Aviation MRO is one of the most safety-consequential work environments in industry. A single hangar can contain a dozen simultaneous hazard exposures on any given shift: technicians torqueing engine components 40 feet above the hangar floor on wing docks, NDT crews running isotope radiography on landing gear components, confined-space entry teams inside fuel tanks with LEL monitors reading contamination levels in real time, hot-work crews welding structural repairs under fire-watch protocols, chemical technicians applying two-part epoxies with respiratory protection, and ground handlers moving aircraft under active engine-run permits. Every one of these operations is regulated by overlapping requirements from the FAA under 14 CFR Part 145, OSHA under 29 CFR 1910, EPA under multiple hazwaste rules, DOT under dangerous goods provisions, and increasingly by ISO 45001 as the international occupational health and safety management system standard adopted across the global aviation MRO sector. Aviation MRO EHS audits — internal, corporate, regulatory, and customer-driven — assess the integrity of the entire safety management system against every one of these requirements simultaneously. This guide walks through the ISO 45001 Plan-Do-Check-Act cycle that structures every rigorous EHS program, the hierarchy of controls that determines risk mitigation approach, the aviation MRO hazard domains every audit examines, the finding classification framework that determines response urgency, and the corrective action workflow that closes findings to audit-team satisfaction. OxMaint gives EHS Managers, Safety Directors, and Quality Managers the CMMS platform that operationalizes EHS audit-readiness as continuous discipline. Book a free demo to see EHS audit management inside OxMaint.
Plan
Establish & Assess
Hazard identification & risk assessment
Legal & regulatory requirements mapping
Safety objectives & targets
Resource allocation & roles assigned
Do
Implement & Execute
Operational controls & procedures
Training program execution
Emergency preparedness & response
Consultation & worker participation
Check
Monitor & Measure
Performance monitoring & measurement
Internal audit & management review
Incident investigation & analysis
Compliance evaluation
Act
Improve & Correct
Corrective action & nonconformity resolution
Continual improvement initiatives
Management review outputs
Updated risk register & controls
Every PDCA element captured in OxMaint · continuous cycle documented as operational data · audit response becomes report export rather than binder reconstruction
ISO 45001
the international OH&S standard that replaced OHSAS 18001 in 2018 · adopted across the global aviation MRO sector
FAA Part 5
Safety Management System regulation · Safety Policy · Risk Management · Safety Assurance · Safety Promotion
12+ Domains
audit coverage typical for aviation MRO EHS review · from LOTO to confined space to hot work to hazwaste
The Hierarchy of Controls — How Risk Is Actually Reduced
The hierarchy of controls is the single most consequential risk-mitigation framework in occupational health and safety. It ranks control measures from most effective (eliminate the hazard entirely) to least effective (protect the worker with PPE) — and the entire logic of a mature EHS program is that lower-tier controls are only acceptable when higher-tier controls are not technically feasible. Auditors examine risk assessments to verify that control selection followed the hierarchy properly, not that PPE was reached for first because it was cheapest. The framework below reflects the standard hierarchy applied in every ISO 45001-compliant program. OxMaint stores the applied control tier against every identified hazard so control selection has a defensible audit trail. Start a free trial to structure your hazard register inside OxMaint.
Hierarchy of Controls · Most Effective at Top
Tier 1
Elimination
Remove the hazard entirely · redesign task to eliminate exposure · most effective control
Tier 2
Substitution
Replace hazardous material or process with less-hazardous alternative · water-based solvents for chlorinated
Tier 3
Engineering Controls
Isolate people from hazard · local exhaust ventilation · machine guards · noise enclosures · fall arrest systems
Tier 4
Administrative Controls
Change how people work · procedures · permits · training · job rotation · warning signs · scheduled breaks
Tier 5
Personal Protective Equipment
Protect the worker with PPE · last line of defense · never acceptable as primary control if higher tiers feasible
Auditors verify control selection followed the hierarchy · PPE-only solutions where engineering controls were feasible generate nonconformity findings
Aviation MRO Hazard Domains — What Every Audit Examines
Aviation MRO facilities carry a specific portfolio of hazard exposures that every EHS audit examines against the applicable regulatory framework. The nine hazard domains below reflect the standard scope of an aviation MRO EHS audit — with each domain having its own risk assessment, its own operational controls, its own training requirements, and its own documented evidence trail. OxMaint stores each domain as a defined audit scope with linked risk assessments, control measures, training records, and incident history — giving audit teams direct evidence access without preparation scramble. Book a demo to see EHS domain tracking inside OxMaint.
