Direct Answer
A Part 135 mock audit is a voluntary internal self-assessment in which you review your own operation against the same regulations and records an FAA inspector would examine, then fix the gaps before the FAA finds them. Run it in six moves: scope it by domain (operations, pilots, maintenance, program-level), sample rather than read everything, trace each sample from the summary back to the signed record that proves it, test that each record is current, complete, and retrievable, write each gap as a finding with a CFR reference and a corrective action with an owner and due date, then close the loop and keep the mock-audit report as a dated record.
The FAA does not run, schedule, or recognize "mock audits" — the term is industry shorthand for an internal dry run. The FAA's own surveillance under the Safety Assurance System (SAS) is risk-based and continuous, not a fixed calendar interval, and ramp checks are unannounced — so the point of a mock audit is to make readiness a standing state. For the readiness checklist this process produces, see the Part 135 records audit preparation checklist; for how a real visit unfolds, see how to prepare for a Part 135 FAA surveillance audit.
If you already know what records a Part 135 operator must keep and the records an FAA inspector asks for first, the mock audit is how you pressure-test all of it in advance. This guide is the method — the repeatable dry run that turns a list of requirements into a graded, fixed, and documented state.
What a Mock Audit Is — and What It Is Not
The single most important thing to be clear about up front: a mock audit is not an FAA program. The FAA does not run mock audits, does not schedule them, and does not recognize a "mock audit" as a regulatory event. The term is industry shorthand for a structured internal dry run that copies how the FAA actually conducts surveillance, so that the real thing holds no surprises. Framing it honestly matters, because a mock audit sold as something the FAA blesses is misleading — and because the value is entirely in what you do with the findings, not in a certificate.
A mock audit IS
- A voluntary internal self-assessment you fully control
- A dry run that copies FAA surveillance logic — scope, sample, trace, write findings
- A way to surface and close gaps on your own schedule, with no enforcement risk
- Evidence of a functioning compliance system when you document and close findings
A mock audit is NOT
- An FAA program, inspection, or anything the FAA schedules or recognizes
- A required activity — no regulation mandates a mock audit
- A pass/fail grade you report to the FAA or anyone else
- A substitute for your SMS, your dispatch system, or legal advice
Why copy the FAA's logic instead of inventing your own
The FAA oversees Part 135 certificate holders through the Safety Assurance System (SAS), a risk-based, data-supported, continuous-surveillance model. SAS is not a separate safety standard and does not impose new requirements — it gives inspectors standardized protocols to evaluate the programs the regulations already require. A mock audit is most useful when it mirrors that approach: sample, trace a thread from summary to signed record, and assess whether the program holds. References to SAS and FAA Order 8900.1 here are to FAA guidance, not regulation. See how often the FAA audits a Part 135 operator.
The Mock Audit, Step by Step
A mock audit is not a vague "look things over" exercise — it is a repeatable method. Run these six steps and you will produce the same kind of output a real inspection produces: a sampled, traced, written set of findings with corrective actions. The difference is that you control the timing and nothing here carries enforcement.
Scope it the way the FAA scopes surveillance
Split the operation into the same domains an inspector works from: operations and manuals (DO), pilot records and training (Chief Pilot), airworthiness and maintenance (DOM), and program-level items (drug & alcohol, SMS, security). Decide up front what is in scope for this pass — a focused monthly currency sweep and a full quarterly dry run are different exercises.
Sample, do not read everything
A real inspector samples; your mock audit should too. Pick one or two pilot files (include one you think is tight on a window), one or two aircraft, and a handful of airworthiness directives. Sampling is what makes a mock audit finishable on a schedule — and it mirrors how findings actually get written.
Trace each sample from summary to signed record
For every sampled item, start at the currency matrix or airworthiness-status sheet and trace back to the entry that proves it. The pilot currency line ties to the 135.293/135.297 record; the AD status ties to the signed compliance entry. If the chain breaks, you have found a finding — a summary that cannot be traced to a record is the same as no record.
Test the three states, not just existence
For each record ask three questions an inspector effectively asks: is it current (nothing expired or lapsed), is it complete (every element the CFR names is present), and is it retrievable (you can produce it on demand without a scramble)? A document that fails any one of the three is a gap even if it physically exists.
Write findings with a CFR reference and an owner
Record every gap as a short, specific finding tied to a regulation, paired with a corrective action that has a named owner and a due date. "Pilot J. Doe IPC expired (14 CFR 135.297) — schedule by [date], owner: Chief Pilot." Vague notes do not close; specific findings do.
