Canadian Aviation Regulations — 604.206
604.206 (1) The quality assurance program shall make provision for sampling the private operator’s processes in order to measure (a) the private operator’s effectiveness in conducting an audit under subsection (2); and (b) the private operator’s ability to carry out its activities effectively and safely. (2) An audit required by the quality assurance program shall be conducted (a) within 12 months after the day on which the private operator registration document was issued; (b) subject to paragraph (c), within 12 months after the day on which the previous audit was completed; (c) within 36 months after the day on which the previous audit was completed, if (i) the private operator submits to the Minister a risk assessment establishing that the private operator is capable of managing the aviation-safety-related risks that may occur during that 36-month period, and (ii) none of the following events have occurred since the day on which the previous audit was completed: (A) a major incident, (B) a major change in the private operator’s activities, and (C) a finding resulting from a review of the safety management system and indicating that the quality assurance program is not achieving its objectives; (d) following an accident, or incident, that affects aviation safety; and (e) following the identification, as a result of a review of the safety management system, of a deficiency that reduces the effectiveness of all or part of the safety management system. (3) A quality assurance program shall include (a) checklists of all of the activities carried out by the private operator; (b) procedures for determining what corrective actions are necessary to eliminate the root cause and contributing factors of each finding of non-compliance with these Regulations; (c) procedures for monitoring corrective actions to ensure that they are effective; (d) a system for recording the following information: (i) the findings resulting from an audit, and any supporting documentation, (ii) an analysis of the root cause and contributing factors of any deficiency identified by the quality assurance program, (iii) any corrective action, and (iv) any follow-up action; and (e) procedures for ensuring that each finding resulting from an audit is communicated to the operations manager and to any person who has been assigned management functions respecting the safety management system, and is made available to the private operator. (4) An audit conducted under paragraph (2)(d) or (e) shall be a complete audit. (5) No private operator shall assign a duty relating to the quality assurance program to a person who is responsible for carrying out a task or an activity evaluated by that program unless (a) owing to the size, nature and complexity of the private operator’s operations and activities, it is impractical to assign the duty to a person who is not responsible for carrying out the task or activity; (b) based on a risk analysis, assigning the duty to a person responsible for carrying out the task or activity will not result in an increased risk to aviation safety; and (c) the operation of the audit system in relation to the quality assurance program will not be compromised. SOR/2014-131, s. 18