ASAP vs VDRP vs ASRS
The Three Voluntary Safety Programs — and Which One to File

Three Programs, Three Different Jobs

The reason these three programs get confused is that they share a philosophy — the aviation system would rather you report a safety issue or an inadvertent mistake than hide it — so they all offer some form of reduced exposure in exchange for voluntary, timely reporting. But they sit at different levels of the operation and protect different actors, and that is the distinction that actually answers "which one do I file?"

ASRS is about the individual. It is run by NASA — deliberately, so the safety data goes to a neutral third party rather than the regulator — and any airman can file it confidentially from anywhere. ASAP is about the employee inside a participating organization. It only exists where a specific operator, the FAA, and often a union have signed a memorandum of understanding, and it routes reports through a joint Event Review Committee. VDRP is about the company. It is the mechanism by which a certificate holder discloses its own apparent regulatory violation and commits to a comprehensive fix.

One critical clarification before going further: with the exception of the ASRS enforcement protection in 14 CFR 91.25, none of these programs is a section of the Code of Federal Regulations. ASAP, VDRP, and the ASRS waiver of sanction are FAA programs and guidance — described in advisory circulars and FAA orders, operated at the agency's discretion. Acceptance and outcomes are not regulatory entitlements. For how the FAA chooses between handling a problem cooperatively and escalating it, see FAA compliance action vs. enforcement.

ASAP vs VDRP vs ASRS, Side by Side

This is the comparison most articles only do two at a time. Read across the rows: the same questions — who files, who runs it, what it protects, the deadline — produce very different answers for each program. That is the whole point.

A subtlety the table flattens: these are not mutually exclusive. The same event can be eligible for more than one program at once — an inadvertent pilot deviation at an ASAP operator can be an ASAP report and an ASRS filing, and a systemic issue behind it might also be a VDRP disclosure by the company. Deciding what to file, and in what combination, is the genuinely hard part — covered below, and ultimately a decision for counsel.

The Aviation Safety Reporting System is the one most individual pilots actually use, and the one most worth understanding precisely because its protection is the only one anchored in a regulation. NASA — not the FAA — administers it, by design: putting a neutral third party between the reporter and the regulator is what makes pilots willing to report candidly. You file the report (pilots use NASA Form 277B), NASA strips out the identifying information, and you keep the dated identification strip NASA returns as your proof of submission.

The protection has two distinct pieces, and conflating them is a common error. First, the regulation: 14 CFR 91.25 states that the FAA "will not use reports submitted to" NASA under the program, "or information derived therefrom," in any enforcement action — except for information about accidents or criminal offenses, which are wholly excluded. That protection does not depend on any deadline. Second, the waiver of sanction: separate FAA guidance (AC 00-46) provides that even if you committed an inadvertent violation, the FAA will generally waive the civil penalty or certificate suspension when four conditions are all met.

The four conditions for the ASRS waiver of sanction

Because the 10-day window is unforgiving and the conditions are specific, the practical discipline is simple: if you think you may have had an inadvertent deviation, file promptly and keep the dated identification strip. The one thing you control completely is timeliness and proof of filing — which is, again, a records habit.

The Aviation Safety Action Program is the one most often misunderstood, because its availability depends entirely on your employer. ASAP is described in FAA guidance AC 120-66, and it only exists where a specific operator, the FAA, and (frequently) a labor organization have signed a memorandum of understanding creating one. If your operator does not have an ASAP, there is no ASAP report to file — which is exactly why ASRS, available to everyone, is so important as the individual's fallback.

Where an ASAP exists, employees — pilots, mechanics, dispatchers, depending on the program — submit reports that are reviewed by an Event Review Committee (ERC), typically composed of representatives from the operator, the FAA, and the employee group. The ERC analyzes the report, identifies the safety issue, and recommends corrective action. The enforcement incentive is the draw: for a report accepted under the MOU, the FAA uses lesser enforcement action or no enforcement action. Critically, which one depends on whether the report is sole-source.

ASAP information is also protected from public disclosure — FAA Order 8000.82 designated ASAP information as protected, consistent with the 14 CFR Part 193 framework for voluntarily provided safety and security information. The reporting deadline is set by each operator's MOU rather than by a single national rule; many programs use a short window after the end of duty, so the practical advice is to know your own program's timeline cold.