Close the loop and keep the record
Verify each corrective action actually closed rather than assuming it, then keep the mock-audit report itself as a dated record. A written trail of self-identified findings and the fixes you made is evidence of a functioning compliance system — exactly the posture risk-based FAA surveillance rewards.
The three-state test, applied to every sample
Throughout the dry run, judge each record against three questions an inspector effectively asks: is it current (nothing expired or lapsed), complete (every element the CFR names is present), and retrievable (you can produce it on demand without a scramble)? A record that fails any one of the three is a finding even if it physically exists somewhere.
Run a 3-minute mock audit before the real one
The free FAA Readiness Score walks the same record domains a mock audit samples — operations, pilots, maintenance, program-level — and flags which gaps are most likely to surface as findings. No signup required; under 3 minutes. Treat it as the fast first pass before your full dry run.
Run the Free FAA Readiness ScoreWhat to Sample, by Area
Step 2 said "sample, do not read everything." Here is what that looks like in each domain. Each card below is one leg of the mock audit, the role that owns it, and the specific threads to pull — the exact items an FAA inspector tends to sample first. Every item links to its governing section on Cornell's Legal Information Institute. For the static record-by-record version of this list, work alongside the records audit preparation checklist.
For the operations leg, the person running the mock audit acts like a Principal Operations Inspector confirming the operator is authorized to fly and that the governing program is current and reachable. These are the first documents a real inspection confirms, so a gap here colors everything downstream.
Pull the certificate and OpsSpecs and confirm they match the operation
14 CFR part 119; 119.49Compare the Air Carrier Certificate and current Operations Specifications against the fleet and authorizations actually in use. An unamended certificate or OpSpec after a change in scope is one of the fastest ways a real inspection escalates.
Open the GOM and GMM to a random section and test currency + accessibility
14 CFR 135.21Section 135.21 requires a certificate holder (other than single-pilot operators) to prepare and keep the manual current, keep at least one copy at the principal base, furnish it to crewmembers and FAA representatives, and ensure the appropriate parts are accessible to flight, ground, and maintenance personnel during their duties. Verify the revision is current and that distribution/acknowledgment records exist.
Where operators trip up: A revision that was made but not distributed and acknowledged is a finding even when the content is correct — a mock audit should sample the distribution record, not just the manual.
Verify the management-personnel designations and the aircraft list
14 CFR 119.69; 135.63Confirm current designation letters for the Director of Operations, Chief Pilot, and Director of Maintenance (14 CFR 119.69(a)), and check the current aircraft list against the tails actually on the certificate. The aircraft list is retained at least 6 months under 135.63(b).
Pilot Records & Currency (sample two files)
Owner: Chief Pilot
14 CFR 135.63(a)(4); 135.293; 135.297; 135.299A real inspector rarely reads every pilot file — they sample. Your mock audit should do the same: pick one or two files (ideally including a pilot you suspect is tight on a currency window) and read each one element by element, exactly as it would be read on the day.
Confirm every 135.63(a)(4) element is present in the sampled file
14 CFR 135.63(a)(4)Each pilot record must contain full name; certificate type/number and ratings; aeronautical experience in sufficient detail; present duties and assignment date; medical certificate effective date and class; the date and result of each initial and recurrent competency test, proficiency check, and route check with aircraft type; flight time in sufficient detail to show flight-time-limit compliance; check-pilot authorization if any; any disqualification release; and training completion dates. Records are retained at least 12 months under 135.63(b).
Where operators trip up: Completeness is the test. A file missing one listed element reads to an inspector as a gap, not a rounding error.
Check the 135.293 competency check and the 135.297 IPC as separate windows
14 CFR 135.293; 135.297The 135.293 knowledge and competency check runs on a 12-calendar-month window; the 135.297 instrument proficiency check, required for any pilot serving as PIC under IFR, runs on a 6-calendar-month window. Verify each independently, per pilot, per aircraft type.
Where operators trip up: A current 135.293 competency check does NOT satisfy the 135.297 IPC — they are separate records on separate clocks, and the shorter IPC window is the one operators most often let slip.
Verify the line check and medical against the operation
14 CFR 135.299; 61.23Confirm the 135.299 line check is current (a 12-calendar-month cadence for PICs) and that the medical certificate is the correct class for the operation and not expired. The medical is the single most common silent-expiry item — a mock audit should always flag anything inside 90 days of lapsing.
