(20)

the following points 21.B.221 and 21.B.222 are added: ‘21.B.221 Oversight principles (a) The competent authority shall verify: 1. compliance with the requirements that are applicable to organisations, prior to issuing the production organisation approval certificate; 2. continued compliance with the applicable requirements of the organisations it has certified; 3. the implementation of appropriate safety measures mandated by the competent authority according to points 21.B.20(c) and (d). (b) This verification shall: 1. be supported by documentation specifically intended to provide personnel responsible for oversight with guidance to perform their functions; 2. provide the organisations concerned with the results of oversight activities; 3. be based on assessments, audits, inspections and, if needed, unannounced inspections; 4. provide the competent authority with the evidence needed in case further action is required, including the measures provided for in point 21.B.225. (c) The competent authority shall establish the scope of the oversight defined in points (a) and (b) taking into account the results of past oversight activities and the safety priorities. (d) If the facilities of an organisation are located in more than one State, the competent authority, as defined in point 21.1, may agree to have the oversight tasks performed by the competent authority(ies) of the Member State(s) where the facilities are located, or by the Agency for facilities that are located outside a territory for which Member States are responsible under the Chicago Convention. Any organisation that is subject to such an agreement shall be informed of its existence and of its scope. (e) For any oversight activities that are performed at facilities located in a Member State other than where the organisation has its principal place of business, the competent authority, as defined in point 21.1, shall inform the competent authority of that Member State before performing any on-site audit or inspection of the facilities. (f) The competent authority shall collect and process any information deemed necessary for performing oversight activities. 21.B.222 Oversight programme (a) The competent authority shall establish and maintain an oversight programme covering the oversight activities required by point 21.B.221(a). (b) The oversight programme shall take into account the specific nature of the organisation, the complexity of its activities, the results of past certification and/or oversight activities, and it shall be based on the assessment of the associated risks. It shall include, within each oversight planning cycle: 1. assessments, audits and inspections, including, as appropriate: (i) management system assessments and process audits; (ii) product audits of a relevant sample of the products, parts and appliances that are within the scope of the organisation; (iii) sampling of the work performed; and (iv) unannounced inspections; 2. meetings convened between the accountable manager and the competent authority to ensure that both parties remain informed of all significant issues. (c) The oversight planning cycle shall not exceed 24 months. (d) Notwithstanding point (c), the oversight planning cycle may be extended to 36 months if the competent authority has established that during the previous 24 months: 1. the organisation has demonstrated that it can effectively identify aviation safety hazards and manage the associated risks; 2. the organisation has continuously demonstrated compliance with points 21.A.147 and 21.A.148 and it has full control over all changes to the production management system; 3. no level 1 findings have been issued; 4. all corrective actions have been implemented within the time period that was accepted or extended by the competent authority as defined in point 21.B.225. Notwithstanding point (c), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions provided in points (1) to (4) above, the organisation has established, and the competent authority has approved, an effective continuous system for reporting to the competent authority on the safety performance and regulatory compliance of the organisation itself. (e) The oversight planning cycle may be reduced if there is evidence that the safety performance of the organisation has decreased. (f) The oversight programme shall include records of the dates when assessments, audits, inspections and meetings are due, and when assessments, audits, inspections and meetings have been effectively carried out. (g) At the completion of each oversight planning cycle, the competent authority shall issue a recommendation report on the continuation of the approval, reflecting the results of the oversight.’;