Ask someone in an airline's compliance team who they answer to, and you will usually get more than one name. That is not confusion. Aviation compliance runs through several different bodies, each with a different job, and the words for them get used loosely in conversation. This is the map: who writes the rule, who checks it, and what paper trail proves the airline followed it.
Who writes the rule: ICAO
The International Civil Aviation Organization (ICAO) is a United Nations body. It writes the global rules that every country's aviation authority is expected to follow. ICAO does not inspect an airline directly. It sets the standard that national law is built on, so that a flight rule in one country lines up, roughly, with the same rule in another.
Who enforces it: the national or regional authority
ICAO's rules become enforceable through a national or regional authority. In Europe that is EASA, the European Union Aviation Safety Agency, whose rulebooks are law for aircraft, airlines and maintenance organisations operating there. A country can also apply EASA rules through its own agency: Spain's AESA, for instance, applies EASA's rules inside Spain. Outside Europe, each country runs its own civil aviation authority, built on the same ICAO foundation. This is the body that approves an airline's documents, licenses its aircraft, and can ground an operation.
What the authority signs off: the OM-A
An airline's core document is its Operations Manual, split into parts. Part A, the OM-A, holds the general policies and procedures for all of the airline's flying: the rules its own crews and staff work to. The national authority has to approve the OM-A, and it has to approve every revision after that. It is the one document that ties an airline's day-to-day operation back to the rule the authority is enforcing.
A separate check: the IOSA audit
Alongside the regulator sits a different kind of check, run by industry rather than government. IOSA, the IATA Operational Safety Audit, is IATA's safety audit for airlines, renewed on a roughly two-year cycle. It is not optional for an airline that wants to stay in IATA: membership depends on it, and partner airlines often ask for it before agreeing to codeshare or interline. Losing IOSA registration is a commercial problem as much as a safety one, since the partnerships built on it can lapse with it.
What an audit produces: the NCR
Whether the audit comes from the national authority or from IOSA, the output looks the same: a Non-Conformity Report, or NCR. An NCR is the written record of one thing the audit found wrong: which rule was broken, and how serious the auditor judged it to be. An audit does not end with a pass or fail stamp so much as a list of NCRs, graded by severity, that the airline has to close out. Closing an NCR means fixing the underlying problem and showing the evidence that it is fixed, not just re-writing the paragraph the auditor flagged.
Putting the map together
Four layers, four different jobs:
- ICAO writes the global rule.
- The national or regional authority (EASA, or the equivalent civil aviation authority) turns it into enforceable law and approves the airline's documents.
- The OM-A is where that law meets the airline's own operation, revision by approved revision.
- IOSA runs an industry-side audit on top of the regulator's own oversight, and both kinds of audit produce NCRs that have to be closed.
None of these bodies replace each other. A clean IOSA audit does not excuse an unapproved OM-A revision, and an approved OM-A does not exempt an airline from IOSA. Knowing which layer a given requirement sits in is most of the work of not getting lost in it. Karutek implements and distributes compliance software built to keep manuals, audits and NCRs in this kind of order.