14 CFR Part 145 does not use the phrase "internal audit," but it requires the self-checking that an internal audit performs. The quality control system in §145.211(a) must ensure airworthiness, and §145.211(c)(1) requires written procedures for nine functions — including taking corrective action on deficiencies. The one explicitly documented self-evaluation the rule names is in §145.215(c): before listing any article on a limited-rating capability list, the station must perform a self-evaluation under §145.209(d)(2) and "retain on file documentation of the evaluation."
A practical internal audit walks the station against its own §145.211(c) procedures plus the surrounding documents — RSM (§145.207–§145.209), capability-list self-evaluations (§145.215(c)), rosters (§145.161), training (§145.163), calibration (§145.109(b)), contract maintenance (§145.217), and recordkeeping with its 2-year retention (§145.219). It is the preventive counterpart to an FAA surveillance inspection: you find the gap before your Principal Maintenance Inspector does.
A point of accuracy: there is no standalone "audit the quality system" line in §145.211
Some checklists circulating online cite §145.211 as if it contains an explicit internal-audit mandate. It does not. §145.211(c)(1) lists nine inspection and control procedures; the explicit documented self-evaluation lives in §145.215(c). The internal audit described here is the standard industry method for proving the §145.211(a) quality system works — the practical mechanism the rule assumes you run, not a separate enumerated requirement. We keep the citations honest because your PMI will.
Internal Self-Audit vs. FAA Surveillance Inspection
These are two different events, run by two different parties, against largely the same standards. Confusing them is the most common reason a station "has a checklist" but still gets surprised at a surveillance visit. The distinction is the whole point of this guide.
Your internal self-audit
- Run by the station on itself, on its own schedule
- Preventive — find and fix gaps before they become findings
- Walks your own §145.211(c) procedures vs. observed practice
- Frequency you commit to in your RSM (§145.209(d)(2))
FAA surveillance inspection
- Run by your Principal Maintenance Inspector (PMI)
- Evaluative — documents findings against the certificate
- Structured under the Safety Assurance System (Order 8900.1)
- On the FAA's schedule, not yours
The document categories overlap heavily — and that is by design. The internal audit checklist below mirrors what an inspector reviews precisely so that, by the time the PMI arrives, every gap has already been found and closed. If you want the inspector's-eye view of which records get requested and in what order, read the companion guide, the Part 145 audit binder: every document an FAA inspector asks for. That post is the FAA's side of the table; this post is yours. Run the self-audit here, and the binder there assembles itself.
Regulatory framework this checklist is built on
Want a head start on the self-audit? Run FileFlo's free FAA Readiness Score against these same areas before you walk the floor.
Score Your Readiness — FreeThe 8-Area Internal Audit Checklist
Each area below is a stop on a complete internal audit. Area 2 is the engine — auditing your station against its own nine §145.211(c) quality-control procedures. The rest verify the documents and records that surround the quality system.
Repair Station Manual (RSM) currency and control
The RSM is the document the station commits to "prepare and follow" under §145.207, with its contents defined in §145.209. Your internal audit starts here because every procedure you will check downstream is defined in this manual. Confirm the manual on the floor is the current accepted revision, that the §145.209(d)(2) self-evaluation procedure is present, and that the §145.209(i) recordkeeping-system description matches how you actually file records.
Checklist items
- Current RSM revision on the floor matches the accepted revision on record, with a complete revision log
- RSM contains the §145.209(d)(2) self-evaluation procedure (methods, frequency, reporting to the appropriate manager)
- RSM describes the recordkeeping system used to obtain, store, and retrieve required records (§145.209(i))
- Revision procedures in §145.209(j) were followed for each past change, with Flight Standards office notification
- Distribution records show the current revision reached all personnel required by subpart D
The 5-minute self-test
Pick the most recent RSM change. Can you produce the revision request, the date, the Flight Standards office notification, and the distribution sign-offs? If a step is missing, the revision is not provably controlled — fix it before the PMI compares your revision number against the FAA file.
Most common gap
The manual was revised but the change was never run through the §145.209(j) revision procedure, or the distribution log was left incomplete so an old revision stayed in circulation.
Quality control system — audit against your own QCM procedures
Tap header to expand
Capability-list self-evaluation file (the rule’s one explicit self-check)
Tap header to expand
Personnel rosters and certificate copies
Tap header to expand
Training program and individual training records
Tap header to expand
Housing, facilities, equipment, and calibration
Tap header to expand
Recordkeeping — content, retention, and availability
Tap header to expand
Contract maintenance list and contractor qualification
Tap header to expand
Build out the rest of your Part 145 records system
How Often to Run It — and What It Costs
Part 145 sets no fixed frequency for a full internal audit. The only frequency language in the rule is in §145.209(d)(2), which requires your repair station manual to state the methods and frequency of the capability-list self-evaluation and how results are reported to the appropriate manager. Whatever frequency you write into your RSM becomes binding. If your manual says quarterly and you audit annually, that gap between documented procedure and actual practice is itself a finding — so set a frequency you will actually keep.
