UNCONTROLLED IF PRINTED

TERHAD PU 2103

TECHNICAL AIRWORTHINESS MANAGEMENT MANUAL

SECTION 4

LEAFLET 4

CONDUCT OF APPROVED MAINTENANCE ORGANISATION AUDITS

INTRODUCTION 1. PU 2103 - Technical Airworthiness Management Manual - regulates and provides guidance on the conduct of engineering and maintenance applied to State aircraft and aeronautical equipment. The regulations require organisations that maintain these aircraft and equipment to be authorised by the State Technical Airworthiness Regulator (STAR). These organisations are known as Approved Maintenance Organisations (AMOs). In order to assess an applicant's suitability for certification and to monitor subsequent compliance, the TAR mandates a compliance assurance methodology, fully described in Section 1 Chapter 6. 2. One method of compliance evaluation and assurance is the formal audit. This instruction details how DGTA personnel are to conduct formal AMO audits. The audit process is illustrated by a flowchart in annex A. Auditing conducted by DGTA conforms to the guidelines issued under ISO 9001: 2001 or ISO 19011; this leaflet as a whole addresses ISO 9001:2000 Clause 8.2 or ISO 19011 Part 5.3.3 b through f. References to the specific guidelines in ISO 9001:2000 or ISO 19011 are made throughout the procedure to demonstrate compliance. This procedure to be used as a section of the overall AMO certification management process, described in TAMM Management of AMO Certification. AIM 3. The aim of this instruction is to state the procedure for the conduct of AMO audits. AUTHORITY 4. The authority for this instruction is the Direktorat Jeneral Teknikal Airworthines (DGTA). SCOPE 5. This instruction is applicable to all DGTA personnel involved in the conduct of AMO audits. 6. The applicability of this instruction excludes audits conducted by Fleet Aviation Engineering Unit and Aviation Support Group. These organisations will continue to conduct audits and Annual Technical Reviews (ATRs); however, the checklists used by these organisations will be modified to accommodate the State Technical Airworthiness Regulations. The role of DGTA personnel in these audits will depend on individual audit circumstances.

www.dgta.gov.my

4.4 - 1 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD DEFINITIONS 7. The following definitions will apply throughout this procedure: a. Applicant. The organisation applying for AMO certification. PU 2103

b. AMO audit. A systematic and independent evaluation of an organisations Maintenance Management System (MMS) and Quality Management System (QMS) to confirm compliance (or the potential for compliance) with State Technical Airworthiness Regulations 4 and 5, contained in this Manual. c. Systems (desktop) audit. An audit to evaluate an applicants documented MMS and QMS against State Technical Airworthiness Regulations 4 and 5. d. Compliance audit. An on-site audit of the applicant conducted against State Technical Airworthiness Regulations 4 and 5. The compliance audit is also used to confirm the implementation of the applicants MMS and QMS. e. Initial AMO audit. The first AMO compliance audit of an applicant.

f. Surveillance AMO audit. This audit is conducted after an AMO has been certified, as part of an on-going evaluation to ensure continued compliance with State Technical Airworthiness Regulations 4 and 5. g. Auditor. A member of the audit team, authorised by DGTA.

h. Lead Auditor. The leader of the audit team who is responsible for the overall coordination and conduct of the audit, authorised by DGTA. i. Auditee. The organisation being audited.

j. Desk officer. DGTA auditor, designated to conduct the systems audit and liaise with the applicant during the certification and surveillance processes. INSTRUCTIONS Pre-Audit Checklist 8. The Lead Auditor is to raise and complete a pre-audit checklist, annex B, and place the completed copy on the audit record file. Systems (desktop) audit 9. Instruction. The desk officer is to conduct a systems audit of the applicant's Maintenance Management Plan (MMP), within the pre-defined audit scope as set by the Lead Auditor. The desk officer is to compile a systems audit (non-compliance) report listing all deficiencies between the MMP and the Technical Airworthiness Regulations. 10. Guidance. The systems audit should provide: 4.4 - 2 of 11 TERHAD

