IS-BAO uses three registration stages that reflect how mature your Safety Management System is. Stage 1 confirms the SMS infrastructure is established and safety-management activities are appropriately targeted. Stage 2 confirms safety risks are being effectively managed. Stage 3, the highest level, verifies that safety management is fully integrated into the business and a positive safety culture is being sustained. You normally progress one stage per audit cycle as your SMS matures. IS-BAO is a voluntary, ICAO-recognized standard run by IBAC — it is not an FAA requirement, and no stage by itself satisfies the FAA Part 5 SMS rule.
If you searched "is-bao stages", "isbao stage 2 requirements", or "is-bao stage 3 certification" and landed on a page written for passengers picking a charter, this is the operator-side version. We define each stage against IBAC's own public material, line them up side by side, explain how you actually move up, and are explicit about the thing the marketing pages blur: IS-BAO is voluntary and is not mandated by the FAA. If you also need to know what the FAA does require, start with the FAA Part 135 SMS 2027 deadline — that rule, not an IS-BAO stage, is the legal obligation.
First, What IS-BAO Actually Is
IS-BAO stands for the International Standard for Business Aircraft Operations. It was launched in 2002 and is administered by the International Business Aviation Council (IBAC), which describes it as the only ICAO-recognized industry standards program built specifically for business aviation. At its core it is a Safety Management System framework: you purchase the IS-BAO document suite, build (or align) your SMS to it, and then have an accredited auditor verify your SMS through a registration audit.
The key word is voluntary. IS-BAO is an industry standard built for operators, by operators — it is not a regulation, and the FAA does not require it. Operators pursue it because corporate flight departments, charter brokers, and international customers recognize it as evidence of a serious, internationally aligned safety program. It is common with corporate (Part 91) flight departments as well as Part 135 charter operators, and an IS-BAO registration can even help satisfy part of the ARGUS Gold Certified requirement.
The one idea that explains the stages
The stages are an SMS-maturity ladder. The IS-BAO audit process concentrates on SMS development through a gradual progression: Stage 1 checks that the system exists and is aimed at the right risks, Stage 2 checks that it is actually managing those risks, and Stage 3 checks that safety management is fully embedded and a positive safety culture is sustained. Same SMS — three checkpoints of increasing maturity.
The Three Stages, Defined From IBAC's Own Material
Each card below pairs IBAC's own description of what the stage verifies with a plain-English read of what that means for your operation. The italicized line is IBAC's wording; the rest is the operator translation.
IS-BAO Stage 1
Infrastructure established
What IBAC says it verifies
“Confirms that the SMS infrastructure is established and that safety-management activities are appropriately targeted.”
What that means for you
The building blocks are in place: a documented safety policy, a risk-management process, safety assurance, and safety promotion, with roles and procedures defined. The entry level — and where most operators begin.
IS-BAO Stage 2
Risks effectively managed
What IBAC says it verifies
“Ensures that safety risks are being effectively managed.”
What that means for you
The system you stood up for Stage 1 is demonstrably working: reporting is active, hazards are identified and assessed, risk controls are in place, and management reviews safety performance. Reached after the SMS has run long enough to produce real outputs.
IS-BAO Stage 3
Fully integrated + sustained safety culture
What IBAC says it verifies
“Verifies that safety-management activities are fully integrated into the operator's business and that a positive safety culture is being sustained.”
What that means for you
The highest level. Safety management is woven into how the business runs day to day, and a positive safety culture is being maintained, not just claimed. The most demanding stage because it asks for proof of cultural adoption and continuous improvement.
A note on Progressive Stage 3 (PS3)
For veteran operators who have reached and maintained Stage 3, IBAC offers Progressive Stage 3: instead of a full periodic audit, you take an annual, low-impact one-day audit covering roughly one third of the IS-BAO standard each year, completing a full cycle over 36 months. It is aimed at mature SMS operators who want continuous, rotating verification rather than a single big re-audit. PS3 is an option for staying at Stage 3 — it is not a fourth stage above it.
