitoring system integration
With 1,000+ projects delivered across 100+ countries spanning IOSA, ISAGO, EASA and ICAO frameworks, our approach is simple: we help airlines move from manual compliance to demonstrable operational control.
Internal links: IOSA Audit Preparation · Gap Analysis & Compliance Assessment · Internal Audits & Mock Audits · SMS / QMS / IMS Development
Conclusion
ISM Edition 17 introduced the transition. ISM Edition 18 operationalises it. IOSA preparation is no longer about updating manuals just before the audit — it is about proving that safety, quality, compliance monitoring and operational control systems are working continuously.
Airlines that prepare early, understand their risk profile and organise evidence around maturity and performance will be in a far stronger position for IOSA renewal under Edition 18.
Need IOSA Edition 18 Readiness Support?
Whether you are preparing for IOSA renewal, transitioning from ISM 17 to ISM 18, or building a continuous compliance monitoring system, Aero Support Group can help. Our 1,000+ projects across 100+ countries give your team unmatched expertise in risk-based IOSA, maturity assessment and evidence-based audit readiness.
IOSA Audit Preparation
Gap Analysis
Internal & Mock Audits
Contact Aero Support Group
References
- IATA IOSA Standards Manual (ISM), Edition 18 Revision 1 — effective 1 January 2026 to 31 December 2026
- IATA IOSA Programme — Risk-Based IOSA (operational profile, safety events, audit history)
- IATA IOSA Programme Manual (IPM), Edition 18
- ICAO Annex 19, Edition 3 — Safety Management
- IATA IOSA XML — structured ISM for SMS / audit / content management integration