Airworthiness & Maintenance (trace one AD, one part)
Owner: Director of Maintenance
14 CFR 135.439; 91.417; 39.7The maintenance leg is where mock audits find the most. Inspectors trace a sample item — an airworthiness directive, a life-limited part, the last inspection — from the status summary back to the signed entry that proves it. Your mock audit should pull the same thread and stop the moment the chain breaks.
Trace one airworthiness directive from applicability to compliance
14 CFR 39.7; 91.417(a)(2)(v)Pick an AD and confirm both applicability (which ADs apply to this airframe/engine/propeller serial) and compliance (AD number and revision, method, date, and next-due for recurring ADs). Under 14 CFR 39.7 the record — not just the work — is the requirement.
Where operators trip up: A status summary that cannot be traced back to a signed compliance entry is the same as no record at all — that is exactly the link a real inspector samples first.
Verify the airworthiness-status records reconcile to the entries
14 CFR 135.439(b)For aircraft on a continuous airworthiness maintenance program, 14 CFR 135.439(b)(3) requires records of total time in service of airframe/engine/propeller/rotor, current status of life-limited parts, time since last overhaul of time-limited items, current inspection status, and current AD status — kept and transferred with the aircraft when it is sold. Pick a life-limited part and reconcile the status sheet to the entry.
Confirm the inspection program signoff matches the governing regime
14 CFR 135.419; 91.409; 91.417Know which inspection regime governs each tail — an Approved Aircraft Inspection Program, or annual/100-hour under 91.409 — and confirm the most recent signoff matches it. For aircraft not on a CAMP, the maintenance-record retention scheme of 91.417 applies (work-performed records until repeated/superseded or 1 year; status records with the aircraft).
Where operators trip up: Mixed fleets create AAIP-vs-91.409 confusion — maintaining the wrong inspection type for a given tail is a recurring finding a mock audit is well placed to catch.
Program-Level Records (drug & alcohol, SMS, security)
Owner: Designated program manager(s)
14 CFR part 120; part 5; 49 CFR 1544Some records belong to no single role, and a mock audit is where you confirm they did not fall between the DO, Chief Pilot, and DOM. Assign an owner to each before the dry run so the gap is found by you, not an inspector.
Sample the drug & alcohol testing program records
14 CFR 120.111Confirm the program plan plus testing records by type (pre-employment, random, post-accident, reasonable-suspicion, return-to-duty, follow-up). Records confirmed positive are kept 5 years and annual MIS reports 5 years under 14 CFR 120.111.
Check SMS documentation ahead of the 2027 mandate
14 CFR part 5The 2024 final rule extends Safety Management System requirements to all Part 135 operators with a single compliance date in May 2027. A mock audit run now should confirm SMS policy, risk-management, assurance, and promotion records are being built — not discovered missing in 2027.
Confirm security program records where applicable
49 CFR 1544Operators subject to the Twelve-Five or other TSA standard security programs keep the program and its training/records per TSA requirements — separate from the FAA file but often requested in the same window.
Go deeper on each sampled record
Writing Findings and Corrective Actions
A mock audit is only worth the time if it produces fixes. The bridge from "something looks off" to "fixed and documented" is the finding. Write each one short, specific, and tied to a regulation, then pair it with a corrective action that names an owner and a due date. Track open versus closed, and verify closure rather than assuming it.
| Finding (specific + CFR) | Corrective action | Owner / due |
|---|---|---|
| Pilot J. Doe 135.297 IPC expired last month (14 CFR 135.297) | Schedule IPC; ground for IFR PIC duty until complete | Chief Pilot — by [date] |
| GOM Rev 12 issued but no distribution/acknowledgment on file (14 CFR 135.21) | Distribute Rev 12, collect crew acknowledgments, file with revision | Director of Operations — by [date] |
| AD 2024-XX status sheet shows complied, no signed entry traces to it (14 CFR 39.7) | Locate or recreate the signed compliance entry; reconcile status sheet | Director of Maintenance — by [date] |
| Aircraft list includes a tail no longer on the certificate (14 CFR 135.63) | Update aircraft list to match certificate and OpsSpecs | Director of Operations — by [date] |
Grade honestly, or do not bother
The failure mode of a mock audit is leniency. A dry run that quietly passes a tight medical or waves through an untraceable AD to avoid an awkward conversation manufactures false confidence — and false confidence is more dangerous than a known gap, because it walks you into real FAA surveillance believing you are clean. If your internal team cannot grade honestly, that is the strongest argument for periodically bringing in an independent reviewer who has no stake in the result.