Stage 1 vs Stage 2 vs Stage 3, Side by Side
The clearest way to see the difference is in one table. This reflects IBAC's public material as of 2026; confirm current criteria and timing with IBAC or your accredited auditor before you plan.
| Dimension | Stage 1 | Stage 2 | Stage 3 |
|---|---|---|---|
| What it verifies | SMS infrastructure established & targeted | Safety risks effectively managed | SMS fully integrated + culture sustained |
| SMS maturity | Built | Working | Embedded |
| Main evidence | Structure: policy, process, roles | Outputs over time: reports, risk controls | Cultural adoption + continuous improvement |
| Typical position | Entry / first registration | After operating the SMS a while | Highest level, after Stage 1 & 2 |
| Registration period | Shorter cycle (often 1–2 yrs) | Shorter cycle (often 1–2 yrs) | May be up to 3 yrs; PS3 option |
| FAA-required? | No — voluntary | No — voluntary | No — voluntary |
A note on the numbers in this table
Registration periods and timing reflect how IS-BAO is commonly described — Stage 1 and 2 on a shorter renewal cycle and Stage 3 for a longer period — but IBAC sets the official protocol and it can change. There is no single published price or fixed month-by-month schedule for moving between stages; treat any specific figure as an estimate and confirm the current requirements with IBAC or your accredited auditor.
See your records gaps before any IS-BAO audit
Every IS-BAO stage verifies the same kinds of records — your SMS outputs plus pilot, training, and maintenance documentation. FileFlo's free FAA readiness score takes about 3 minutes and surfaces the document gaps most likely to slow down an audit at any stage. No signup required.
5-day free trial · No credit card required · Cancel anytime
How You Actually Move From Stage 1 to Stage 3
The stages are sequential by design: you do not buy your way to Stage 3, you mature into it. Because each stage requires more evidence over time than the last, the practical path is usually one stage per audit cycle. Here is the typical arc — bearing in mind IBAC sets the official criteria and timing.
Build and register at Stage 1
You purchase the IS-BAO suite, stand up (or align) your SMS, and an accredited auditor confirms the infrastructure is established and aimed at the right risks. This is your entry registration.
Operate the SMS, then earn Stage 2
You run the system long enough to generate real outputs — active reporting, hazard identification, risk controls, management reviews. At the next audit, the auditor verifies that risks are being effectively managed. That evidence-over-time requirement is why Stage 2 follows a period of operation, not an immediate re-audit.
Embed the culture, then reach Stage 3
Over subsequent cycles you demonstrate that safety management is fully integrated into the business and a positive safety culture is being sustained. Stage 3 is the highest level; veteran Stage 3 operators may then opt into Progressive Stage 3 to stay there via rolling annual audits.
Why stage progression is mostly a records problem
The thing that moves you from Stage 1 to Stage 2 to Stage 3 is demonstrable evidence that your SMS has been running — reports filed, risks assessed and closed, meetings held, training kept current. If those records are scattered across drives and inboxes, the audit becomes a scramble to reconstruct proof. If they are organized and retrievable, you can show maturity instead of asserting it. That is the bucket FileFlo targets — covered below.
Important: No IS-BAO Stage Is an FAA Requirement
A voluntary registration vs. the FAA SMS mandate
IS-BAO is a voluntary, ICAO-recognized standard administered by IBAC. The FAA does not require any stage, and holding Stage 1, 2, or 3 does not satisfy your FAA obligations. IS-BAO exists because corporate flight departments and charter brokers use it to recognize a serious safety program. The FAA-mandated obligation in this space is the Safety Management System rule under 14 CFR Part 5.
This distinction matters because a registration and a regulation are different obligations. Under 14 CFR §5.1, the SMS rule applies to Part 121 air carriers, Part 135 certificate holders, holders of a §91.147 Letter of Authorization, and certain Part 21 certificate holders. Under 14 CFR §5.9, operators already authorized before the rule must develop and implement an SMS and submit a Declaration of Compliance no later than May 28, 2027. Notably, Part 145 repair stations and most Part 91 flight departments are not in that general SMS mandate — though many pursue IS-BAO voluntarily anyway.
