Risk-Based IOSA
IATA's tailored audit approach uses industry standards and operator-specific information to focus audit depth while retaining a baseline of conformity and assessing maturity.
Safety risk management × flight data
Move from counting events to managing operational risk.
Risk-based FDM links validated flight-data evidence to the operator's actual hazards, exposure, controls, decisions, and assurance cycle. It does not replace professional judgement, approved criteria, or the controlled IOSA documentation.
01Begin with the operational risk profile
02Translate each risk into measurable evidence
03Validate data and event logic
04Interpret frequency, exposure, and severity together
05Connect signals to barriers and decisions
06Verify whether action changed performance
ASIP Academy film · 7 minutes
Watch the method before exploring the evidence.
This visual lesson connects operational risk questions, validated flight-data evidence, safety barriers, ownership, and effectiveness assurance in one guided sequence.
Independent educational content based on public sources. Not operational guidance.01 · Essential distinction
Three related ideas—not one interchangeable requirement.
This distinction prevents audit language, programme design, and analytical event logic from being mixed together.
Risk-based FDM / FDAP
An operator links validated flight-data analysis to its actual hazards, exposure, risk controls, actions, and assurance cycle instead of relying only on a fixed catalogue of exceedances.
Event detection
A threshold, model, or pattern detector screens flights for review. It is evidence input—not a complete risk assessment, causal finding, compliance decision, or maintenance determination.
02 · Practical method
A six-stage path from risk question to assurance.
The sequence below is an ASIP educational synthesis of public ICAO, FAA, UK CAA, IATA, and EASA material—not a replacement for any organization's approved process.
- 01
Begin with the operational risk profile
Use the SMS hazard register, occurrence experience, audit findings, reports, operational change, and external safety intelligence to decide which questions deserve flight-data support.
- 02
Translate each risk into measurable evidence
Define the flight phase, aircraft population, usable signals, exposure measure, event logic, exclusions, and review question before producing a rate or dashboard.
- 03
Validate data and event logic
Confirm parameter mapping, units, sampling, segmentation, aircraft differences, missing data, false positives, false negatives, and version control before interpreting results.
- 04
Interpret frequency, exposure, and severity together
A count alone is not risk. Compare like-for-like operations, use an appropriate denominator, inspect severity potential and trend, and retain the operational context.
- 05
Connect signals to barriers and decisions
Ask which preventive, recovery, or consequence-mitigation control should work, who owns it, and what other evidence is needed before selecting an action.
- 06
Verify whether action changed performance
Track the action owner, implementation, unintended effects, and a pre-agreed effectiveness measure. Closing an action is not the same as demonstrating a stronger control.
03 · Worked learning example
Unstable-approach risk—without inventing a universal threshold.
This fictional example demonstrates the reasoning structure. It contains no airline data, IOSA result, operational limit, or recommended event threshold.
Where are approach-control barriers becoming less reliable?
Define the aircraft, operation, approach population, approved stability criteria, relevant change, and decision the review is intended to support.
Use relationships and trends, not one signal.
Examine path, speed, descent rate, thrust, configuration, mode, and go-around response over time. Validate every signal and aircraft mapping first.
Compare like with like.
Use an appropriate approach denominator and review runway, procedure, weather, fleet, destination, and operational-change context without turning correlation into cause.
Test the barrier—not just the event count.
Combine reports and operational expertise, identify the control to strengthen, assign ownership, and agree how effectiveness will be measured after implementation.
04 · Evidence for review
What a mature, risk-linked programme should be able to demonstrate.
This is an educational evidence map, not an IOSA checklist or a conformity statement.
01
Approved FDM or FDAP governance, objectives, roles, and data-protection arrangements
02
A traceable link between monitoring priorities and the operator's current hazard and risk picture
03
Aircraft- and fleet-specific parameter mapping, data-quality checks, and event-definition version history
04
Rates with a suitable exposure measure, scope, comparison population, and stated limitations
05
Documented multidisciplinary review using flight data alongside reports and relevant operational evidence
06
Actions linked to named risk controls, accountable owners, due dates, and effectiveness measures
07
Management review showing reprioritisation when operations, fleets, routes, or hazards change
08
Evidence that data is used for safety purposes within the applicable just-culture and protection framework
05 · Official-source foundation
Read the controlling and supporting material.
ASIP paraphrases only enough to explain why each source belongs here and sends readers to the publisher.
ICAOInternational FDAP framework
Manual on Flight Data Analysis Programmes (Doc 10000), Second Edition
ICAO describes the relationship between SMS and FDAP, programme elements, implementation, and State promotion and assessment. The full manual is a paid ICAO publication.
Open official sourceICAO Asia-PacificPublic implementation guidance
Guidance on the Establishment of a Flight Data Analysis Programme
The public guidance connects automatic data capture with safety management, confidentiality safeguards, pilot support, contextual narrative, and a non-punitive programme.
Open official sourceICAOSMS and safety-performance framework
Safety Management Manual (Doc 9859), Fourth Edition
ICAO's public companion presents safety risk management, safety performance, data collection, analysis, protection, assurance, and data-driven decision-making as connected parts of effective safety management.
Open official sourceICAOSafety-data to decision guidance
Safety Intelligence Manual (Doc 10159) gateway
ICAO describes the manual as guidance for collecting, processing, analysing, sharing, and exchanging safety data and information to develop safety intelligence under Annex 19.
Open official sourceIATARisk-based audit context
IOSA and the Risk-Based Approach
IATA states that audit scope combines baseline standards with operator-specific factors such as operational profile, safety events, and audit history, together with maturity assessment.
Open official sourceIATACurrent IOSA documentation gateway
IOSA Standards Manual overview
The ISM contains the IOSA standards, recommended practices, and guidance used as audit criteria. Always use the controlled current edition for audit preparation.
Open official sourceIATADe-identified industry benchmarking
Flight Data eXchange (FDX)
FDX consolidates airline-contributed, processed flight-data results for global, regional, airport, and comparable-aircraft benchmarking by participating airlines.
Open official sourceFAAFOQA programme guidance
AC 120-82 — Flight Operational Quality Assurance
The active advisory circular describes one acceptable means of developing, implementing, and operating a voluntary FAA-acceptable FOQA programme.
Open official sourceUK CAAPractical FDM good practice
CAP 739 — Flight Data Monitoring
CAP 739 describes FDM as systematic, proactive use of routine digital flight data within an intrinsically non-punitive and just safety culture.
Open official sourceEASASystem-level safety intelligence
Data4Safety
Data4Safety combines reports, operator flight data, ATM data, weather, expert analysis, and data science to identify systemic risks, assess them, and measure safety performance.
Open official source