A complete walk of all eight areas at least once a year is common industry practice for small and mid-size stations — often timed before the expected surveillance cycle.
Between full audits, monitor the time-sensitive items continuously: training currency, calibration cycles, and capability-list self-evaluations. These are where drift accumulates silently.
Above all, run the audit at the frequency your own §145.209(d)(2) procedure commits to. The most avoidable finding is a station not following its own written schedule.
The cost is mostly labor, and the alternative is far more expensive (2026)
An internal audit's direct cost is staff time — and, if you use one, an outside auditor or consultant's day rate, which varies widely by region and station size (no single published figure exists). The point of comparison is the downside: an uncorrected documentation gap that surfaces during FAA surveillance can escalate into a civil penalty action or, for systemic quality-system failures, certificate suspension or revocation. A scheduled self-audit is the cheapest insurance a repair station buys.
Building your audit program from scratch? Start with the companion guides on writing the repair station manual and QCM and the underlying Part 145 recordkeeping requirements — then keep the records behind every line current with a document platform rather than a binder you rebuild under pressure.
Do You Also Owe an SMS? The May 28, 2027 Deadline and Part 145
A frequent point of confusion: the FAA's expanded Safety Management System final rule (14 CFR Part 5, effective May 28, 2024) does not place Part 145 repair stations under the general SMS mandate. The widely cited May 28, 2027 compliance date applies to Part 135 operators (along with certain Part 121, §91.147 air tour, and certain Part 21 certificate holders). The FAA explicitly invited public input on a possible future rule extending Part 5 to Part 145 — so SMS for repair stations remains under consideration, not currently required.
Where the deadline bites is the dual-certificate holder: a maintenance organization that also operates as a Part 135 air carrier. That operator must implement an SMS for its Part 135 operation by May 28, 2027 — and the same records discipline that runs your internal maintenance audit (the QC procedures, training currency, corrective-action close-out) feeds the SMS safety-assurance function under Part 5. If that describes your operation, work through the SMS pillar guides:
How a Compliance Document Platform Keeps the Audit Always-Ready
An internal audit is only as good as the records behind each checklist line. The hard part is not running the audit once — it is keeping every record current between audits so the next one takes hours instead of weeks. A QCM revision issued last month must be reflected with its distribution log. A mechanic onboarded in the spring must have an individual training record with a current recurrent date. A torque wrench re-calibrated last week must show its new due date.
FileFlo is a compliance document intelligence platform that keeps each audit area live rather than assembled under deadline. When you upload a document — a QCM revision, a training certificate, a calibration cert, a capability-list self-evaluation, an 8130-3 tag — FileFlo classifies it against the relevant CFR subpart, version-controls it, and files it in the right place. It tracks expiration dates on training currency, calibration cycles, and self-evaluations, surfacing what is coming due at 90, 60, and 30 days so a gap is closed before your next audit — internal or FAA.
Every QCM revision version-controlled with effective date and distribution log, so procedure-vs-practice drift is visible immediately.
Each capability-list self-evaluation indexed to its article and retained on file, with revision dates tracked.
Individual training records with initial, OJT, and recurrent currency dates; 90/60/30-day alerts before a currency lapses.
Calibration master log with each instrument’s due date tracked, so the floor-walk finding never happens.
Run a self-audit dry run in under 10 minutes
FileFlo's FAA Readiness Score tool walks you through the same areas as the internal audit above and surfaces where your records have gaps — before your next surveillance cycle. No signup required for the assessment. Starter at $89/mo or Professional at $299/mo with a 5-day free trial and no credit card.
Frequently Asked Questions
Does 14 CFR Part 145 require a repair station to run an internal audit?
Part 145 does not use the words "internal audit," but it does require self-checking. The quality control system in 14 CFR §145.211(a) must "ensure the airworthiness of the articles" the station maintains, and §145.211(c)(1) requires written procedures for nine inspection and control functions — including "taking corrective action on deficiencies." The one explicit, documented self-evaluation the rule names is in §145.215(c): before listing any article on a limited-rating capability list, the station must perform a self-evaluation under the procedures in §145.209(d)(2) and "retain on file documentation of the evaluation." A scheduled internal audit that walks the station against its own §145.211(c) procedures is the standard industry method for proving the quality system actually works — not a separate FAA-mandated item, but the practical mechanism the rule assumes you have.
What is the difference between an internal self-audit and an FAA surveillance inspection?
They are two different events run by two different parties. An FAA surveillance inspection is conducted by your Principal Maintenance Inspector (PMI) under the Safety Assurance System (FAA Order 8900.1) — the FAA auditing you, on the FAA's schedule. An internal self-audit is the station auditing itself, on its own schedule, against the same standards. The internal audit is where you find the QCM revision drift, the missing training signoff, or the expired calibration tag before the PMI does. The document categories overlap heavily — that is the point — but the internal audit is preventive and the surveillance inspection is evaluative. Our companion guide on the documents the FAA asks for covers the inspector's side; this checklist covers the station's own self-audit.
