What IS-BAO Stage 3 Auditors Look for in a Flight Department’s Continuous Improvement Record - and Why Most Operations Can’t Produce Evidence That Satisfies the Standard
IS-BAO Stage 3 is the point where an auditor stops checking whether your aviation safety management system exists and starts verifying whether it actually changes how your organisation behaves. The audit shifts from document review to culture assessment, and the evidence standard shifts with it. Most flight departments arrive at Stage 3 having built procedural infrastructure that satisfies Stages 1 and 2, then discover that their continuous improvement record, the longitudinal thread that proves their SMS is learning and adapting, is too thin, too fragmented, or too recent to satisfy an auditor looking for genuine integration nbaa.org.
TL;DR
- IS-BAO Stage 3 auditors assess whether safety management is embedded in organisational culture, not just documented in manuals wildingair.com.
- The most common failure point is an inability to produce evidence of closed improvement cycles across a meaningful time horizon.
- Corrective action records, trend analysis, and safety data outputs must form a connected narrative, not a collection of isolated documents lvoyage.aero.
- A well-constructed aviation safety management system produces audit evidence as a by-product of normal operations, not a pre-audit scramble.
- Most operations underestimate how far back auditors want to look, and how specifically they want to see data reconcile to action.
About the Author: Private Aviation Technology Ltd. (PATL) supports private flight departments and operators through IS-BAO Stage 1, 2, and 3 audit preparation, including the design of SMS documentation and continuous improvement record architectures that produce verifiable evidence under audit conditions. PATL’s lead auditor, Ray Wilson, holds IS-BAO Stage 3 auditor credentials and brings 15 years of leadership across military, commercial, and business aviation, with multi-registry AOC compliance expertise.
What Does IS-BAO Stage 3 Actually Assess That Earlier Stages Do Not?
Stage 3 is categorically different from what came before. Stages 1 and 2 establish that a flight department has built an SMS and that the system is functioning. Stage 3 verifies that safety management activities are fully integrated into the operator’s business and that a positive safety culture is being sustained over time wildingair.com.
The critical word is “sustained.” An auditor at this level is not primarily asking “do you have a hazard log?” They are asking: “Can you show me how a hazard identified two years ago was assessed, escalated, acted upon, closed, and then reviewed to confirm the corrective action held?” That chain of evidence, connected across time, is what most operations cannot produce on demand.
The Progressive Stage 3 (PS3) option, which involves lower-impact progressive audits supported by access to the IS-BAO business aviation safety database, reflects the same underlying logic: continuity of evidence matters as much as the content of any single audit cycle ibac.org.
Why Is Continuous Improvement Evidence So Difficult to Produce?
Building on the distinction above, the harder question is not whether operations care about improvement, but whether their systems are designed to generate traceable, time-stamped, causally connected records.
Most flight departments fall into one of three patterns:
- The isolated record problem: Hazard reports, corrective actions, and safety reviews are stored in separate systems or folders, with no formal linkage between them. An auditor asking for end-to-end evidence of a single improvement cycle has to reconstruct it manually, and often cannot.
- The recency problem: An SMS may be well-maintained in the months before an audit but lack historical depth. Auditors will look for evidence of historical operation, trend analysis, and corrective action cycles. A system stood up or significantly reorganised three months before an audit will not satisfy the standard lvoyage.aero.
- The activity-versus-outcome problem: Many operations can demonstrate that safety meetings occurred, that reports were filed, and that corrective actions were assigned. Far fewer can demonstrate that those corrective actions measurably changed operational behaviour or reduced a specific risk, and that someone subsequently confirmed the change held.
The distinction between recording activity and demonstrating outcome is where Stage 3 separates operations that have an SMS from operations that are governed by one.
What Specific Evidence Does an IS-BAO Stage 3 Auditor Examine?
Stepping back from the structural problems, the practical question is what an auditor is actually looking for when they sit across from a chief pilot or flight department manager. The answer is specific and predictable.
| Evidence Category | What Auditors Look For |
|---|---|
| Hazard identification records | Volume, regularity, and source diversity over multiple audit cycles |
| Risk assessments | Documented rationale, not just a risk rating |
| Corrective action closure | Confirmation that actions were completed, not just assigned |
| Trend analysis outputs | Evidence that data was reviewed at the fleet or programme level |
| Management review records | That senior leadership engaged with SMS outputs, not just signed off |
| Safety culture indicators | Voluntary reporting rates, near-miss disclosure, cross-crew contributions |
The auditor is constructing a picture of whether safety management is a leadership function or an administrative one. A department where the safety data never reaches the accountable executive, or where the accountable executive cannot speak to recent safety trends without consulting a binder prepared that morning, will not demonstrate the integration Stage 3 requires nbaa.org.