Aviation MRO EHS Audit Domain Coverage
Domain 1
Lockout / Tagout
Energy isolation procedures · authorized employee training · periodic inspection · group LOTO for shift transitions
Domain 2
Confined Space Entry
Permit-required entry · atmospheric monitoring · attendant / entrant / supervisor roles · rescue procedures
Domain 3
Fall Protection
Wing docks · tail stands · elevated platforms · anchor points · harness inspection · rescue planning
Domain 4
Hot Work & Fire Prevention
Hot work permits · fire watch · flammable liquid controls · portable extinguisher inspection · ignition source management
Domain 5
Chemical Management
Hazard communication · SDS availability · container labeling · storage segregation · exposure monitoring
Domain 6
PPE Program
Hazard assessment · PPE selection · training · fit testing · maintenance & replacement · disposal
Domain 7
Respiratory Protection
Written program · medical evaluation · fit testing · cartridge change schedules · airline respirator systems
Domain 8
Hearing Conservation
Noise exposure monitoring · engine run areas · audiometric testing · hearing protection · signage
Domain 9
Environmental & Waste
Hazwaste generation & storage · used oil · solvents · air permit compliance · stormwater management
Finding Classification — The Severity Framework Auditors Use
Every EHS audit produces findings, and the classification of each finding directly determines the response urgency, the corrective action timeline, and the escalation path. Major nonconformities threaten certification and demand immediate response. Minor nonconformities require formal corrective action but on longer timelines. Observations do not require formal response but should be tracked for trend analysis. Opportunities for Improvement are optional enhancements that mature programs address as part of continuous improvement. The framework below reflects the ISO 45001 finding classification structure. OxMaint stores every finding at its classification level with the applicable response window automatically enforced.
EHS Audit Finding Classification · Four Severity Tiers
Major NC
Major Nonconformity
Systemic failure of a management system requirement · absence of required process · repeated minor NC pattern · certification at risk
Response: root cause analysis within 30 days · CAP within 60 days · verification audit
Minor NC
Minor Nonconformity
Isolated failure to meet a requirement · single documentation gap · procedural drift from written standard
Response: root cause & CAP within 60 days · closure verification at next audit
Observation
Observation
Situation approaching nonconformity but not yet failed · early warning · potential future finding if not addressed
Response: acknowledgment · addressed at next planning cycle · trended for pattern
OFI
Opportunity for Improvement
Suggestion for enhancement beyond conformity · efficiency gain · best-practice adoption · continual improvement input
Response: optional · captured for continual improvement backlog
Every finding classified within days of audit closeout · response protocol automatic per classification · OxMaint tracks CAP deadlines to closure
Every Domain · Every Finding · Every CAP — One Platform
OxMaint holds the EHS audit program as tracked operational data · risk registers, control measures, training records, incident history, and corrective action plans linked to specific assets and areas.
The Corrective Action Workflow — Finding to Closure
The corrective action workflow is where EHS audit findings become resolved nonconformities — or where they get lost, forgotten, and reappear as repeat findings in the next audit. Rigorous programs execute a defined six-step workflow for every nonconformity finding, with each step producing documented evidence that the next step depends on. The framework below reflects the standard ISO 45001-compliant CAP workflow. OxMaint holds every finding as a linked chain of steps with mandatory evidence capture at each stage. Start a free trial to configure CAP workflows inside OxMaint.
Corrective Action Workflow · Six Steps from Finding to Closure
01
Finding Documented
Audit finding recorded with classification · photo evidence · location · date · auditor identification
02
Root Cause Analysis
5-Why · Fishbone · fault tree · identify systemic factors · not just immediate symptom
03
Corrective Action Plan
Actions defined · responsibilities assigned · target completion dates · resource allocation
04
Implementation
Actions executed · training delivered · procedures updated · evidence captured per action
05
Effectiveness Verification
Verify the action actually resolved the finding · not just completed · re-audit critical control
06
Closure & Documentation
Formal closure with evidence package · management sign-off · lessons learned into risk register
Every step evidenced in OxMaint · CAP closure requires effectiveness verification · no finding closed without documented proof the action worked
EHS Manager Perspective · Audit-Ready Is a State, Not a Preparation
The mature aviation MRO EHS program treats audit-readiness as a continuous operational state, not a two-week scramble before the auditor arrives. That distinction sounds obvious but it drives every practical difference between programs that pass their ISO 45001 surveillance audits cleanly and programs that generate repeat major nonconformities year after year. Continuous-readiness programs document every hot-work permit as it is issued, every LOTO application as it is applied, every confined-space entry as it is authorized, every incident investigation as it is completed, every training completion as it is recorded. When the auditor asks for evidence of a specific control, it is one query away in the CMMS. Preparation-mode programs treat safety documentation as a separate exercise from safety operations — permits go on paper in binders on the wall, incident reports live in a shared drive nobody has updated in three months, training records live in HR's system that does not talk to safety's system. When the auditor asks for evidence, it triggers a scramble across four systems and often produces gaps that become the next audit's findings. The transformation to continuous readiness requires one thing above all else: a CMMS where safety operations and safety documentation are the same activity. Once we moved to OxMaint, that convergence happened. Every LOTO application generates a documented record. Every permit issuance captures its own evidence. Every corrective action tracks to closure with mandatory verification. Our next ISO 45001 surveillance audit closed with zero major nonconformities. That is not accident. That is what continuous EHS discipline actually looks like at operational scale.
