IOSA Q5AIMS Auditee Manual. Effective June nd. Edition

IOSA Q5AIMS Auditee Manual Effective June 2013 2nd Edition

IOSA Q5AIMS 2nd Edition 2013

IOSA Q5AIMS Auditee Manual Effective June 2013 International Air Transport Association Montreal Geneva 2nd Edition

NOTICE DISCLAIMER. The information contained in this publication is subject to constant review in the light of changing government requirements and regulations. No subscriber or other reader should act on the basis of any such information without referring to applicable laws and regulations and/or without taking appropriate professional advice. Although every effort has been made to ensure accuracy, the International Air Transport Association shall not be held responsible for any loss or damage caused by errors, omissions, misprints or misinterpretation of the contents hereof. Furthermore, the International Air Transport Association expressly disclaims any and all liability to any person or entity, whether a purchaser of this publication or not, in respect of anything done or omitted, and the consequences of anything done or omitted, by any such person or entity in reliance on the contents of this publication. International Air Transport Association. All Rights Reserved. No part of this publication may be reproduced, recast, reformatted or transmitted in any form by any means, electronic or mechanical, including photocopying, recording or any information storage and retrieval system, without the prior written permission from: Senior Vice President Safety, Operations and Infrastructure International Air Transport Association 800 Place Victoria P.O. Box 113 Montreal, Quebec CANADA H4Z 1M1 IOSA Q5AIMS Auditee Manual ISBN 978-92-9252-224-7 2013 International Air Transport Association. All rights reserved. Montreal Geneva

TABLE OF CONTENTS Table of Contents 1 INTRODUCTION... 3 1.1 IOSA Commitment to Quality... 3 1.2 Corrective Action Process... 4 2 ACCESSING THE SYSTEM... 5 3 ACCESSING THE CORRECTIVE ACTION RECORDS (CAR)... 7 4 EDITING CORRECTIVE ACTION RECORDS... 10 4.1 Initiating Info Tab... 11 4.2 Root Cause Tab... 12 4.3 Interim Action Tab... 13 4.4 Final Action Tab... 14 4.4.1 Part 1 - Final Action Required Section... 15 4.4.2 Part 2 Final Action Taken Section... 16 4.4.3 Observations Which Will Not be Actioned by the Auditee... 17 4.5 Review / Close Tabs... 19 4.6 Docs Tab... 19 5 REQUIREMENTS FOR ROOT CAUSES CORRECTIVE ACTIONS... 20 5.1 Root Cause Analysis... 20 Root Cause Analysis:... 20 5.2 Final Action Required... 20 5.3 Final Action Taken... 21 6 EXAMPLES OF ROOT CAUSES AND CORRECTIVE ACTIONS... 22 IOSA Q5AIMS Auditee Manual_Ed 2 1 June 2013

IOSA Q5 Auditee Manual Record of revisions Edition number Issue date Effective date First Edition February 2010 February 2010 Second Edition June 2013 June 2013 IOSA Q5AIMS Auditee Manual_Ed 2 2 June 2013

INTRODUCTION 1 Introduction The aim of this user manual is to provide procedures and guidance to assist airlines in processing IOSA corrective actions, to support the program objective of providing acceptable quality and value in IOSA reports. The manual contains procedures for using the Q5AIMS electronic audit tool, as well as minimum requirements for the documenting of corrective actions by the Auditee. Numerous examples of root causes, final actions required and final actions taken are also included. This manual is primarily for the use of the Auditee coordinator during audit follow-up, but should also be distributed to any Heads of Departments who will be providing corrective actions descriptions to the Audit Organizations (AO). 1.1 IOSA Commitment to Quality The detail, accuracy and clarity of the corrective actions records for IOSA Findings and Observations is key to providing a clear record of how the airline permanently corrected any audit nonconformities. IATA receives an average of two to three review requests per report, so it is important to keep in mind that IOSA reports will be regularly reviewed by industry reviewers worldwide. To maintain this valuable flow of information to the industry, the Quality Assurance Departments of both the AOs and IATA are committed to ensuring a consistent level of detail, accuracy and clarity for all information in IOSA reports. IOSA Q5AIMS Auditee Manual_Ed 2 3 June 2013