There is real overlap to your advantage. IS-BAO exercises the same four SMS components the FAA rule expects — safety policy, safety risk management, safety assurance, and safety promotion — so the work you do to reach a stage gives you a genuine head start on the FAA mandate. But the FAA requires its own SMS and its own Declaration of Compliance; an IS-BAO stage is not a substitute. The cluster below covers what the rule actually mandates and how to prepare.
Two cases come up constantly. First, corporate flight departments: many Part 91 operators pursue IS-BAO voluntarily even though they sit outside the mandate — see voluntary SMS for a Part 91 flight department and Part 91 corporate flight department records. Second, how IS-BAO sits next to the charter ratings: if you are weighing it against ARGUS and Wyvern, see ARGUS vs Wyvern vs IS-BAO compared, and to fund it, see how much ARGUS, IS-BAO & Wyvern audits cost.
What Every Stage Audits: The Records Behind the SMS
Here is the operator's real insight. Whatever stage you are chasing, the audit is verifying documentation — that your SMS exists, is running, and can be proven. The higher the stage, the more the auditor expects to see sustained outputs over time, not just a manual on a shelf. The audit does not create these records; it confirms they exist, are current, and can be produced on demand.
Safety policy & SMS manual
Your documented safety policy and SMS manual covering the four components — the structural backbone every stage checks first.
Risk & hazard records
Hazard reports, risk assessments, and the risk controls that prove (especially at Stage 2) that the system is actively managing safety.
Safety assurance outputs
Safety-meeting minutes, management reviews, audits, and corrective-action tracking that show the SMS is live and closing the loop.
Pilot training & currency
Initial and recurrent training, checkrides, and currency records for every crewmember the SMS and operation rely on.
Maintenance & airworthiness
Inspection status, airworthiness records, and maintenance tracking for each aircraft — the operational records the SMS touches.
Promotion & culture evidence
Training, communications, and the trail of sustained activity that underpins the Stage 3 case for an embedded safety culture.
The single biggest hidden cost of an IS-BAO audit — at any stage — is the internal labor to assemble and prove that set. When records live in scattered drives, inboxes, and binders, most of the prep is spent finding documents, not producing them, and that is exactly what explodes in the weeks before an audit. The same retrieval problem shows up when the FAA arrives. For the budgeting angle, see how much ARGUS, IS-BAO & Wyvern audits cost; for the prep mechanics, see the ARGUS & Wyvern audit document checklist and how to prepare for an ARGUS audit. And because the same records satisfy an FSDO visit, see how to prepare for a Part 135 FAA surveillance audit.
How FileFlo Helps: The Proof Layer, Not the Auditor
FileFlo holds and proves the records — it is not an auditor and does not grant IS-BAO stages
FileFlo is a compliance document intelligence platform. It classifies your records, version-controls them, tracks expirations and recurrence, and assembles an organized evidence binder on demand. It does not conduct the IS-BAO audit, does not grant, register, or guarantee any IS-BAO stage, is not an auditor, accredited auditor, or consultant, does not run your SMS, and does not provide legal advice. IS-BAO is a registered trademark of IBAC, and FileFlo is not affiliated with or endorsed by IBAC. FileFlo attacks one specific bucket: the records labor behind the audit.
Here is the honest positioning: you still earn the stage, and you still own your safety program. FileFlo does not run the audit or make the registration decision. What it removes is the labor of producing and proving the records the auditor asks for — the part that recurs every cycle and is the same whether you are registering at Stage 1 or sustaining Stage 3. When your records are classified, version-controlled, and instantly retrievable, audit prep stops being open-ended staff time and the evidence binder stops being a fire drill.
Classifies the records an IS-BAO audit verifies
SMS manual and safety policy, hazard reports, risk assessments, safety-meeting minutes, pilot training and currency, and maintenance and airworthiness records are filed by type — so you are not hunting across drives in the weeks before a Stage 1, 2, or 3 audit.
Tracks expirations and recurrence so nothing lapses
Pilot currency, recurrent training, and inspection cycles all carry expiry dates. FileFlo flags upcoming gaps 90, 60, and 30 days out — before a lapsed record turns into an audit finding, when fixing it is cheap.
