Independent Management System Audits for CAMO and Part-145 Organisations in Malta

George Spiteri
Independent Management System Audits for CAMO and Part-145 Organisations in Malta

An independent Management System audit is an objective, arm’s-length review of how your CAMO or Part-145 organisation actually meets its EASA obligations — carried out by qualified auditors who hold no responsibility for the functions, procedures or products being checked. For Malta-based continuing airworthiness and maintenance organisations this is more than good practice: the independence of the compliance monitoring function is a regulatory expectation under EASA Part-CAMO and Part-145. [Organisation Name] delivers independent Management System audits across Malta, performed by experienced aviation auditors — including IOSA-qualified professionals — so you can demonstrate compliance to the Civil Aviation Directorate (Transport Malta) with confidence.

 

What is an independent Management System audit?

An independent Management System audit is a structured, evidence-based assessment of your organisation’s management system — covering compliance monitoring, safety management, your exposition, procedures and records — performed by people who are demonstrably independent of the areas under review. Under EASA rules, “independent” has a precise meaning: audits and inspections must be carried out by personnel who are not responsible for the functions, procedures or products being audited. Put simply, a team cannot objectively audit its own work, and the compliance monitoring function itself must also be subject to independent monitoring.

 

Why CAMO and Part-145 organisations in Malta need one

Every CAMO and Part-145 organisation must operate a management system. For continuing airworthiness organisations this sits under CAMO.A.200; for maintenance organisations, the management system and safety management requirements were introduced into Part-145 by Commission Implementing Regulation (EU) 2021/1963, applicable from 2 December 2022, with transition findings to be closed by 2 December 2024. The Part-145 management system (145.A.200) closely mirrors CAMO.A.200, so the same independence principles apply across both.

The compliance monitoring function provides an independent check on how your organisation meets its requirements — and it cannot audit itself. EASA accepts three ways to satisfy this: using competent personnel from a different department who are not responsible for compliance monitoring; contracting the independent audit element to an external organisation or a qualified competent person; or certification against an internationally recognised standard. For many Malta organisations — especially smaller CAMOs and maintenance organisations where one person holds several roles — an external independent auditor is the cleanest and most defensible option. Whichever route you take, the method must be described in your CAME or MOE and accepted by the Civil Aviation Directorate.

 

What our independent audit covers

We build the audit programme around your approval scope and EASA’s audit-planning expectations, so every aspect of compliance is verified across the cycle. A typical engagement covers:

  • Compliance monitoring programme, audit plan and findings management — including audit of the compliance monitoring function itself
  • Safety management: hazard identification, risk management, safety reporting and the just-culture framework
  • Your CAME or MOE and associated procedures, checked for currency and adherence
  • Contracted and subcontracted activities, including the maintenance you receive
  • Product sampling — the end result of the process — with unannounced audits where Part-145 activities warrant them
  • Records, personnel competence and continuing-airworthiness deliverables

Each audit produces a clear report describing what was checked and any non-compliance findings against the applicable requirements, with practical, prioritised corrective actions.

 

Why IOSA-qualified auditors make the difference

IOSA — the IATA Operational Safety Audit — is the global benchmark for operational safety auditing, built on standards drawn from ICAO, EASA and FAA requirements and industry best practice. IOSA is an airline programme, but an IOSA-qualified auditor has been trained and assessed against a demanding international standard in audit methodology, evidence-gathering and management-system evaluation. That discipline transfers directly to CAMO and Part-145 work: you receive rigorous, consistent, internationally benchmarked auditing rather than a tick-box exercise. Our team brings this competence to every independent Management System audit we conduct in Malta.

 

The benefits for your organisation

A well-run independent audit does far more than satisfy the regulator. It surfaces risks before they become findings, sharpens your procedures, reassures your accountable manager and your clients, and strengthens your position at oversight audits and approval renewals. For organisations on Malta’s fast-growing 9H register, credible independent assurance is also a competitive signal to lessors, operators and partners.

 

Contact us we would like to help!

 

Ing. George Spiteri

Email: george.spiteri@aviathrust.com

Mob: +356 99972206

Frequently asked questions

Is an external independent auditor allowed under EASA?

Yes. EASA expressly permits contracting the independent audit element of the compliance monitoring function to another organisation or a qualified competent person. The arrangement must be described in your CAME or MOE and accepted by the Civil Aviation Directorate.

Can small organisations outsource compliance monitoring?

Yes. Both the Part-CAMO and Part-145 frameworks recognise that smaller organisations may outsource compliance monitoring functions, and larger organisations may also use external auditors from time to time to preserve independence and capacity.

How often is an independent audit required?

Your audit plan should ensure that all aspects of compliance are verified every year, including subcontracted activities. Where there are no safety-related findings, the planning cycle may be extended, subject to a risk assessment and the agreement of the Civil Aviation Directorate.

Do external Management System auditors have to be IOSA-qualified and trained?

Yes, in the case that matters most for airlines. If your airline is IOSA-registered, the internal audit conducted against the IOSA standards (the ISARPs) must be performed by IOSA-qualified and trained auditors, and that requirement still applies when you outsource it to an external provider. For EASA compliance monitoring under Part-CAMO, Part-145 and Part-ORO (Regulation (EU) 965/2012), the legal test is auditor competence and independence rather than an IOSA qualification as such, but IOSA-trained auditors raise the standard either way. Aviathrust's auditors are IOSA-qualified, so we can cover both.

Does Aviathrust also cover management systems under the Air Operations Regulation (EU) 965/2012?

Yes. Air operators (AOC holders) must run a management system with a compliance monitoring function under Part-ORO (ORO.GEN.200) of Regulation (EU) 965/2012, which mirrors the CAMO and Part-145 frameworks. Aviathrust provides independent Management System audits and compliance monitoring support for Air Operations too, so an operator running an AOC alongside a CAMO and a Part-145 organisation can cover all three under one consistent, independent audit programme.


Our Services