IOSA Q5 Auditee Manual 1.2 Corrective Action Process The general corrective action process for closing Findings and/or Observations is set out below. Each AO may have additional procedures that they will require the Auditee to follow: a. A root cause and corrective action plan must be recorded for each Finding or Observation. The Root Cause, Final Action Required and Date Due fields of the Corrective Action Plans (CAP) in Q5AIMS must be completed and accepted by the AO within 45 calendar days of the Closing Meeting. b. After the CAPs have been accepted by the AO, the Corrective Action for each Finding (and Observation (when applicable) must be implemented by the Auditee, in accordance with the CAP within the required timelines. c. During the corrective action process, the status of corrective actions should be regularly reported to the AO. d. The AO must be notified as soon as the corrective actions for each Finding and/or Observation (when applicable) are completed. Evidence of corrective action implementation must be provided to the AO. e. The AO will review the evidence and either: i. Notify the Auditee that the corrective actions have been accepted, and the Finding or Observations are closed, or ii. Advise that further action is required. Note: Detailed descriptions of how to access the Q5AIMS database and the type of information to be entered in each section are provided on the following pages. IOSA Q5AIMS Auditee Manual_Ed 2 4 June 2013

ACCESSING THE SYSTEM 2 Accessing the System To gain access to the Q5AIMS server, any computer with an internet connection can be used. No additional software or components are required, as the system is accessed through a web browser (Internet Explorer, Firefox, Google Chrome). All post audit activities are tracked and recorded using the Q5AIMS server. The information entered is immediately available to anyone involved in the follow up process that has the username and password. a) To access the system go to: http://www.q5iata.com b) The browser will connect to the Q5AIMS server and request the username and password. c) Enter the username and password that have been provided by the AO and click Sign In. If the username and password are correct, the list of all Corrective Action Records (CARs) associated with the Auditee will appear. If the username and/or password are incorrect, the system will deny entry and the login screen will re-appear, for re-entry of the information. Please contact your AO to have the username and/or the password verified. IOSA Q5AIMS Auditee Manual_Ed 2 5 June 2013

IOSA Q5 Auditee Manual Note: When the user logs in the application for the first time, the home page will be set to display MY Q5 module by default. The MY Q5 module can be turned on or off under the settings module. This can be accessed through the Settings tab and then selecting User Settings. If MY Q5 is turned off, the screen below will appear. IOSA Q5AIMS Auditee Manual_Ed 2 6 June 2013

ACCESSING THE CORRECTIVE ACTIONS RECORDS (CAR) 3 Accessing the Corrective Action Records (CAR) The submenu contains two tabs titled CARS and Custom. The CARS tab lists all Findings and Observations associated with the Auditee. There are two (2) ways to access the CARs: I. From the home page, if My Q5 is ON, a) Each Finding or Observation can be accessed by clicking on the CAR ID. If at any time, the Auditee is unsure where he/she is in the system or how to continue, the Home tab should be clicked in order to return to the main menu. If there are several pages of CARs, click on the page number at the top of the list to move to the required page. b) Once the ID number of the CAR is selected, the system will open up the CAR, as per the example below. IOSA Q5AIMS Auditee Manual_Ed 2 7 June 2013

IOSA Q5 Auditee Manual II. From the Actions tab, a. On the main menu, move the mouse pointer over the Actions tab and a sub-menu will open up. b. From the choices that are presented, select Find/Edit Corrective Action. c. The system will display a documentation tree and the audit ID as shown by the Auditee s three-letter ICAO designator should be chosen. d. Once the audit ID is selected, the following page will appear: IOSA Q5AIMS Auditee Manual_Ed 2 8 June 2013

ACCESSING THE CORRECTIVE ACTION RECORDS (CAR) f. The All and All option buttons at the top of the page are already preselected. g. To see a list of all CARs, click on Find Corrective Action in the bottom left corner. h. To view individual CARs, define the search criteria by selecting the Dates, Assigned To, Initiated By and Type, as appropriate. i. The list of CARs will appear and each corrective action can be accessed by clicking anywhere in the row of a CAR. IOSA Q5AIMS Auditee Manual_Ed 2 9 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) 4 Editing Corrective Action Records The CAR contains the relevant information for each Finding or Observation and is divided into seven sections represented by the seven tabs as seen on the webpage: Initiating Info Root Cause Interim Action Final Action Review Close Docs The Auditee ONLY completes the two sections in bold font above. These two sections will be individually addressed in the following chapters. Saving and/or Resetting the information that has been entered. At the bottom of the CAR record, the three of the four buttons as seen below are used to save or reset information that has been entered. If changes have been made but are not to be kept, click on Reset. To go back to the list of CARs, click on Back. To save changes, click on Save. Note: The Escalation Notification button is not currently used. IOSA Q5AIMS Auditee Manual_Ed 2 10 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) 4.1 Initiating Info Tab The Initiating Info section contains general information on the non-conformity such as type, level, who initiated it and the original auditor comment from the checklist. This section is read-only and no modifications can or need to be made. The information is completed by the Lead Auditor. IOSA Q5AIMS Auditee Manual_Ed 2 11 June 2013

