Safety management is no longer optional for maintenance organisations. Since Commission Implementing Regulation (EU) 2021/1963 amended Regulation (EU) No 1321/2014, every EASA Part-145 approved maintenance organisation has been required to operate a management system that embeds safety management — applicable from 2 December 2022, with the transition window under Article 4(7) of Regulation (EU) No 1321/2014 closed on 2 December 2024. Continuing airworthiness management organisations reached the same position earlier through point CAMO.A.200 of Regulation (EU) 2019/1383.
Many organisations bring in external support to implement or mature their SMS. Choosing that support well matters: your competent authority audits your organisation, not your consultant, and responsibility for the management system cannot be delegated. This guide sets out evaluation criteria anchored in the regulations themselves, so you can judge any proposal against what the rules actually require.
Why maintenance organisations bring in SMS support
The regulation requires outcomes, not methods. Point 145.A.200 requires the organisation to establish, implement and maintain a management system that includes, among other elements, clearly defined lines of responsibility and accountability, a safety policy, processes for hazard identification and safety risk management, safety training and promotion, and compliance monitoring of the organisation with the applicable requirements. The related point 145.A.202 requires an internal safety reporting scheme, and 145.A.205 governs how contracting and subcontracting are controlled.
None of this obliges you to hire anyone external. Organisations typically seek support because the deadline pressure transition exposed gaps, because a small organisation cannot spare a full-time resource to design the system, or because an audit or authority finding demands structured corrective action. All three are legitimate reasons — provided the consultant builds capability inside your organisation rather than dependency on theirs.
It is also worth being clear about what a consultant cannot do. They cannot hold your approval, and they cannot own your hazards. The value an external specialist brings is pattern knowledge — what a functioning reporting scheme looks like, which risk assessment methods survive contact with a hangar floor, where authorities have raised findings in comparable organisations — applied to a system that must remain recognisably yours.
Know what the rules require before you read a single proposal
You cannot evaluate a scope of work unless you know the yardstick. Internationally, the framework is ICAO Annex 19 (Safety Management, second edition, 2016) and the ICAO Safety Management Manual (Doc 9859, fourth edition, 2018), which structure an SMS into four components and twelve elements: safety policy and objectives, safety risk management, safety assurance, and safety promotion. The EASA rules transpose this framework into the continuing airworthiness domain through 145.A.200 and CAMO.A.200.
Doc 9859 is explicit that an SMS must be tailored to the size, nature and complexity of the organisation. That single sentence is your sharpest evaluation tool: any proposal that does not begin by understanding your ratings, fleet mix, staffing and existing procedures is offering you someone else’s SMS.
Competence criteria: what an aviation SMS consultant must demonstrate
Evaluate competence in three layers. First, regulatory knowledge: current command of Regulation (EU) No 1321/2014 as amended, the associated EASA Acceptable Means of Compliance and Guidance Material, and the ICAO references behind them. Ask which specific amendments they have taken organisations through; Regulation (EU) 2021/1963 is the obvious recent test.
Second, operational experience in your domain. Safety management in an airline flight operations department is not safety management on a hangar floor. Look for evidence of work inside Part-145 or CAMO environments: approvals supported, findings closed, familiarity with maintenance-specific hazard sources such as shift handover, task interruption and contracted work — the territory where maintenance error investigation methods such as Boeing’s MEDA operate.
Third, verifiable evidence. References from organisations of comparable size and scope, examples of documentation produced (with client details redacted), and the consultant’s own professional history: licences held, postholder or nominated person roles occupied, audit experience on either side of the table. Certificates from safety management courses are supporting evidence, not proof by themselves.
Scope and deliverables to specify in the contract
A well-scoped SMS engagement names its deliverables against the regulatory elements they satisfy. Depending on your starting point, the scope will typically include some or all of the following:
- Gap analysis — your current management system mapped element by element against 145.A.200 or CAMO.A.200 and the four components and twelve elements of Doc 9859, producing a prioritised action plan.