www.dgta.gov.my

UNCONTROLLED IF PRINTED
TERHAD PU 2103 a. a determination of whether the applicant may become an AMO, as specified in the Technical Airworthiness Management Manual (TAMM); b. an assessment of the AMOs MMS and QMS as documented in the MMP, for compliance against State Technical Airworthiness Regulations 4 and 5. c. the means to familiarise nominated members of the audit team with the applicant's MMS through the development of a checklist or question-list; and 11. The basis for notification to the applicant, through the Lead Auditor, of any deficiencies detected in the application and associated documentation with respect to the State Technical Airworthiness Regulations. This notification is to be signed by DGTA. 12. Guidance. The desk officer should conduct a systems audit of the application and associated documentation in which the degree of compliance of the applicants MMS and QMS with the Aircraft Maintenance Regulations is assessed in detail. The desk officer will then recommend to the supervisor a response to the applicant depending on the outcome: 13. Systems audit does not preclude compliance audit. Once the desk officer has assessed the application and associated documentation, any deficiencies discovered that would not impede the conduct of a compliance audit should be documented and forwarded to the applicant via the MAO. If these deficiencies have not been rectified by the completion of a compliance audit, they should be documented and managed as Corrective Action Requests (CAR). 14. Systems audit precludes compliance audit. In the event that the application is judged as unsuitable to proceed with the AMO certification process, a response should still be sent to the applicant via the MAO. The response should describe the faults found within the application and associated documentation, and highlight those deficiencies that must be resolved prior to the commencement of a compliance audit. A compliance audit should only proceed once these major deficiencies have been rectified. Any other deficiencies that have not been resolved by the completion of a compliance audit should be documented and managed as CARs. 15. Guidance. There is no pre-defined method to conduct a systems audit. However, the desk officer should ensure that the requirements of each regulation are satisfied by the application. One way to successfully achieve this is to generate a table with each regulation referenced against the method that the applicant uses to satisfy the applicable regulatory requirements. An example of a systems audit report, which incorporates a checking table, is included at annex C. 16. Guidance. A key part of the systems audit is the development of an audit checklist. Whilst there is no pre-determined format for an audit checklist, it should: a. document any non-compliances contained within the applicants AMO submission; b. provide members of the audit team with a reference to key applicant procedural references; and c. Highlight all areas of concern contained within the application documentation.

www.dgta.gov.my

4.4 - 3 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD PU 2103 17. Guidance. During the systems audit, the applicant may be requested to clarify data supplied as part of the application or provide additional documentation relevant to the audit scope. Some audits may involve classified documents that will only be available on-site during the compliance audit. Audit team 18. Instruction. The Lead Auditor is to appoint members of the audit team (ISO19011 Parts 5.3.3 c and 6.2.4). 19. Guidance. The size and composition of the audit team will be dictated by: a. b. c. d. the scope of the audit; the physical size, and geographical location of the organisation; any requirements for specialist knowledge; and The availability of suitably trained and authorised auditors.

20. Guidance. The MAO should be invited to participate in the audit. For commercial organisations, the Lead Auditor should also contact appropriate members within the Direktorat Jeneral Teknikal Airworthines (DGTA) and Joint Technical Airworthiness (JTA) members. DGTA and JTA members often have established relationships with the commercial applicant. The inclusion of these members, whilst at the discretion of the Lead Auditor, may add valuable experience to the audit team. The role of any external personnel, ie auditors or observers, should be established clearly prior to the audit (ISO/DIS 19011 Part 6.5.3). Develop the compliance audit plan 21. Instruction. The Lead Auditor is to notify interested organisations that a compliance audit of the applicant will be conducted. Ascertain whether those interested organisations have any specific concerns regarding the operation of the applicant. Any information provided is to be treated as in confidence until cleared by the originator for further discussion. 22. Guidance. As a minimum, the Lead Auditor should contact these organisations prior to the compliance audit to ascertain whether they have any concerns related to the potential compliance of the applicant with State Technical Airworthiness Regulations 4 and 5. Consideration should be given to coordinating audits with other organisations so as to minimise disruption of the auditee. Reports of other organisations audits should be reviewed for possible issues to be included in the AMO audit checklist. The type of organisations that may be contacted for input include, but are not limited to: a. b. c. MAO; Related SAO Engineering Department; DGTA;

www.dgta.gov.my

4.4 - 4 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD d. e. JTA members; Centre Aerospace Engineering Services Establishment (CAESE) PU 2103