IOSA Q5 Auditee Manual 4.2 Root Cause Tab The Root Cause Analysis section must be completed by the Auditee for each Finding or Observation, regardless of whether corrective action is being taken. This information is vital to assist the Auditee in identifying the background reasons for the lack of a process, procedure, etc. It is also important for long-term analysis (after de-identification) of IOSA Program trends. In this section, only the following field must be completed: Root Cause Analysis The Assigned To name or the Date Due field does not need to be completed. The auditor s description of the non-conformity must not be repeated in the Root Cause Analysis. The description of the planned corrective action must not be in the Root Cause Analysis. See Section 5.1 for requirements applicable to the Root Cause Analysis. See Section 6 for examples of suitable text for Root Cause Analysis. IOSA Q5AIMS Auditee Manual_Ed 2 12 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) 4.3 Interim Action Tab The interim corrective action option is seldom used and requires prior approval from IATA. This option, applicable only to renewal audits, requires approval from IATA and is for unconventional or exceptional situations, normally beyond the control of the Operator, which would delay the implementation of permanent corrective action(s) to close a Finding. It is important that any interim corrective action accepted by the AO clearly confirms satisfactory resolution of the non-conformity on a temporary basis, including meeting the documented and implemented requirement, despite the fact that the resolution of the Finding is temporary. IOSA Q5AIMS Auditee Manual_Ed 2 13 June 2013

IOSA Q5 Auditee Manual 4.4 Final Action Tab In the Final Action section the Auditee has to provide two important pieces of information: 1. A description of the planned action to permanently correct the Finding or Observation (corrective action plan). 2. A description of the action which was taken to correct the Finding or Observation (where applicable) (final corrective action). The tab is divided into two sections to represent these two steps: 1. The corrective action plan is completed in the Final Action Required field. 2. The final corrective action is completed in the Final Action Taken field. Note: It is important not to complete the Final Action Taken section, until the proposed action contained in the Final Action Required has been accepted by the AO. The Email CC Address field is optional. Note: If the non-conformity is an Observation and the Auditee chooses not to take corrective action, the procedures in Section 4.4.3 of this manual must be followed. IOSA Q5AIMS Auditee Manual_Ed 2 14 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) 4.4.1 Part 1 - Final Action Required Section The Final Action Required is used for recording the planned corrective action by the Auditee. The following is to be completed: - Under Date Due, select the date by which the action is planned to be completed. This date is for planning only. Under Final Action Required, describe what action is planned to correct the non-conformity. This information should be completed as soon as possible after the audit, to facilitate the submission to the AO and to ensure process to review and reach agreement with the Operator on an acceptable CAP is available within forty-five (45) calendar days following the on-site closing meeting. Note: Both the Date Due and Final Action Required fields are mandatory and must be completed. The description of the planned action must be written in the future tense. See Section 5.2 for requirements applicable to Final Action Required. See Section 6 for examples of suitable text for Final Action Required. Do not proceed to Part 2 unless the AO has accepted the Final Action Required in Part 1. IOSA Q5AIMS Auditee Manual_Ed 2 15 June 2013