FileFlo: the proof layer that does the document half of the mock audit
FileFlo is a compliance document intelligence platform — a proof layer that sits alongside your existing stack (flight scheduling, maintenance tracking, training software) and organizes the documents those systems produce into an audit-ready state. It does not conduct the audit, play the inspector, represent you to the FAA, or give legal advice, and it does not replace your safety management system, dispatch software, or maintenance tracking platform. What it does is the part of a mock audit that is pure retrieval and currency-checking: it classifies over 600 document types against the governing regulation, tracks expiration windows on every medical, training check, and required inspection so the currency sweep is already done, and lets you produce any sampled record — a specific pilot's 135.293 check, an aircraft's AD compliance status, the current GOM revision — on demand.
Mapped to this method: it makes step 2 (sampling) and step 3 (tracing) fast for the Chief Pilot and the Director of Maintenance, and gives the Director of Operations one place to confirm manual currency and pull any record on demand. The two-day binder hunt becomes a search query — which frees the people running the mock audit to spend their time on judgment rather than retrieval.
How Often Should You Run One?
There is no FAA-mandated mock-audit frequency, because the FAA does not require mock audits at all. So the cadence is yours to set — and the right answer is driven by how the FAA actually watches you. Because SAS surveillance is risk-based and continuous, and ramp checks are unannounced, readiness that only exists the week before an expected base inspection will not survive a surprise one. A layered rhythm works best.
Monthly: currency sweep
A light pass over pilot files and dated maintenance items — medicals, 135.293/135.297 checks, required inspections — to catch anything inside 90 days of lapsing. Fast, focused, and the one that prevents silent expiries.
Quarterly: full dry run
The complete six-step method across all four domains, with written findings and corrective actions. This is the real mock audit; the monthly sweep just keeps it from ever finding a surprise.
Periodic: independent review
Bring in an outside consultant or a peer from another certificate for fresh eyes, and always run a full dry run ahead of any coordinated FAA base inspection. Fresh eyes catch the gaps your own team has normalized.
There is no "audit every N months" FAA rule to anchor to
Do not set your mock-audit cadence by trying to predict the FAA's. The FAA oversees Part 135 certificate holders through a risk-based, data-supported, continuous-surveillance model — not a fixed calendar interval. Scheduled base inspections are usually coordinated in advance; ramp checks and en-route observations are unannounced. Anyone quoting a fixed "the FAA audits every N months" cadence is describing a rule that does not exist in the public surveillance model. Set your own rhythm so readiness is always a standing state. More on this in how often the FAA audits a Part 135 operator, and on what findings cost in FAA fines for Part 135 paperwork violations.
Frequently Asked Questions
What is a Part 135 mock audit?
A Part 135 mock audit is an internal self-assessment in which you (or a hired consultant) review your own operation against the same regulations and records an FAA aviation safety inspector would examine, then fix the gaps before the FAA finds them. It is not an FAA program, and the FAA does not run, schedule, or recognize "mock audits" — the term is industry shorthand for a structured internal dry run. A good mock audit copies the FAA's actual surveillance logic under the Safety Assurance System: pick a sample, trace it from the summary back to the record that proves it, and write up what does not hold. The output is a findings list with corrective actions, not a pass/fail grade you report to anyone.
How do you run an internal audit on a Part 135 operator?
Run it in five moves. First, scope it the way the FAA does — split the operation into operations (DO), pilot records and training (Chief Pilot), and airworthiness/maintenance (DOM), plus program-level items like drug and alcohol testing. Second, pick samples instead of trying to read everything: one or two pilot files, one or two aircraft, a handful of airworthiness directives. Third, trace each sample end to end — from the currency summary or status sheet back to the signed entry that proves compliance — because a summary that cannot be traced to a record is the same as no record. Fourth, write every gap as a finding with a CFR reference and a corrective action with an owner and a due date. Fifth, verify the corrective actions actually closed. Documenting the mock audit is what turns it into evidence of a functioning compliance system rather than a private worry session.
Who should conduct a Part 135 mock audit — internal staff or an outside consultant?
Both models work, and they solve different problems. An internal mock audit run by your own management team (DO, Chief Pilot, DOM) is cheap, repeatable, and best run on a regular cadence so readiness becomes a standing state. The weakness is familiarity — people stop seeing the gaps they walk past every day. An outside consultant or a peer from another certificate brings fresh eyes and often catches the "we have always done it that way" problems your own team has normalized. Many operators do both: frequent internal self-audits plus a periodic independent review. Whoever runs it, the value is in honesty — a mock audit that is graded leniently to protect feelings is worse than none, because it manufactures false confidence going into real FAA surveillance.