How often should a Part 145 repair station run an internal audit?
There is no Part 145 frequency mandate for a full internal audit. The only frequency language in the rule is in §145.209(d)(2), which requires the repair station manual to state the "methods and frequency" of the capability-list self-evaluation and the procedure for reporting results to the appropriate manager. Whatever frequency you write into your RSM becomes your binding commitment. Common industry practice is an annual full internal audit of the quality system plus continuous monitoring of expiring items (training currency, calibration cycles, contract maintenance approvals). The frequency that matters most is the one in your own manual — if your RSM says quarterly and you audit annually, the gap between your documented procedure and your actual practice is itself an FAA finding.
What should a Part 145 internal audit checklist cover?
A complete internal audit walks every function the quality control system is required to cover. Map it to 14 CFR §145.211(c)(1): incoming raw-materials inspection; preliminary inspection of articles; hidden-damage inspection of articles involved in accidents; proficiency of inspection personnel; current technical data; qualification and surveillance of noncertificated persons; final inspection and return to service; calibration of measuring and test equipment with intervals; and corrective action on deficiencies. Then add the governing documents and records that surround the QC system: the repair station manual (§145.207–§145.209), the capability-list self-evaluation file (§145.215(c)), personnel rosters (§145.161), the FAA-approved training program and individual training records (§145.163), equipment calibration to an FAA-acceptable standard (§145.109(b)), contract maintenance (§145.217), and the recordkeeping system with its 2-year retention (§145.219).
Where does the FAA require a documented self-evaluation in Part 145?
The explicit documented self-evaluation is in 14 CFR §145.215(c), which applies to repair stations with a limited rating that use a capability list. An article may be listed "only after the repair station has performed a self-evaluation in accordance with the procedures under §145.209(d)(2)." That self-evaluation must determine that the station "has all of the housing, facilities, equipment, material, technical data, processes, and trained personnel in place to perform the work on the article as required by part 145," and the station "must retain on file documentation of the evaluation." The procedures for that self-evaluation — its methods, its frequency, and how results are reported to the appropriate manager for review and action — live in the repair station manual under §145.209(d)(2).
What are the most common findings an internal audit catches before the FAA does?
The recurring documentation failures in Part 145 surveillance are administrative, not maintenance-quality, problems — which is exactly why a self-audit catches them. The usual list: quality control manual or repair station manual revision drift (running on a superseded revision, §145.207–§145.211); individual training records missing or recurrent training not tracked to currency dates (§145.163); parts received with no receiving-inspection record or missing FAA Form 8130-3 traceability (§145.211(c)(1)(i)); work orders missing a required return-to-service element under 14 CFR §43.9 (§145.219); and measuring or test equipment in active use past its calibration due date (§145.109). An internal audit run against the §145.211(c) procedure list surfaces every one of these before they become a finding in your FAA file.
Does a Part 145 repair station need an SMS, and is the May 28, 2027 deadline relevant?
The FAA's expanded SMS final rule (14 CFR Part 5, effective May 28, 2024) does not place Part 145 repair stations under the general SMS mandate. The May 28, 2027 compliance date applies to Part 135 operators (plus certain Part 121, §91.147 air tour, and certain Part 21 certificate holders). The FAA asked the public for input on a possible future rule extending Part 5 to Part 145, so it remains under consideration — not currently required. The deadline becomes directly relevant when a repair station also holds a Part 135 Air Carrier Certificate: that operator must implement an SMS under Part 5 by May 28, 2027 for its Part 135 operation, and the same records discipline that runs the internal maintenance audit feeds the SMS safety-assurance function.
Does FileFlo run my internal audit or get my repair station certified?
No. FileFlo is the compliance document and proof layer — it does not run your quality system, perform your internal audit, write your repair station manual or QCM, or get you certified, and it is not legal or A&P advice. What it does: classify each document you upload against the relevant CFR subpart, version-control your RSM and QCM revisions, track expiration dates on training currency, calibration cycles, and capability-list self-evaluations, and assemble the records for any audit category on demand. You and your accountable manager still run the audit and make the airworthiness determinations; FileFlo makes sure the records behind every checklist line are current, indexed, and provable when someone asks.
Find the gaps in your own audit before the FAA does
FileFlo keeps every internal-audit area live — QCM revision history, capability-list self-evaluations, training currency, calibration schedules, and work-order records — and assembles the records for any audit category on demand. Organize and prove your repair-station records. Starter at $89/mo, Professional at $299/mo flat regardless of mechanic count. 5-day free trial, no credit card required.
5-day free trial · No credit card required · Starter $89/mo · Professional $299/mo · Cancel anytime