IOSA Q5 Auditee Manual 4.4.2 Part 2 Final Action Taken Section The Final Action Taken must contain a detailed description of the corrective actions carried out to permanently rectify the Finding or Observation. The following must be completed: Note: - Under Completed/Submitted by, select the Auditee Representative who has submitted the evidence. - Under Date Completed/Submitted, select the date on which all steps to correct the Finding or Observation were completed. - Under Final Action Taken, describe the actions which have been taken, including the updating of manuals and documentation (revision and/or date). Local and regional abbreviations and acronyms, while familiar to the Auditee, must be spelled out, to ensure a clear understanding by reviewers of the report worldwide. The Completed/Submitted by, Date Completed/Submitted, and Final Action Taken fields are mandatory and must be completed. Descriptions of the corrective action must be written in past tense and sentences similar to see document attached must not be used as it adds no value to the corrective action. The final report will not contain any kind of attachment and no attachments will be reviewed by any third party reader. An accurate description of the corrective action must be used instead. - When the final action is complete, the checkbox Change Status to Completed/Submitted automatically gets selected. The system will automatically complete the details section with the name of the user who is currently logged in, as well as the current date. The name and date can then be adjusted if necessary. The date must correspond to the date on which the corrective action was implemented. Note: Once the Change status to Completed/Submitted box is ticked, changes cannot be made unless it is deselected and saved again. See Section 5.3 for requirements applicable to Final Action Taken. IOSA Q5AIMS Auditee Manual_Ed 2 16 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) See Section 6 for examples of suitable text for Final Action Taken. 4.4.3 Observations Which Will Not be Actioned by the Auditee For Observations, the Auditee has the option of taking no corrective action, or of beginning corrective actions, but not completing them before the audit is closed. In either case, the following applies. Note: The Root Cause must always be completed, whether or not the observation is corrected by the Auditee. 4.4.3.1 If no corrective action is taken at all, the following must still be completed: - The Date Due field should be left blank, as there will be no corrective action. - The phrase, No corrective action. must be inserted into the Final Action Required field. - The phrase No final corrective action must be inserted into the Final Action Taken field. - Click on Save. The Change Status to Completed/Submitted box is automatically selected. IOSA Q5AIMS Auditee Manual_Ed 2 17 June 2013

IOSA Q5 Auditee Manual 4.4.3.2 If corrective action is taken, but not completed before audit closure, then complete the following: - The Due Date field should be left blank, as the correction will not be completed before audit closure. - Complete the planned corrective action, to reflect what is planned in the Final Action Required field. - Insert the phrase, No final corrective action in the Final Action Taken field. - Click on Save. The Change Status to Completed/Submitted box is automatically selected. Note: This situation would arise when an Auditee wanted a record of the corrective actions taken, even though these corrective actions were not completed before audit closure. IOSA Q5AIMS Auditee Manual_Ed 2 18 June 2013

EDITING CORRECTIVE ACTION RECORDS (CAR) 4.5 Review / Close Tabs 4.6 Docs Tab The Review and Close sections are completed by the AO. These sections are used to indicate what evidence has been reviewed in order to close the Finding or Observation. If a CAR has been reviewed or closed, changes to the information inserted on the Final Action section can no longer be made. If any update is required for a CAR that has been reviewed, the AO who closed the CAR must be contacted for authorization to make any amendments to the CAR. The Docs tab can be used to attach documents related to each specific CAR. To attach a document to a corrective action, the following must be completed: - Select Docs tab - Select Add Docs - Browse to locate the file - Save the document Note: Even though documents can be attached to a specific CAR, statements such as see document attached must not be used in the Final Action Taken Section, as the Final Audit Report does not include any supporting documents. IOSA Q5AIMS Auditee Manual_Ed 2 19 June 2013

IOSA Q5 Auditee Manual 5 Requirements for Root Causes Corrective Actions The closing of Findings and Observations after the audit will be quicker and easier if the requirements below are followed, to facilitate the assessment and verification of corrective actions by the AO, as well as satisfying AO and IATA QC requirements. 5.1 Root Cause Analysis The reason(s) for the lack of any particular policy, process, procedure, etc. must be analyzed and a description provided to the AO. This information should provide broader background information on why the policy, process, procedure, etc. was not in place. It is also important for long-term analysis (after de-identification) of IOSA Program trends. When completing a Root Cause Analysis (RC), the following rules shall be followed Root Cause Analysis: 1 The RC must be completed for all CARs, even if no corrective action is taken. 2 The auditee should provide an analysis of the situation, as a factual, objective statement why the IOSA policy, procedure, function, etc.., was not active. 3 Standard, generalized phrases or brief statements such as ISARP not considered do not provide an appropriate reason for why the Operator had not incorporated the provision. 4 The RC must not be a copy paste or an extract of the Finding and/or Observation 5 The RC must not contradict the reasoning and evidence recorded in the Finding and/or Observation, or contradict any other assessment information in the CAR. 5.2 Final Action Required When completing the Final Action Required (FAR) section, the following rules shall be followed The FAR must contain: 1 A brief description of the changes planned to correct the Finding or Observation. It must be written in the future tense. 2 Changes planned for documentary structures/manuals and if available, references for the planned revisions and/or amendments. 3 For assessments of not implemented, a description of how the changes will be implemented is required. 4 Estimated Date(s) of when the corrective action(s) is expected to be implemented. Note: The Estimated Date is Date Due in the Final Action tab. This date should be completed when a corrective action is to be taken, otherwise, it remains blank. IOSA Q5AIMS Auditee Manual_Ed 2 20 June 2013