- Documentation — drafting or revising the management system content of your exposition (MOE or CAME) and any safety management manual, in your organisation’s language and structure, not a template with the name changed.
- Hazard identification and risk management — a working hazard register seeded from your own data (occurrence reports, audit findings, reliability data), a defined risk assessment method, and a functioning internal safety reporting scheme meeting 145.A.202.
- Interfaces — integration of safety assurance with your compliance monitoring function under 145.A.200, and control of contracted and subcontracted work under 145.A.205.
- Training and promotion — safety training matched to roles, from the accountable manager down, and a communication plan the organisation can sustain itself.
Post-implementation support — defined availability through your first authority audit cycle of the new system, with an explicit end point.
Cultural fit and knowledge transfer
An SMS lives or dies on whether your people use it. The consultant will leave; the reporting culture, the risk register discipline and the management review rhythm must stay. Weigh how the consultant proposes to work: with your staff or instead of them, in workshops that surface your organisation’s real hazards or in presentations of generic ones.
Insist on named involvement of your safety manager — the person responsible for the safety management processes under 145.A.30(ca). That person is nominated by the organisation and accepted by the competent authority, and may be an employee or a contracted specialist; what matters is that they can allocate sufficient time to the function and report directly to the accountable manager. The same attention applies to your compliance monitoring manager, whose function under 145.A.200 replaced the former quality system. The interaction between those two roles is where integrated management systems succeed or fail, and it cannot be designed without both of them at the table.
Ask each candidate one deliberately open question: “What will our people be able to do without you when you leave?” The quality of that answer — specific roles, specific capabilities, a specific date — tells you more than any brochure. If the proposal does not put your postholders at the centre, the system being built is not yours.
Comparing proposals and pricing structures
SMS consultancy is priced in several common structures: fixed price against defined deliverables, day-rate support, retainers for ongoing availability, and packaged products such as manual templates with adaptation workshops. No official source publishes benchmark costs for this work, and any article quoting typical figures is guessing — so compare structures, not numbers. A fixed price against the deliverables listed above is the easiest to govern; a day rate rewards efficiency only if you actively manage the backlog; a retainer makes sense mainly after implementation, through the first audit cycle.
Whatever the structure, tie payment milestones to regulatory substance: gap analysis accepted, exposition amendment submitted, reporting scheme live and receiving reports, training delivered and recorded. Milestones defined by documents produced rather than capability demonstrated are how organisations end up compliant on paper and exposed in practice.
Red flags
- Guaranteed approval. No consultant controls your competent authority’s decision. Treat any promise of approval as disqualifying.
- Template-only delivery. Doc 9859’s tailoring requirement is the test; a manual that could be sold unchanged to your competitor fails it — and experienced inspectors recognise recycled documentation quickly.
- No demand on your time. An engagement that requires nothing from your staff is building shelf-ware, not a management system.
- Vague deliverables. “SMS support” without named documents, registers, training events and an end state cannot be evaluated or enforced.
- No exit plan. If ongoing dependence on the consultant is built into the design, knowledge transfer was never the goal.
A practical evaluation checklist
Score each candidate against these questions before you commit:
- Which EASA continuing airworthiness amendments has the consultant implemented, and for organisations of what size and scope?
- Can they name the four components and twelve elements of Doc 9859 and show where each lands in your MOE or CAME?
- Will the gap analysis be mapped against 145.A.200 / CAMO.A.200 point by point, with a prioritised action plan as a deliverable?
- How will your safety manager and compliance monitoring manager be involved in building the system?
- What exactly is delivered, by when, and what happens at your first authority audit after implementation?
- What does knowledge transfer look like — and when does the engagement end?
A consultant who welcomes these questions is usually one worth shortlisting. One who deflects them has answered them anyway.
Closing
External support can compress an SMS implementation and spare you expensive false starts — but the regulation is addressed to you, not to your adviser. Choose a consultant the way your authority will later audit your system: against 145.A.200, against Annex 19 and Doc 9859, and against the simple question of whether the organisation left behind is safer and more capable than the one they found.
