Do you find yourself stressed before a surveillance visit? Scrambling to demonstrate compliance? Even when you know you're following procedures, it can be tricky to prove it, especially with an auditor standing in front of you. The scramble isn't a sign the operation is unsafe or that you are non-compliant, but that you’re treating compliance and assurance as the same thing when they’re fundamentally different. Compliance is the evidence that controls existed and were effective at some point in the past, whereas assurance is knowing, right now in real-time, that they're still working. The gap between the two is usually a visibility problem, not a compliance one.
Key takeaways:
- Most operations are already compliant but struggle to easily see or prove it.
- Regulators are shifting toward risk-based, performance-based and continuous oversight, not just fixed periodic audits.
- In practice, assurance looks like one connected source of truth with role-based, real-time dashboards.
Compliance vs assurance: two different questions
According to OneReg Co-Founder and Chief Customer Officer, Carly Waddleton, compliance is about producing evidence that controls existed at a point in time. “Assurance is about knowing, at any point in time, that controls are working as intended,” she says. It’s a subtle distinction with real operational consequences, as outlined in the table below.
Assurance means having ongoing confidence and visibility that your controls hold up in practice today, not just on the day someone checked.
Why Being Compliant Doesn't Guarantee You Can Prove It
As Waddleton puts it, "Compliance is no longer viewed as a standalone function sitting in the background. It has become a strategic part of operational performance and business resilience. We need to move from moment in time to continuos oversight."
That shift is important because most operations don’t have issues with compliance but they do have challenges with proving it at a moment’s notice. Evidence of a working safety management system might live in one checklist tool, corrective actions in someone's inbox, training records in a spreadsheet and document versions in SharePoint. None of this is wrong, but it’s scattered, so when an auditor asks a specific question, someone has to assemble the answer, often under time pressure, often days before the audit itself.
What "Continuous Audit Readiness" Actually Means
Continuous audit readiness means being able to show the controls are working today at any moment, not just reconstructing the answer once every few months when the auditor arrives.
Waddleton frames the shift this way: "It's the operational visibility to be able to know your compliance position at any given point in time, in real time, not just every three years when you get audited and you can say, 'we were safe then.' You're safe today. What's the risk profile today? And you can see it. Think of it as being audit ready, always."
This is what OneReg customers describe once a surveillance visit happens. A regional airport operator summed it up simply after a recent inspection: "We recently went through a CASA surveillance and having OneReg made a real difference."
The Regulators Are Moving This Way
Oversight is shifting from fixed periodic audits toward risk-based, performance-based and continuous safety assurance.
ICAO's Safety Management Manual (Doc 9859) names safety assurance as its own distinct component of a Safety Management System, separate from safety policy, safety risk management and safety promotion. Rather than an add-on to compliance, it's built into the standard as the function that continuously monitors whether an SMS's controls are actually working. Individual regulators are moving the same way.
The UK CAA's performance-based oversight approach commits to modifying "the volume, type and focus of our oversight according to risk and organisational performance", instead of applying the same fixed schedule to every operator regardless of how they're performing. In Australia, CASA's surveillance programme is explicitly risk-based, checking that authorisation holders are managing their safety risks and complying on an ongoing basis, including unscheduled surveillance when something warrants a closer look.
Periodic audits aren’t disappearing, but the basis for oversight is shifting toward risk and demonstrated performance. This rewards operators who can show, continuously, that their controls are working, not just operators who pass a point-in-time check.
Waddleton expects that shift to keep accelerating: "In two to three years, I think we'll look back at this period as the point where digital compliance stopped being a competitive advantage and became table stakes,” she says. “The audit cycle itself will compress from periodic intensive audits toward something closer to continuous oversight. Imagine a regulator with near real time data and an organisation feeling confident in what they see."
What Assurance Looks Like in Practice
With assurance, operators have one connected source of truth with role-based, real-time visibility. That means SMS records, audit and inspection findings, corrective actions, document control, regulatory change tracking and training records are all linked together, so a change in one shows up wherever it matters elsewhere. It also means the right person sees the right view: an executive overseeing four airports can see a real-time picture across all four, while an operations manager at one site sees exactly what's relevant to their own.