REQUIREMENTS FOR CORRECTIVE ACTIONS 5.3 Final Action Taken When completing the Final Action Taken (FAT) section, the following rules shall be followed, FAT must contain: 1 A description of the corrective actions taken to close the Finding or Observation. The FAT must address: a. the elements of ISARP which resulted in the nonconformity; b. the original non-conformity, as recorded in by the auditor; c. the Root Cause The corrective actions must describe how the documentation and implementation deficiencies (changes to documentation, operational structures, programs, processes, procedures, etc. including action taken to address the gap in the implementation) were addressed, to close the Finding and/or Observation permanently. 2 As completed actions, they must be written in the past tense. 3 Documentation deficiencies: a. Changes made to controlled documentation must include manual names or acronyms, revision/amendment references and/or dates, as available. b. Dates of documentation cannot be after the Date Implemented or after the CAR audit closure date. c. Brief descriptions of the kind of changes made to documentation. Copy pasting of individual processes, procedures etc. from the Operator documentation must not be included. d. Distribution and receipt of documentation to all affected parties must be provided. 4 Implementation deficiencies: details of how deficiencies were corrected and implemented, shall include: a. Traceable evidence of implementation, e.g. records, reports, audit, training dates, schedules, rosters, meeting minutes, management reviews, analysis, etc, including applicable dates, revisions, locations, names and any other associated information. b. Detailed descriptions of how applicable corrective actions were implemented. c. Distribution of revisions to documentation is seldom sufficient to confirm implementation. If the deficiency concerned staff or crew training, details must be provided on how and when training had begun for the staff or crew. d. There are situations when corrective actions cannot commence or be completed before audit closure deadlines, for example, implementing initial training when there is no new staff to train, or when there is insufficient data available to implement review or analysis programs. e. In such cases, the Auditee must provide the reasons why actual implementation could not be confirmed, as well as all actions taken to ensure implementation when possible. 5 The corrective action cannot contradict the reasoning provided for the RC analysis. 6 The Completed/Submitted By field must contain the Auditee Representative name and the Date Implemented must contain the appropriate date. The Date Implemented cannot be after the Review Date, or after the CAR or audit closure date(s). IOSA Q5AIMS Auditee Manual_Ed 2 21 June 2013

EXAMPLES OF ROOT CAUSES AND CORRECTIVE ACTIONS 6 Examples of Root Causes and Corrective Actions The examples below contain: Typical Root Cause Analysis; The type of descriptions that are needed for evidence of corrective actions; Descriptions and references of the amendments/revisions to manuals and documentation; Descriptions of how corrective actions were implemented. Example 1: Finding: Senior management reviews of issues arising from the quality assurance program were taking place, but the review process was not documented. Root Cause Analysis: Senior management reviews had only been taking place when significant quality assurance issues were identified. The need for formalizing a regular management review process had not been identified. Final Action Required: A process for senior management reviews of significant issues arising from the quality assurance program will be documented in the OMA 1.3 as Rev 5. The review process will be incorporated in the Quality Management review agenda planned for Aug 12. Final Action Taken: A formal process for senior management reviews of significant issues arising from the quality assurance program has been documented in the OMA 1.3 as Rev 5, dated 08 Jul 2012. The review process has also been incorporated in the Senior Management Review meeting agenda, scheduled for 04 Aug 2012. Agenda reference: SM/08/12. Example 2: Finding: Recurrent training for operations personnel was taking place, but the process, syllabus and frequency of training were not documented. Root Cause Analysis: The annual recurrent training program for operations personnel had been presented by two experienced instructors for many years and the need to formally document the syllabus and annual training program had not been identified. Final Action Required: The annual recurrent training program for operations personnel will be incorporated in the Operations Manual, chapter 12.4, as Rev 12. OM Revision 12 and the revised Training Program, which includes the syllabus and frequency of recurrent training, will be distributed to all applicable staff when approved. Final Action Taken: The annual recurrent training program for operations personnel has been approved and documented in the Operations Manual, chapter 12.4, as Rev 12, dated 25 Oct 2012. OM Revision 12 and the revised Training Program, which includes the syllabus and frequency of recurrent training, were distributed to all applicable staff on 30 Oct 2012 and were used for the recurrent training course on the 15 Nov 2012. IOSA Q5AIMS Auditee Manual_Ed 2 22 June 2013