f. Instruction. The Lead Auditor is also to review the following data, and modify the audit checklist to accommodate any concerns arising from the review. g. h. The 'Current Maintenance Issues' file The TAR Maintenance Directives file

i. Maintenance Incident Reports (MIR) and Special Occurrence Reports (SOR). Analysis procedure of MIRs and SORs is detailed in PU 2201 Arahan Organisasi dan Pentadbiran Kejuruteraan. j. Any previous audits conducted on the applicant to find any information applicable to the applicant that should be considered when planning the audit. k. Maintenance concerns arising from previous Airworthiness Board submissions and Airworthiness Board outcomes are also to be considered by the Lead Auditor. 23. Guidance. DGTA maintains data on maintenance issues to assist in identifying potential threats to technical airworthiness. This data is reviewed prior to the compliance audit to ascertain which elements apply to the applicant. For example, if maintenance publications have recently been associated with a number of incidents that threaten or contravene technical airworthiness requirements within maintenance organisations, the Lead Auditor should specify that the audit team directs extra resources toward ensuring that the applicant's maintenance publication system is compliant with the applicable State Technical Airworthiness Regulations. 24. Instruction. The Lead Auditor is to develop the audit plan and confirm the agreed audit details in writing through the preparation and dispatch of an audit plan to the applicant (ISO/DIS 19011 Parts 5.4 a and b, and 6.4.1). The Lead Auditor must also ensure the necessary administrative, travel and accommodation arrangements are made to support the plan. 25. Guidance. An example of an audit plan is included in annex D. The audit plan should include: a. b. the purpose and scope of the audit; the agreed date(s) of the audit;

c. Details of the audit team members, including names, position and role in the audit (ie. Lead Auditor, auditor, specialist members, or observer and whether acting under training). This is particularly relevant for members of the audit team that are not DGTA Section personnel. These members should have very clearly defined areas of responsibility and may require supervision by DGTA staff; d. any outstanding documentation requirements from the systems audit; 4.4 - 5 of 11 TERHAD

www.dgta.gov.my

UNCONTROLLED IF PRINTED
TERHAD PU 2103 e. Facilities requirements for the audit team (ie. a suitable briefing room for the opening and closing meetings, a private room with power throughout the audit etc.); f. an outline of the compliance audit process;

g. the proposed audit program, including a strong suggestion that senior management attend the opening and closing meetings; and h. Proposed reporting and follow-up actions.

26. Guidance. The audit program details the proposed schedule of audit activities during the compliance audit. This should not be to overly detail to enable flexibility during the conduct of the audit. Usually audit activities should commence 30 minutes after the start of business, and finish 30 minutes before the close of business. This limits the disruption to the applicants normal business routine. Where an AMO conducts multiple shifts or 24 hour operations, the Lead Auditor should consider whether there is a requirement to make auditors available to monitor operations surrounding shift changes, to provide insight into operational differences between shifts and the conduct of the shift change. 27. Guidance. Arrange travel and accommodation by raising the appropriate travel and financial documentation. Personnel information is included on the recall list found at DGTA computer file. Arrange for provision of equipment required to conduct an audit without reliance on the applicant's facilities (for example laptop computer(s) and a portable printer). Arrange necessary data, documentation and stationary (ie. sufficient quantity of Pre-printed CAR forms, adequate yellow and green paper, pens, audit checklists, organisations file, copy of this procedure, softcopy of DGTA CAR Generator, CD with current status of technical publications, etc). Audit team preparation brief 28. Instruction. The Lead Auditor, in conjunction with the systems auditor, is to brief the audit team on the details of the audit. 29. Guidance. The audit team preparation brief should include: a. the purpose and scope of the audit;

b. how the audit is to be conducted, recorded and reported, including the use of check-lists or question-lists and the importance of recording objective evidence and specific references in relation to non-compliances (ISO/DIS 19011 Part 6.4.3); c. allocation of responsibilities for specific parts of the audit (ISO/DIS 19011 Part 6.4.2); d. any key maintenance issues to be considered, whether provided by the AEO, the 'Maintenance Issues' folder or other organisations; and e. travel and accommodation arrangements.