How Should a Flight Department Structure Its SMS to Produce Stage 3 Evidence Naturally?
A related but distinct question is how to avoid the pre-audit scramble entirely. The answer is to design the SMS so that audit evidence is produced as a by-product of normal operational discipline rather than assembled retrospectively.
Practically, that means:
- Link your records at the point of creation. Every corrective action should reference the specific hazard report that generated it. Every closure record should reference the corrective action. This linkage should be built into the workflow, not patched in later.
- Schedule trend reviews at fixed intervals, with written outputs. An undocumented review did not happen, from an audit perspective. Quarterly safety data reviews with distribution records and written summaries create the longitudinal pattern auditors need to see.
- Separate the SMS owner from the SMS record-keeper. When one person both manages and documents the SMS, the audit record often reflects what that person noticed rather than what the system produced. Independent record-keeping creates more credible evidence.
- Build management review into governance, not into audit preparation. If the accountable executive reviews SMS outputs once a year, three weeks before an audit, that is visible in the record. Monthly or quarterly governance touchpoints produce a different kind of evidence density.
Operations that treat these practices as administrative overhead will always find Stage 3 difficult. Operations that treat them as operational infrastructure find that the audit largely confirms what their records already show.
Frequently Asked Questions
How far back will an IS-BAO Stage 3 auditor typically look at continuous improvement records? Auditors generally want to see evidence across multiple SMS cycles, typically covering the period since the previous audit or registration. Operations with shorter histories will be assessed on what they have, but thin records are a known risk factor.
Can a small flight department realistically achieve IS-BAO Stage 3? Yes, but the evidence standard is the same regardless of fleet size. A single-aircraft operation needs the same quality of closed improvement cycles as a larger department; it simply has a smaller volume of underlying data to work with.
What is the difference between a corrective action being “closed” and being “verified”? Closing a corrective action means the assigned task was completed. Verification means a subsequent review confirmed the action achieved its intended safety outcome. Stage 3 auditors look for verification, not just closure.
Is the Progressive Stage 3 option easier than a standard Stage 3 audit? PS3 is lower-impact in terms of single-event disruption, but the evidence standard is the same. The progressive format does not reduce what needs to be demonstrated ibac.org.
What is the most common reason a flight department is not ready for Stage 3? The most consistent gap is the absence of a connected improvement record: hazard logs, risk assessments, corrective actions, and management reviews exist but are not linked in a way that lets an auditor trace a safety issue from identification to confirmed resolution lvoyage.aero.
Does IS-BAO Stage 3 assess individual staff behaviour or only organisational systems? Stage 3 includes a comprehensive assessment of safety culture, which means the auditor looks at how principles are embedded at the individual level, not only whether the right documents exist nbaa.org.
How does voluntary reporting rate factor into a Stage 3 assessment? Voluntary reporting volume and diversity are treated as indicators of safety culture health. A department where only the chief pilot files reports is likely to attract scrutiny even if the report volume appears adequate on paper.
About Private Aviation Technology Ltd.
Private Aviation Technology Ltd. (PATL) solves the hard operational and regulatory problems private aviation organisations face, including IS-BAO audit preparation, operations design, and AOC compliance support across multiple registries. PATL’s team combines IS-BAO Stage 3 auditor credentials, 15 years of leadership across military, commercial, and business aviation, and enterprise technology experience, making it one of the few firms that can address both the procedural and the data architecture dimensions of SMS compliance in a single engagement. PATL is the sister company of L’VOYAGE (founded 2014), which expanded its private aviation footprint into PATL to handle the technical and operational hard problems that sit underneath client-facing private jet brokerage and luxury travel work. PATL’s operating heritage and established operator network across Asia provide on-the-ground regional experience and regulatory familiarity. All client data, cost architectures, and operational strategies are handled with strict confidentiality.
If your flight department is preparing for IS-BAO Stage 3, or if you have a continuous improvement record that you are not confident will hold up under audit scrutiny, contact Private Aviation Technology Ltd. (PATL) at https://www.privateaviationtech.com/ to discuss how to build an SMS that produces the evidence auditors are looking for, before the audit date is set.
References
- Above and Beyond: IS-BAO’s Plan for Continuous Improvement | NBAA - National Business Aviation Association (nbaa.org)
- Progressive Stage 3 | International Business Aircraft Council (ibac.org)
- IS-BAO Certification Explained: What Aviation Startups and Flight Departments Need to Know Before They Pursue It | L’VOYAGE (lvoyage.aero)
- IS-BAO - Registration, Audit & Certification Stage I, II & III Audits Available. (wildingair.com)