Drone Ops Consultants

Drone compliance audits

Internal audit and regulator visits

A compliance audit checks whether a drone operator does what its authorization, operations manual and the regulations say it does. It can be internal, run by the operator or someone it hires, or external, run by a regulator, a client or an insurer. The ground covered is much the same either way: complete records, current pilots, maintained aircraft, valid insurance, and day-to-day practice that matches the paperwork.

This guide covers what an internal audit should look at, how UK CAA, EASA-system and FAA oversight works, how to prepare, how to deal with findings, and how often to audit. The regulatory facts were checked against the regulators' own pages in October 2026.

Vetted consultants

2 results

Pegasus Vectoring

London, GB

Pegasus Vectoring provides specialist consultancy for organisations developing and operating unmanned aircraft systems (UAS) in the Specific Category. They guide clients from initial operational concept through SORA development, regulatory authorisation, and ongoing compliance assurance, ensuring safe, practical and regulator‑defensible capabilities. Services include operational design, airspace and ground environment assessment, SORA and operational authorisation support, competence development

Pegasus Vectoring Limited is an independent specialist consultancy helping organisations develop safe, practical and regulator-ready unmanned aviation capabilities. We start with the client’s operational need—not a predetermined regulatory solution. Working collaboratively, we define the objective, characterise the operating environment and develop a proportionate operational and regulatory strategy. Our support extends from early feasibility and concept development through risk assessment, OSC and SORA applications, operational documentation, findings resolution and ongoing assurance. Our experience includes BVLOS operations within Atypical Air Environments, critical infrastructure and heavy-lift UAS. Led by a former airline captain with 23 years of aviation experience and UK CAA and UAE GCAA Airline Transport Pilot Licences, Pegasus combines operational judgement with structured regulatory analysis. Our aim is not simply to secure an approval, but to help clients establish a safe, sustainable and scalable operational capability.

CAA
Compliance audit

Vaspba Remote Piloted Systems Ltd

Winfrith, GB

CAA Regulatory Consultancy | Agriculture | Heavy Lift | BVLOS | Drone Forensics & Expert Witness Support

Vaspba Remote Piloted Systems Ltd is a UK specialist in uncrewed aircraft systems, regulatory consultancy and operational support. We assist organisations with CAA Operational Authorisations, PDRA and SORA applications, ConOps, Operations Manuals, risk assessments, compliance evidence and BVLOS projects. Our services also include independent drone accident investigation, flight-log analysis, technical reporting and expert-witness support for legal, insurance and commercial disputes. With practical experience in UAS design, integration, testing, servicing and operations, we provide evidence-based advice grounded in real-world aviation and engineering experience.

CAA

What an internal audit checks

An internal audit compares what your documents say, what your records show, and what your crews actually do. Start with the conditions on your authorization, waiver or certificate, then work down to the evidence for each one. A practical scope covers:

  • Operations manual against practice: the current version is the one crews carry, and site surveys, checklists and briefings follow it
  • Flight records: date, location, pilot, aircraft and flight time logged for every flight, in the operator's name
  • Pilot competence and currency: qualifications held, recurrent training or test dates, and recent flying hours
  • Maintenance: a log for each aircraft, defects recorded and closed, and work done to the manufacturer's instructions
  • Insurance: a policy in force, in the right name, covering the aircraft and the work you actually fly
  • Authorization conditions: every limit and mitigation in your authorization, with evidence that you meet it
  • Occurrence reports: incidents reported to the regulator where the rules require it, and followed up internally

Regulator oversight and inspections

Under UK Regulation (EU) 2019/947, the CAA must run a risk-based oversight system for operators that hold an operational authorization or a light UAS operator certificate (LUC). For operations outside the open category, it plans audits based on each operator's risk profile, compliance level and safety performance, and carries out inspections. The EU version of the regulation places the same duties on the competent authority in each state that applies it.

For PDRA01 holders, the CAA describes targeted compliance assessments that can happen at any time during the 12-month validity of the authorization. The operator is contacted by email and has 28 calendar days to send an evidence pack. This includes the operations manual, pilot qualification and currency details, Operator ID and Flyer IDs, and the site surveys, flight logs and maintenance logs for the last three flights. The CAA says the authorization will be suspended if the evidence does not arrive in time, or if the documents are not in the name of the operator on the authorization.

In states applying the EU regulation, point UAS.SPEC.090 requires a specific category operator to give any person authorized by the competent authority access to its facilities, UAS, documents, records, data and procedures. This applies even where the activity is contracted to another organization. Each authority runs its own oversight process, so check your authority's guidance.

In the United States, 14 CFR 107.7 requires the remote pilot in command to carry their remote pilot certificate and identification, and to show them on request to the FAA, the NTSB, the TSA or law enforcement. On request, the remote pilot, owner and operator must make available any document, record or report the regulations require them to keep, and let the FAA test or inspect the aircraft and the crew. Holders of a Part 135 certificate face wider oversight: section 135.73 requires the certificate holder and its staff to allow FAA inspections or tests at any time or place.