OneReg's platform for airport operations is built around this model, as it’s one configurable system that replaces the fragmented tools and spreadsheets most operators are still working around. Every user has access to the right information at the right time, so they can make better-informed decisions and attend to the most critical issues.
The Assurance Maturity Ladder
Broadly, the journey towards assurance maturity looks like four rungs of a ladder:
- Reactive/periodic — compliance is proven only when an audit or inspection demands it, so evidence is assembled after the fact.
- Documented/repeatable — processes and records exist consistently, but they're still fragmented across separate tools.
- Connected/visible — records are linked, so a change in one place is reflected wherever else it matters.
- Continuous assurance — the current state of compliance and risk is visible in real time, to the right person, without anyone having to assemble it.
Most operators sit somewhere between rungs two and three: doing the work, keeping the records, but not yet able to see the whole picture in one place without manual effort. Getting to the top rung doesn’t involve working harder, but connecting what already exists. Wherever your operation sits, it's important to assess where you currently sit on this ladder and what you need to get to the next rung.
Complete Regulatory Assurance
The distinction between compliance and assurance is why OneReg exists. OneReg was built by aviators, with its founders and leadership bringing 100+ years of combined aviation experience. That means the platform starts from how aviation operations actually work, not from a generic GRC framework applied to an unrelated industry. The result is what OneReg calls complete regulatory assurance: not just meeting the rules, but having the real-time visibility to demonstrate, maintain and improve compliance as an everyday state, rather than an audit-time scramble.
Frequently Asked Questions
What is the difference between compliance and assurance?
Compliance is producing evidence that controls existed and met the rules at a specific point in time, typically for an audit. Assurance is knowing, at any point in time, that those same controls are actually working. Compliance looks backward to prove a moment, while assurance looks at the present.
What is regulatory assurance in aviation?
Regulatory assurance is the ongoing confidence that your organisation's controls meet regulatory intent, not just on paper, but in practice, continuously. In ICAO's Safety Management System framework, safety assurance is a named, distinct function that monitors whether an SMS's controls are actually performing as intended.
Is being compliant the same as being safe?
Not necessarily. Compliance is about meeting the minimum the rules require. Assurance is what confirms the controls behind that compliance are genuinely working day to day, which is closer to what "being safe" actually means in practice.
What does continuous audit readiness mean?
It means being able to produce evidence that your controls are working on any given day, not only when an audit is scheduled. Instead of scrambling to reconstruct a picture from scattered records, the evidence is already current and available.
Compliance vs assurance vs audit — what's the difference?
An audit is a point-in-time check against a set of rules or standards. Compliance is the state that the audit is checking for. Assurance — and continuous audit readiness — is what lets you maintain and demonstrate that state between audits, not just during them.
Are aviation regulators moving away from periodic audits?
Regulators including the UK CAA and Australia's CASA are shifting toward risk-based and performance-based oversight, adjusting the intensity of surveillance according to an operator's demonstrated risk and performance rather than applying a uniform fixed schedule. Periodic audits aren't disappearing, but the emphasis is moving toward continuous, risk-informed oversight.
How is assurance related to a Safety Management System?
Safety assurance is one of the four named components of an SMS under ICAO's Safety Management Manual (Doc 9859), alongside safety policy and objectives, safety risk management and safety promotion. It's the ongoing monitoring function that checks whether an SMS's controls are actually working, Assurance isn't an extra step bolted onto compliance, it's built into the standard itself.
Why can a compliant operation still fail an audit?
Because being compliant and being able to prove it in the moment are two different things. If evidence is scattered across separate systems and nobody has consolidated it recently, an operation can be genuinely safe and still struggle to produce a clear, current picture when an auditor asks for one.
Where to Go From Here
Most operators aren't failing at compliance, they're working hard at it every day. What's usually missing is visibility, meaning one place where the evidence already lives and is connected and current, so it doesn’t take days to assemble. That's what closing the compliance vs assurance gap looks like in practice, and it's the foundation OneReg is built on. If you want to see what real-time compliance and risk visibility looks like for your operation, book a demo.
Assurance Maturity Self-Assessment
Where does your operation sit today, and what does the next stage look like?