EXAMPLES OF ROOT CAUSES AND CORRECTIVE ACTIONS Example 3: Finding: Flight deck crews were aware of the procedure to check navigation accuracy both after prolonged in-flight operations and prior to an approach, but the procedures for performing the check before commencing the approach were not documented. Root Cause Analysis: Due to an oversight, procedures and limits for checking navigation accuracy prior to an approach had not been published in the FOM. Final Action Required: Procedures and limits for checking navigation accuracy prior to an approach will be included in the existing procedures for the navigation accuracy check after prolonged in-flight operation. The new procedures will be issued as Amendment 23 of the FOM and as a Flight Operations notice to all crews. Final Action Taken: Procedures and limits for checking navigation accuracy prior to an approach have been added to the existing procedures for the navigation accuracy check after prolonged in-flight operation. The new procedures were issued as Amendment 23 of the FOM and also issued as a Flight Operations notice to all crews on 14 Apr 2013. Example 4: Finding: The process for the investigation of aircraft accidents and incidents and the reporting of any events in accordance with requirements of the State was documented, but a recent incident had not been reported as per State requirements. Root Cause Analysis: The Safety Manager was away on an assignment when the incident took place and had not specifically appointed an individual to cover all duties and obligations, specifically the requirement for the reporting of accidents and incidents to the State. It has been decided that all key managerial responsibilities will be reviewed as a result of this. Final Action Required: Responsibilities for the reporting of accidents and incidents have been reviewed and a deputy will be appointed for the Safety Manager, to ensure complete coverage of all Safety Manager duties, specifically the requirement for the reporting of accidents and incidents to the State. This managerial appointment will be included in the Corporate Manual as amendment 2a. Final Action Taken: Responsibilities for the reporting of accidents and incidents were reviewed and a deputy was appointed for the Safety Manager, to ensure complete coverage of all Safety Manager duties, including the requirement for the reporting of accidents and incidents to the State. The appointment of the deputy was documented in the Corporate Manual as Amendment 2a, dated 05 Mar 13 IOSA Q5AIMS Auditee Manual_Ed 2 23 June 2013

IOSA Q5 Auditee Manual Example 5: Finding: Flight deck crews were not performing stabilized approaches and there were no documented procedures for such approaches. Root Cause Analysis: Stabilized approach procedures were not a specified requirement by the Civil Aviation Authority and the Flight Operations Department had not developed the procedure for our crews. Final Action Required: Procedures for Stabilized approaches will be published in OMA 8, 8.3 as Revision 23. Crews completing the recurrent training from Feb 2013 onwards will be trained and tested in the new procedure for stabilized approaches. Final Action Taken: Procedures and limits for Stabilized approaches have been published in the OMA 8, 8.3 as Revision 23, dated 18 Jan 2013. OMA Revision 23 was distributed to all aircrew and the Crew Training Department. All crews completed the recurrent training between Jan and Feb 2013 and were trained and tested for stabilized approaches. All operating crews are required to confirm receipt of the new procedure when signing on for flights. Example 6: Finding: Responsibilities for the management and control of security documentation had not been documented. Root Cause Analysis: The Security structure and documentation was developed by the Security Director, but the need to formalize responsibilities for these functions had not been recognized. Final Action Required: Responsibility for the management and control of security documentation by the Security Director will be included in the Security Manual, section 1, as Revision 4B and distributed against signature to all relevant security staff on 10 Nov 2012. Final Action Taken: Responsibility for the management and control of security documentation by the Security Director were included in the Security Manual (SM), section 1, as Revision 4B and distributed against signature to all relevant security staff on 10 Nov 2012. IOSA Q5AIMS Auditee Manual_Ed 2 24 June 2013

Printed in Canada ISBN 978-92-9252-224-7