SUPPLIER & SERVICE PROVIDER AUDITS · Aero Support Group FZCO · Updated 22 October 2026
What the frameworks require
- EASA air operators: under ORO.GEN.205 the operator remains responsible when it contracts or purchases a service or product, and must ensure that the contracted activity meets the applicable requirements. The CAMO and Part-145 rules contain equivalent provisions (CAMO.A.205 and 145.A.205).
- IOSA: the ISM requires the operator to have a process for selecting and monitoring external service providers that perform operational functions, with contracts that specify safety and quality requirements, across the ORG section and the operational sections that outsource activities.
- ISAGO: ground service providers must oversee their own subcontractors and suppliers under the ORM discipline.
- ICAO Annex 19: a service provider’s SMS covers hazards arising from the activities of contractors that interface with its operations.
A risk-based oversight programme
1. Inventory and classification. List every external provider that performs or supports an operational function and classify each by the safety consequence of failure, the volume of activity and its track record.
2. Contract requirements. Contracts and service level agreements should state the applicable standards, the provider’s obligations to report occurrences and changes, and the operator’s right to audit.
3. Use of existing evidence. Where a provider holds a relevant approval or registration, such as an EASA Part-145 approval, ISAGO registration or membership of an IATA quality pool, the operator can take that into account and focus its own audits on what those schemes do not cover.
4. Audits and monitoring. Audit frequency follows the classification. Between audits, performance data such as occurrence reports, delays and ramp incidents shows whether a provider needs attention earlier.
5. Findings and follow-up. Findings are tracked to closure with evidence, and repeated or serious findings are escalated through the operator’s management system.
Provider categories and audit criteria
- Ground handlers: the operator’s ground handling requirements, IGOM and AHM, and the ISAGO standards where the handler is registered.
- Maintenance organisations: Part-145 or the equivalent national approval, the contract and the operator’s maintenance programme, with particular attention to scope of work, certifying staff and subcontracting.
- Fuel suppliers: the operator’s fuel quality requirements and the JIG standards for aviation fuel handling, with fuel conforming to the applicable specification (DEF STAN 91-091 or ASTM D1655 for jet fuel).
- De-icing providers: the operator’s de-icing programme, AHM and SAE standards, and DAQCP reports where available.
- Catering, cleaning and other services: food safety standards such as HACCP, and the security and safety requirements that apply airside.
- Training providers: the approvals the provider holds and the training programme the operator relies on.
Where supplier oversight falls short
- The list of providers is incomplete, especially for subcontractors of subcontractors at outstations.
- Contracts do not include the right to audit or the obligation to report occurrences and changes.
- Audits are questionnaires returned by the provider, with no verification.
- Every provider is audited at the same frequency, regardless of risk.
- Pool reports are received but not reviewed, and open findings are not followed up.
- Supplier performance data never reaches the safety review board.
How ASG supports supplier oversight
- Design or review of the operator’s external service provider oversight programme, aligned with ORO.GEN.205 and the ISM.
- Provider risk classification and a multi-year audit plan.
- Audit checklists for ground handlers, MROs, fuel, de-icing and other services.
- Audits carried out on the operator’s behalf, including pre-contract due diligence.
- Review of pool reports and follow-up of open findings.
- Training for the operator’s own supplier auditors.
Conclusion
Contracting an activity out does not transfer the responsibility for it. An oversight programme that classifies providers by risk, uses existing evidence and audits where it matters gives the operator real assurance and stands up in IOSA and authority audits. ASG builds and runs those programmes.
Frequently asked questions
Those that perform or support operational functions with a safety impact, such as ground handling, maintenance, fuelling and de-icing. The depth and frequency of oversight should follow the risk each provider presents.
The regulations and the ISM leave frequency to the operator’s risk assessment. Critical providers are typically audited more often, and performance data can trigger an earlier audit.
They can be taken into account. An EASA Part-145 approval, ISAGO registration or IATA pool membership provides evidence, but the operator still checks the activities it contracts and the requirements specific to its operation.
The applicable standards, the services and scope, occurrence and change reporting obligations, the operator’s right to audit, and how findings will be handled.
Yes. ASG carries out supplier audits on behalf of operators and can also train the operator’s staff to run their own programme.
Key takeaways
- The operator remains responsible for contracted activities (ORO.GEN.205)
- IOSA requires oversight of external service providers
- Classify providers by risk and set audit frequency accordingly
- Use approvals, ISAGO registration and IATA pool reports as evidence
- Contracts should include the right to audit and reporting obligations
Need a supplier oversight programme or audit?
Tell us your providers and stations. ASG will propose a risk-based programme or carry out the audits for you.