QA vs QC in aviation

What it means in practice

QA is process assurance. It includes compliance monitoring, procedure control, audit activity, systemic corrective action, management review, and checking whether the organisation’s processes are designed and working to produce compliant maintenance. QC is output control. It includes inspection, testing, verification, and direct checking of work, materials, and released products.

In practice, approved organisations need both. A workshop can perform good end-item inspection and still fail if its procedures, competence control, records, or subcontractor controls are weak. Equally, a good audit system does not remove the need to inspect and verify the actual work produced.

Who it applies to

The distinction matters most for Part-145 maintenance organisations, CAMOs, and anyone managing compliance or internal oversight. Quality managers, compliance monitoring staff, supervisors, and certifying staff all need to understand whether they are checking the process, the output, or both.

The same organisation may use different internal titles, but the regulatory requirement is function-based. The approval must still show how compliance is monitored and how maintenance output is controlled.

What EASA says

Current Part-145 rule text uses the management system and maintenance procedures framework rather than a simple QA/QC label. 145.A.200 requires a management system with safety policy, accountabilities, reporting, hazard identification, and compliance monitoring. 145.A.65 requires maintenance procedures that incorporate human factors and good maintenance practices. Those clauses create the formal process-control side of what industry normally calls QA. Output checks, inspections, testing, and release-to-service controls then sit across the maintenance data, performance, and certification clauses.

Common mistakes

The most common mistake is using QA and QC as if they were interchangeable. They are not. If the organisation only checks finished work and never tests whether the system itself is compliant and effective, it has a QC function but not a full process assurance function.

Another mistake is relying on QC alone to satisfy regulatory oversight expectations. A compliant approved organisation must show that it controls its people, data, procedures, records, hazards, and corrective action system, not only that it occasionally catches errors before release.