The Civil Aviation Safety Authority’s procedures and guidance for scoping an audit included several important aspects, but it did not formally include the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.
The ATSB is satisfied that CASA has undertaken action to address this issue since November 2009.
In August 2017 (after receiving the draft ATSB report for the reopened investigation), CASA advised the ATSB:
CASA implemented a national approach to surveillance in 2012 with the introduction of the CASA Surveillance Framework which is documented in the CASA Surveillance Manual (CSM). The CSM identifies possible systems and system elements for holders of each authorisation type, and necessitates that those elements relevant to a particular authorisation holder are identified when preparing for a surveillance event—including noting areas of potential system vulnerability.
In the preparation process, inspectors are required to review a range of information—including the authorisation holder's policy and procedures manuals—and identify specific areas and risks to be assessed or reviewed. The information, data and history known about the authorisation holder assists in determining the scope and depth of each surveillance event.
CASA has developed safety risk profiles for a number of sectors of the aviation industry, and is continuing to develop safety risk profiles for the remaining sectors. These sector safety risk profiles enable a shared understanding between CASA and industry of hazards that sector participants must address in order to manage their risks and enhance safety outcomes for the sector. CASA is working to enhance the use of sector safety risk data to inform the scoping of surveillance activities.
CASA is currently developing and implementing a National Surveillance Selection Process (NSSP), which will be an enhanced systematic approach to the prioritisation of CASA's surveillance activities. This will include improved authorisation holder risk and performance profile capabilities, including integration of relevant sector information. The NSSP is expected to be fully deployed by June 2018.
The ATSB notes the surveillance planning and scoping form provided by CASA to its inspectors is still the same as the form used from 2004–2009, and this form does not refer to the nature of the operator’s activities, the inherent threats or hazards associated with those activities, and the risk controls that were important for managing those threats or hazards.
Nevertheless, the ATSB acknowledges CASA’s surveillance processes have undergone significant evolution since 2009, and that it is continuing to review and develop its surveillance processes. It should also be noted that the ATSB will review CASA’s oversight processes since the introduction of the CSM in 2012 during the course of other investigations, including investigation AI-2017-100 (Case study: implementation and oversight of an airline's safety management system during rapid expansion).