www.dgta.gov.my

4.4 - 6 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD Opening meeting 30. Instruction. The Lead Auditor is to conduct an opening meeting between the audit team and the auditee's representatives (ISO/DIS 19011 Part 6.5.1). 31. Guidance. The purpose of an opening meeting is to confirm and, if necessary, amend the arrangements detailed in the audit program. The auditee should be encouraged to ensure that appropriate members of senior management are present. A checklist guide for the conduct of an opening meeting is in annex E. Compliance audit 32. Instruction. Conduct a compliance audit of the applicant's organisation to ensure compliance with State Technical Airworthiness Regulations 4 and 5. 33. Guidance. The audit should be carried out at the location where the MMS is being implemented and where records are readily available. This location should be reflected within the audit scope. Where the auditor finds a non-compliance with the State Technical Airworthiness Regulations, objective and specific evidence must be gathered and referenced. Any audit checklists may be expanded during the audit to include additional questions to further clarify the auditees compliance with specific regulatory requirements. The audit scope should include the issues discussed at para 43. 34. Guidance. Throughout the audit the Lead Auditor should consider providing the auditee with ongoing feedback of the compliance audit findings. Potential major CARs should be brought to the attention of the auditee as soon as possible. Principles of Auditing 35. Instruction. The audit is to be conducted and all audit team members are to conduct themselves in accordance with the general principles of ethical conduct, fair presentation and due professional care. DGTA auditors need to maintain their independence from the auditee and ensure findings are based on objective evidence 36. Guidance. This addresses the general principles of auditing outlined in ISO/DIS 19011 (Part 4). Audit team meetings 37. Instruction. At the conclusion of each day the Lead Auditor is to chair an informal meeting of the audit team (ISO/DIS 19011 Parts 6.5.2 and 6.5.5). 38. Guidance. The purpose of the informal meetings at the end of the day is to review and evaluate the audit findings and redirect the audit team's approach to the following day's audit activities if required. The Lead Auditor may need to arrange meeting with the auditee to communicate the status of the audit and any concerns. Any evidence of immediate and significant risks to airworthiness or safety should be reported to the auditee without delay. 39. Instruction. At the conclusion of the audit, and once the objective evidence required to support disclosure of all discovered non-conformances has been collected, the Lead Auditor is to conduct a final meeting of the audit team. www.dgta.gov.my 4.4 - 7 of 11 TERHAD PU 2103

UNCONTROLLED IF PRINTED
TERHAD PU 2103 40. Guidance. The purpose of the final meeting is to review and evaluate all the audit findings, and prepare for the closing meeting. At the final meeting, the audit team should discuss each noncompliance observed and decide whether it constitutes a major noncompliance, a minor noncompliance or an observation. The Lead Auditor is ultimately responsible for deciding the status of all non-compliances. CARs should be raised in accordance with the Writing CARs section of this instruction and managed in accordance with SAO pertinent publications. Writing CARs 41. Instruction. Non-compliances are to be documented by raising a CAR Form prior to the closing meeting. 42. Guidance. The CAR form used by DGTA Section is a locally produced softcopy form, which is available using the DGTA CAR Generator. 43. Guidance. The CAR form must contain sufficient information to enable the auditee to identify the non-compliance in the future. Objective evidence should be quoted (ISO/DIS 19011 Part 6.5.4), together with the relevant Technical Airworthiness Regulation clause and/or auditees documentation against which the non-compliance is recorded (ISO/DIS 19011 Part 6.5.5). The Lead Auditor should consider convening a brief meeting with the Senior Maintenance Manager (SMM) prior to the closing meeting to provide a summary of the findings and briefly discuss the more significant CARs that have been raised. No significant audit findings should be left unknown by the auditee at the closing meeting. Less important non-compliances and problems unrelated to the Technical Airworthiness Regulations or outside the scope of the audit may be recorded as observations in the final report. Draft audit report 44. Instruction. Prepare a draft report on the AMO audit (ISO/DIS 19011 Part 6.5.6). The report distribution shall include, but is not limited to, the applicant and the MAO. Reports on initial AMO audits are to detail both how the auditee achieved compliance (to provide a baseline for future audits) and what aspects need corrective action. The Lead Auditor is to make a recommendation as to whether AMO status should be granted or maintained. Reports are to include specific reference to the status of topics specified by the 'Current Maintenance Issues' and TAR Maintenance Directives file. The report is also to include reference to implementation of recommendations arising from SORs and MIRs. 45. Guidance. A sample audit report is included in annex G. To comply with the requirements for airworthiness board submissions a supplementary report should be raised as an enclosure to the audit report and should discuss the following aspects: a. b. c. Training/Competencies the effectiveness of the initial trade training and on-the-job training programs, the current competency and proficiency of the maintenance workforce,