How often should you do a mock audit for Part 135?
There is no FAA-mandated frequency for a mock audit, because the FAA does not require mock audits at all — they are a voluntary internal practice. A practical rhythm most operators land on is a focused internal self-audit on a recurring cadence (monthly currency sweeps of pilot files, quarterly deeper passes across maintenance and operations) plus one larger independent review periodically, and always a full dry run ahead of any coordinated FAA base inspection. The reason to keep it continuous rather than annual is that the FAA's own surveillance under the Safety Assurance System is risk-based and continuous, not a fixed calendar interval — and unannounced ramp checks can happen any time an inspector encounters your aircraft. Readiness that only exists the week before an expected visit will not survive a surprise one.
What does a Part 135 mock audit checklist cover?
It covers the same record domains an FAA inspector works from. On operations: the Air Carrier Certificate, current Operations Specifications, and the General Operations Manual and General Maintenance Manual at their current accepted revisions (14 CFR 135.21). On pilots: each individual pilot record with every element 14 CFR 135.63(a)(4) lists, plus currency of the 135.293 competency check (a 12-calendar-month window), the 135.297 instrument proficiency check (a 6-calendar-month window for IFR PICs), and the 135.299 line check. On maintenance: airworthiness status and the maintenance records of 14 CFR 135.439 (for aircraft on a continuous airworthiness maintenance program) or 91.417 otherwise, plus airworthiness-directive compliance under 14 CFR 39.7. On program level: drug and alcohol testing records under 14 CFR part 120, and SMS records under part 5 ahead of the 2027 mandate. The mock audit does not just confirm the documents exist — it tests whether each is current, complete, and retrievable.
What is the difference between a mock audit and a real FAA audit?
A real FAA audit is conducted by an aviation safety inspector using the Safety Assurance System, can result in enforcement, and is something you do not control — a base inspection is usually coordinated in advance, but ramp checks and en-route observations are unannounced. A mock audit is a voluntary internal dry run you fully control: you choose the scope, the timing, and what to do with the findings, and nothing you find is reported to the FAA or carries enforcement consequences. The point of the mock audit is to make the real one boring — to surface and close every gap on your own schedule so that when an actual inspector pulls a pilot file or samples an airworthiness directive, the record is already current, complete, and instantly retrievable.
How do you write up mock audit findings and corrective actions?
Write each finding as a short, specific statement tied to a regulation, then pair it with a corrective action that has a named owner and a due date. For example: "Finding — Pilot J. Doe's 135.297 instrument proficiency check expired last month (14 CFR 135.297). Corrective action — schedule IPC by [date]; owner: Chief Pilot." Track open versus closed status, and verify closure rather than assuming it. The discipline matters for two reasons. First, a written, dated trail of self-identified findings and the fixes you made demonstrates a compliance program that actually functions, which is exactly the posture risk-based FAA surveillance rewards. Second, a finding you cannot show you closed is indistinguishable from one you never addressed. Keep the mock-audit record the same way you keep any other compliance record: current, complete, and retrievable.
How does FileFlo help you run a Part 135 mock audit?
FileFlo is a compliance document intelligence platform — the proof layer that makes a mock audit fast instead of a two-day scramble. It does not conduct the audit, play the inspector, represent you to the FAA, or give legal advice, and it does not replace your safety management system, dispatch software, or maintenance tracking platform. What it does is the part of a mock audit that is pure document work: it classifies your uploaded records against the governing regulation, tracks expiration windows on every medical, training check, and required inspection so the currency review is already done, and lets you produce any sampled record — a specific pilot's 135.293 check, an aircraft's AD compliance status, the current GOM revision — on demand. When the records side of the mock audit is a search query instead of a file hunt, the people running it can spend their time on judgment rather than retrieval.
The Part 135 audit-prep cluster
Make the real audit boring — be ready to produce any record on demand
A mock audit is only as fast as your ability to retrieve and verify records. FileFlo keeps every record across all four domains — operations, pilots, maintenance, and program-level — current, complete, and instantly retrievable, so the dry run takes hours instead of days and a real inspector's sample is answered in seconds. Starter at $89/month. Professional at $299/month (unlimited pilots + aircraft). Five-day free trial, no credit card required.
5-day free trial · No credit card required · Cancel anytime · A mock audit is a voluntary internal practice, not an FAA program. FileFlo is the compliance document/proof layer — it does not conduct the audit, represent you to the FAA, or replace your SMS, dispatch, or maintenance tracking system.