Helps you show maturity over time, not assert it
Stage 2 and Stage 3 ask for evidence the SMS has been running. A version-controlled, time-stamped record of reports, reviews, and corrective actions lets you demonstrate sustained activity instead of reconstructing it the week before the audit.
Assembles an organized evidence binder on demand
When an auditor requests documentation, FileFlo produces a complete, organized binder in seconds instead of staff hours spent assembling it across systems — the same capability that helps with FAA surveillance.
One records home for IS-BAO, the charter ratings, and the FAA
Because IS-BAO, ARGUS, Wyvern, and the FAA SMS rule verify a heavily overlapping set of records, FileFlo holds them once. Advance a stage, add a charter rating, or face an FSDO visit from a single retrievable system — not duplicate piles.
Starter Plan
$89/mo
Up to 100 documents/month · 3 users
For smaller operators building the SMS records behind a Stage 1 registration.
Professional Plan
$299/mo
Unlimited documents + users · audit trail · employee auto-detection
For multi-aircraft operators sustaining IS-BAO Stage 2 or Stage 3 records over time.
FileFlo pricing is a fixed published rate (5-day free trial on both plans). It is separate from, and additional to, any IS-BAO suite, registration, audit, or consultant cost — and it targets the records/proof bucket, not the audit itself or the stage decision.
Frequently Asked Questions
What is the difference between IS-BAO Stage 1, Stage 2, and Stage 3?
The three stages reflect increasing maturity of your Safety Management System (SMS), not three separate products. In IBAC's own words, Stage 1 confirms that the SMS infrastructure is established and that safety-management activities are appropriately targeted; Stage 2 ensures that safety risks are being effectively managed; and Stage 3 verifies that safety-management activities are fully integrated into the operator's business and that a positive safety culture is being sustained. You normally start at Stage 1 and progress to Stage 2 and Stage 3 over successive audit cycles as your SMS matures. None of the stages is an FAA requirement — IS-BAO is a voluntary, ICAO-recognized industry standard administered by the International Business Aviation Council (IBAC).
What does IS-BAO Stage 1 mean?
Stage 1 is the entry level. Per IBAC, it confirms that your SMS infrastructure is established and that your safety-management activities are appropriately targeted — in other words, you have the building blocks in place: a documented safety policy, a risk-management process, safety-assurance activities, and safety promotion, with the people and procedures defined. It does not yet require proof that the system has been running long enough to demonstrate it is effectively managing risk; that is what Stage 2 adds. Stage 1 is where most operators begin, and a Stage 1 registration is typically valid for a defined period before re-audit. It is a voluntary registration, not an FAA certification.
What are the IS-BAO Stage 2 requirements?
Stage 2 is where the auditor looks past structure to results. IBAC describes Stage 2 as ensuring that safety risks are being effectively managed — meaning the SMS you stood up for Stage 1 is now demonstrably working: safety reporting is active, hazards are being identified and assessed, risk controls are in place, and management is reviewing safety performance. In practice you reach Stage 2 after operating your SMS for a period beyond the initial Stage 1 registration, because the auditor needs evidence the system has produced real outputs over time. The exact criteria and timing are defined by IBAC's current protocol and your accredited auditor — confirm them directly. Stage 2 remains a voluntary registration and is not the FAA SMS rule.
What does IS-BAO Stage 3 mean and is it the highest level?
Yes — Stage 3 is the highest IS-BAO registration level. IBAC describes it as verifying that safety-management activities are fully integrated into the operator's business and that a positive safety culture is being sustained. It is the most demanding stage because it asks for evidence of cultural adoption and continuous improvement, not just a functioning system. Operators typically reach Stage 3 only after holding Stage 1 and Stage 2 across multiple cycles. IBAC also offers a Progressive Stage 3 program for veteran Stage 3 operators, which replaces the full periodic audit with an annual, lower-impact audit covering roughly one third of the standard each year over a 36-month rotation. Stage 3 is still a voluntary, ICAO-recognized registration — it is not an FAA certification.
How long does it take to go from Stage 1 to Stage 3 in IS-BAO?