Preparing for an audit, and handling findings

The best preparation is records kept up to date as you fly. Keep documents in the name on your authorization, store them where they can be found quickly, and make sure crews carry the current manual. Before an external audit, run your own check against the list the auditor will use, such as the CAA's PDRA01 evidence pack. For FAA operations, check that each remote pilot has passed the knowledge test or completed recurrent training within the previous 24 calendar months (107.65), and that any event needing a report under 107.9 was reported within 10 calendar days.

CAA oversight reports separate Observations, which suggest good practice and need no reply, from Findings, which need corrective action by a target date. A Level 2 Finding is not an immediate safety concern but could become one. A Level 1 Finding is an immediate safety concern, and for PDRA01 holders it suspends the authorization at once. The suspension may be lifted if all Level 1 Findings are closed by the target date.

Whoever raised it, handle each finding the same way. Find the cause, change the procedure or document, show that the change is in use, and reply quoting the finding number. Under Regulation (EU) 2019/947, an LUC holder's safety management system must include an independent function that monitors compliance and feeds findings back to the accountable manager so corrective action is carried through.

Client and insurer audits, and how often to audit

Larger clients often check a drone supplier before awarding work, through a pre-qualification questionnaire, a document request or a site visit. Insurers may ask similar questions at proposal or renewal. Both usually want the evidence a regulator would ask for: the authorization and its conditions, insurance certificates, pilot records, maintenance logs and the operations manual. One audit-ready set of records lets you answer each request without rebuilding it.

The regulator pages checked for this guide do not set a fixed interval for an operator's own internal audits. A sensible baseline is a full audit once a year, timed ahead of renewal, plus a targeted check after any change to aircraft, crew, procedures or authorization, and after any occurrence. Under the UK PDRA01 authorization, records of pilot qualifications and training and other safety documents must be kept for at least 3 years, so an audit can look back that far.

What a consultant does, and what to ask before hiring

A consultant can run an independent internal audit, prepare you for a regulator's assessment, help close findings, and help answer client or insurer questionnaires. They cannot sign off your compliance on the regulator's behalf or promise an audit outcome: the regulator decides. Operators can compare vetted consultants on DOC, where regulator experience is shown as verified only where it has been evidenced. Useful questions to ask:

  • Which regulators' oversight processes have you prepared operators for, and how recently?
  • Will you audit against our own authorization conditions, or a general checklist?
  • Do you trace real flights through our records, or review documents only?
  • What does your report look like, and will you help us close the findings?
  • Have you audited operators of our size and type of work?

Common mistakes

Each of these can turn a routine audit into a finding:

  • Records held in a pilot's or another company's name instead of the operator's on the authorization
  • A manual that no longer matches practice because a procedure changed and the manual was not updated
  • Logging flights but keeping no maintenance log for an aircraft because no work was done on it
  • Losing track of pilot currency, such as recent flying hours or the FAA's 24-month recurrent training
  • Insurance that has lapsed, or does not cover the aircraft or work being flown
  • Missing the deadline for an evidence request or a finding's target date
  • Fixing the symptom of a finding without changing the procedure that caused it

Common questions

What is a drone compliance audit?

It is a structured check that an operator's flying matches its authorization, operations manual and the regulations that apply. It looks at records, pilot competence and currency, maintenance, insurance and occurrence reporting, usually by tracing real flights through the paperwork. It can be run internally, by a consultant, or by a regulator, client or insurer.

How does the CAA check PDRA01 operators?

The CAA runs targeted compliance assessments that can happen at any time during the authorization's 12-month validity. Selected operators are emailed and have 28 calendar days to send evidence, including the operations manual, pilot qualification and currency details, and site surveys, flight logs and maintenance logs for the last three flights. Missing the deadline leads to suspension of the authorization.

Can an authority in an EASA state inspect my operation?

Yes. Regulation (EU) 2019/947 requires competent authorities to run risk-based oversight, plan audits and carry out inspections for operations outside the open category. Point UAS.SPEC.090 requires specific category operators to give anyone authorized by the authority access to facilities, aircraft, documents, records, data and procedures, including activity contracted to another organization. Each authority runs its own process, so check its guidance.

What records does the FAA expect a Part 107 operator to show?

Under 14 CFR 107.7, the remote pilot in command must carry their remote pilot certificate and identification and present them on request. The remote pilot, owner and operator must make available to the FAA any document, record or report the regulations require them to keep, and allow the FAA to test or inspect the aircraft and crew. An audit should confirm those records exist and can be produced quickly.

How often should we run an internal audit?

The regulator pages checked for this guide do not set a fixed interval for internal audits under an operational authorization. A sensible baseline is a full audit once a year, ahead of renewal, plus a targeted check after any change to aircraft, crew, procedures or authorization, and after any occurrence. An LUC holder must also have an independent compliance monitoring function in its safety management system.

What happens if the CAA raises a finding?

The oversight report sets a target date for each Finding, and you must report the corrective action, explaining what changed and quoting the finding numbers. A Level 2 Finding must be closed by its target date. For PDRA01 holders, a Level 1 Finding is an immediate safety concern and suspends the authorization at once. The suspension may be lifted if those findings are closed in time.