Every Permit Live
OxMaint captures every hot work, confined space, and LOTO application with photo evidence and e-signature at issuance.
Every CAP Tracked
Corrective action workflow enforced end-to-end · closure requires documented effectiveness verification.
Continuous Audit Posture
Every domain evidenced as it happens · surveillance audit becomes report export rather than scramble.
Move to Continuous EHS Readiness in 2026
If your aviation MRO EHS program still runs on paper permit binders, spreadsheet training tracking, and quarterly audit preparation scrambles, you are carrying preventable certification risk into every ISO 45001 surveillance cycle. See what OxMaint — a CMMS built for aviation MRO EHS operations — looks like against your program.
Frequently Asked Questions
What is ISO 45001 and how does it apply to aviation MRO?
ISO 45001 is the international standard for Occupational Health and Safety Management Systems, published in 2018 to replace OHSAS 18001. It applies the Plan-Do-Check-Act cycle to workplace safety, requires risk-based thinking, worker consultation, and continual improvement. Aviation MRO organizations increasingly adopt ISO 45001 certification as part of their overall management system alongside AS9100 (quality) and ISO 14001 (environmental). Certification requires a third-party audit demonstrating conformity with all standard requirements.
What is the hierarchy of controls?
A five-tier framework ranking hazard control measures from most to least effective: (1) Elimination — remove the hazard entirely; (2) Substitution — replace with less-hazardous alternative; (3) Engineering Controls — isolate people from hazard through design; (4) Administrative Controls — change how people work through procedures and training; (5) PPE — protect the worker as last line of defense. Auditors verify that lower-tier controls are used only when higher-tier controls are not technically feasible.
What is the difference between a Major NC and Minor NC?
A Major Nonconformity represents a systemic failure of a management system requirement — absence of a required process, repeated pattern of minor NCs, or breakdown that puts certification at risk. Response requires root cause analysis within 30 days and CAP within 60 days, typically followed by a verification audit. A Minor Nonconformity is an isolated failure — a single documentation gap or procedural drift — that requires CAP within 60 days with closure verification at the next scheduled audit rather than an immediate verification visit.
What hazard domains does an aviation MRO EHS audit cover?
Standard scope includes at least: lockout/tagout, confined space entry, fall protection, hot work and fire prevention, chemical management and hazard communication, PPE program, respiratory protection, hearing conservation, and environmental/waste management. Additional domains often examined: ergonomics, electrical safety, emergency response, contractor management, and incident investigation. Each domain has its own risk assessment, operational controls, training requirements, and documented evidence trail.
What is the corrective action workflow?
Six sequential steps: (1) Finding documented with classification, photo evidence, and location; (2) Root cause analysis using 5-Why, Fishbone, or fault tree; (3) Corrective action plan with responsibilities and target dates; (4) Implementation with evidence captured per action; (5) Effectiveness verification — confirming the action actually resolved the finding, not just completed; (6) Formal closure with evidence package and management sign-off. Each step depends on documented evidence from the previous step.
How does a CMMS support EHS audit readiness?
A modern CMMS like OxMaint captures every permit as it is issued (hot work, confined space, LOTO), links every safety check to its work order, holds training records against workers and roles, tracks every incident from report through investigation to closure, maintains the CAP register with automatic deadline enforcement, and stores photo evidence, e-signatures, and timestamps for every audit-relevant action. This turns audit-readiness into a continuous operational state — evidence is captured as work happens rather than reconstructed before an audit visit.