d. the procedures in place to ensure that records of training and efficiency are properly maintained, and e. the effectiveness of field training facilities; www.dgta.gov.my 4.4 - 8 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD PU 2103 f. state whether there are sufficient competent tradesmen to ensure that maintenance standards are maintained; g. if a trend of maintenance incidents is emerging, state what action has been taken to reverse it; h. state whether there are any noteworthy maintenance procedural problems and identify whether there are an excessive number of Carried Forward Unserviceabilities; i. provide an assessment of any issues identified with the use of SPKB system and any associated electronic maintenance management tools (state whether a SPKB audit has been conducted and, if any serious deficiencies were identified, whether these and their causes have been rectified); and j. provide an assessment of the currency, accuracy and useability of maintenance publications and advise of any deficiencies that have a bearing on airworthiness. Closing meeting 46. Instruction. The Lead Auditor is to chair a closing meeting to provide the auditee with an outline of the audit findings and get acknowledgment for the corrective action required (ISO/DIS 19011 Part 6.5.7). All available members of the audit team are to be present. 47. Guidance. It is frequently useful to discuss the audit findings with the auditees representative (typically the Senior Maintenance Manager) prior to the closing meeting in order to clarify and resolve any contentious issues (ISO/DIS 19011 Part 6.5.5). This will avoid the need to prolong the closing meeting by reviewing detailed findings such as observations. An example of the possible checklist for the conduct of a closing meeting is in annex H; however, as a minimum the following agenda should be followed: a. b. c. d. An overview of the audit, including: audit purpose and scope; the audit program as completed; and the results (starting with the positive aspects).

e. Guidance. The Lead Auditor should briefly summarise the audit findings and any lessons learnt from the conduct of the AMO audit. Management of CARs 48. Instruction. The Lead Auditor (or delegate) is to register all CARs raised during the compliance audit in the DGTA CAR Management Database. 49. Guidance. The Lead Auditor (or delegate) should enter all applicable CAR details on the DGTA CAR Management Database in accordance with annex F. Instructions on the www.dgta.gov.my 4.4 - 9 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD PU 2103 management of CAR closure are located within DGTA Management of Certification of Authorised Maintenance Organisations. Post-Audit Checklist 50. The Lead Auditor is to raise and complete a post-audit checklist, annex I, and place the completed copy on the audit record file. Audit records 51. Instruction. All appropriate audit documentation is to be retained on the associated audit record (ISO/DIS 19011 Part 5.5) as detailed in DGTA Data Management. Audit documentation relating to commercial organisations is to be treated as Commercial in Confidence (ISO/DIS 19011 Parts 6.6.2 and 6.7.1). Training 52. Instruction. The Lead Auditor is to ensure the DGTA training record is updated and, where appropriate, auditor authorisation action is initiated following the audit. 53. Guidance. Training and authorisation of auditors (ISO/DIS 19011 Part 7) is covered in PU 2302. Surveillance Audits 54. A surveillance audit is performed biennially or at the discretion of the TAR to verify whether certification is to remain valid, which is achieved by assessing continued compliance to the Technical Airworthiness Regulations. The procedure for the surveillance audit is the same as that of the system and compliance audits described within this instruction. Review 55. This procedure shall be reviewed every 12 months.

Annexes: A. Conduct of AMO audit flow chart B. Pre-Audit Checklist C Sample systems audit report D. Sample audit plan E. Opening meeting checklist F. AMNTREG CAR Generator A Users Guide G. Sample audit report H. Closing meeting checklist I. Post-Audit Checklist Related orders, instructions and publications PU 2103 Technical Airworthiness Management Manual
www.dgta.gov.my 4.4 - 10 of 11 TERHAD

UNCONTROLLED IF PRINTED
TERHAD PU 2103

www.dgta.gov.my

4.4 - 11 of 11 TERHAD