The Voluntary Disclosure Reporting Program is the only one of the three filed by the company rather than an individual. Described in FAA guidance AC 00-58, VDRP applies to regulated entities — certificate holders operating under 14 CFR parts 121, 135, and 145 (with a related framework for hazardous materials). When a certificate holder discovers it has apparently violated a regulation, it can disclose that violation to the FAA, take immediate corrective action, commit to a comprehensive fix, and — when the program's conditions are met — have the matter closed with a letter of correction instead of a civil penalty.

VDRP runs on two clocks: an initial notification to your principal inspector ordinarily within 24 hours of discovery, then a detailed written report ordinarily within 10 working days. The written report is, in effect, a root-cause-and-corrective-action package: the regulation involved, how the violation happened and was found, the immediate action taken, the systemic cause, the comprehensive fix and schedule, and a self-audit proving it worked. VDRP submissions are protected from public disclosure when labeled under 49 U.S.C. 40123 and 14 CFR Part 193.

One caution that applies across all three programs: never fabricate, backdate, or alter a record to make a report look cleaner. Falsifying a maintenance record is itself a serious violation — the FAA consolidated its falsification rules into 14 CFR Part 3, §3.403 (fraudulent or intentionally false statements; §3.405 covers incorrect statements) effective November 3, 2025, reserving the former 14 CFR 43.12 — and it converts a recoverable inadvertent mistake into intentional misconduct that none of these programs protect. The honest, dated, complete record is the one that helps you. See falsification of maintenance records under Part 3 Subpart D (former 43.12) and, for the legitimate way to fix a flawed entry, how to correct a maintenance logbook entry.

How to Decide Which One to File

The cleanest way to choose is to ask two questions: who are you in this event (an individual airman, an employee, or the certificate holder), and what is the event (an inadvertent slip, a systemic company issue, or something more serious like an accident). The matrix below is a starting framework — not a substitute for legal advice, because real events rarely fit one box and the consequences of the wrong call are real.

A few practical reminders that trip people up. These programs do not replace mandatory obligations: if an event is a reportable accident or serious incident, an NTSB Part 830 notification can be required on its own immediate timeline regardless of any voluntary filing — see what to do for a Part 135 accident NTSB notification. And if the FAA already has the event from a ramp check or surveillance, the calculus changes — which is why knowing your ramp-check rights and what to do after a failed ramp check matters.

The One Thing That Helps No Matter Which You File: Your Records

Step back from the differences and notice what all three programs share: every one of them is stronger when your records are complete, dated, and producible on a deadline. ASRS rewards timely filing and proof of submission. ASAP's sole-source determination can turn on what the operator's records already showed. VDRP is a documentation exercise — a root-cause-and-corrective-action package on a 10-working-day clock. The operators and airmen who use these programs well are not the ones who never make mistakes; they are the ones who can find the issue in their own records, prove what happened and when, document the fix, and hand over a clean package fast.

That is a document-management capability, and it is exactly the gap FileFlo is built to close. Below is the record set these programs typically draw on, what each one proves, and where a compliance document intelligence platform helps.

The voluntary-reporting record set

None of these documents is exotic — they are the same records a Part 135 operator is already required to keep. For the foundational records picture underneath all of this, see what records a Part 135 operator must keep, Part 135 maintenance recordkeeping and CAMP requirements, and the aviation records retention schedule for how long each must be kept.

The maintenance-record entries that so many reports revolve around are governed by the 43.9 maintenance-record entry requirements, and increasingly those entries live in digital systems — see electronic aircraft maintenance records and digital signatures. Major repairs and alterations bring their own paperwork, the FAA Form 337 records. And if the underlying problem is that records have gone missing, the recovery path is its own discipline: how to reconstruct lost aircraft logbooks.

The same records discipline is what carries you through the adjacent enforcement situations in this cluster — a paperwork-driven fine for a Part 135 paperwork violation, a ramp-check document checklist and what to expect in a ramp inspection, preparing for a Part 135 surveillance audit, responding to a records request during an investigation, and the grey-area scrutiny covered in the FAA illegal-charter crackdown.

Frequently Asked Questions