There is no fixed published timetable, because progression is tied to SMS maturity rather than the calendar — and IBAC and your accredited auditor set the criteria. The structure itself implies a multi-year path: you typically stand up the system and register at Stage 1, operate it long enough to demonstrate effective risk management for Stage 2, and then build a sustained, fully integrated safety culture for Stage 3. Because Stage 1 and Stage 2 registrations are renewed on a shorter cycle and Stage 3 may be registered for a longer period, most operators move up one stage per audit cycle rather than skipping ahead. Treat any specific month count you see online as an estimate, not an IBAC rule, and confirm the current protocol with IBAC or your auditor.
Is IS-BAO required by the FAA, and does an IS-BAO stage satisfy the Part 135 SMS rule?
No on both counts. IS-BAO is a voluntary, ICAO-recognized industry standard run by IBAC; the FAA does not require it, and holding any stage does not by itself satisfy your FAA obligations. The FAA-mandated requirement is the Safety Management System rule under 14 CFR Part 5. Under §5.1 it applies to Part 121 air carriers, Part 135 certificate holders, holders of a §91.147 Letter of Authorization, and certain Part 21 certificate holders; under §5.9, operators authorized before the rule must develop and implement an SMS and submit a Declaration of Compliance no later than May 28, 2027. Because IS-BAO exercises the same four SMS components the FAA rule expects, a mature IS-BAO registration gives you a strong head start — but the FAA requires its own SMS and its own declaration. The stage is not a substitute.
How often do you have to re-audit to keep an IS-BAO registration?
IS-BAO is a recurring registration, not a one-time certificate, so you re-audit on a cycle to stay registered. Stage 1 and Stage 2 registrations are generally valid for a shorter period (commonly one to two years) before renewal, while a Stage 3 registration may be granted for a longer period of up to three years. Veteran Stage 3 operators can opt into Progressive Stage 3, which spreads the work into an annual one-day audit covering about a third of the standard each year on a rolling 36-month cycle. Exact registration durations and re-audit timing are set by IBAC's current protocol — confirm them with IBAC or your accredited auditor before you plan budgets or deadlines.
What records and documentation do you need for an IS-BAO audit at any stage?
An IS-BAO audit verifies your SMS documentation and the evidence that the system is actually running. That means your safety policy and SMS manual, your risk-assessment and hazard-reporting records, safety-meeting minutes and management reviews, corrective-action tracking, and the underlying operational records the SMS touches — pilot training and currency, crew qualifications, and maintenance and airworthiness records. The higher the stage, the more the auditor expects to see sustained outputs over time (active reports, closed-loop risk controls, evidence of safety culture), not just a manual on a shelf. The audit does not create these records; it confirms they exist, are current, and can be produced on demand. That records-and-proof bucket is exactly what FileFlo targets — it classifies and version-controls the documents, tracks expirations, and assembles an organized evidence binder on request. FileFlo is not an auditor and does not grant or guarantee any IS-BAO stage.
Whatever stage you are chasing, make the records labor disappear
IS-BAO Stage 1, 2, and 3 all verify the same kind of documentation — your SMS outputs plus pilot, training, and maintenance records. FileFlo handles the bucket they share: it classifies every record an auditor reviews, surfaces expiring records before they become findings, and assembles a complete, organized evidence binder in seconds. Starter at $89/mo · Professional at $299/mo · 5-day free trial.
5-day free trial · No credit card required · Cancel anytime
Written by Chad Griffith, Founder, FileFlo — compliance document intelligence. This article explains the IS-BAO registration stages from a compliance-document perspective. IS-BAO (the International Standard for Business Aircraft Operations) is administered by the International Business Aviation Council (IBAC); it is an independent, voluntary program and a registered trademark of its owner. FileFlo is not affiliated with, endorsed by, or a substitute for IBAC, is not an auditor or accredited auditor, does not run your SMS, and does not grant, register, or guarantee any IS-BAO stage. Stage descriptions reflect IBAC's public material as of 2026 and can change — confirm current details directly with IBAC or your accredited auditor. Cited regulatory facts reflect 14 CFR Part 5 as published; this is not legal, financial, or safety-program advice. Always confirm your FAA obligations with your assigned FSDO.