Vendor oversight for Part 135 operators: what auditors look for, and what the 2027 SMS deadline changes
ARGUS, Wyvern and IS-BAO audits, insurers and charter clients all ask the same question in different words: how do you know the companies touching your aircraft are qualified and covered? With the FAA's SMS deadline for Part 135 operators arriving May 28, 2027, here is how to build vendor records that hold up.
Taxi route 6 sections
The question behind every audit
Safety auditors, insurers and charter clients use different checklists, but they converge on the same thing. If a fueler, caterer, cleaner, mobile technician or car service touches your aircraft or your passengers, can you show:
- that you decided in advance what that kind of vendor must have,
- that this vendor met it on the day they did the work,
- and that someone would have noticed if they stopped meeting it?
Most operators can answer the first point. The second and third are where binders and spreadsheets fall apart, because certificates expire on their own schedule and outstation vendors change from trip to trip.
What the SMS rule changes, and what it doesn’t
The FAA’s final rule, published in 2024, extends Part 5 safety management system requirements to Part 135 operators and certain Part 91 operators. Existing certificate holders have until May 28, 2027 to have a compliant SMS in place, and the accountable executive signs a declaration of compliance. Inspectors have already started asking for evidence that the system is in use, not just written down.
The rule doesn’t hand you a vendor checklist. What it does is require you to identify hazards, assess risk, put controls in place and check that they work. Contractors and vendors are a hazard source like any other. A vendor control that exists only as a paragraph in your manual will be hard to evidence. A vendor control that produces a dated record every time a vendor is checked is easy.
Building a vendor record that holds up
Step one: sort vendors by what they touch
Not every vendor needs the same scrutiny. A practical split:
| Category | Examples | Why it matters |
|---|---|---|
| Touches the aircraft | Fuel, maintenance, avionics, cleaning, de-icing, lav service | Airworthiness, damage and contamination risk |
| Touches passengers or crew | Car services, catering, hotels | Safety, security and service risk |
| Works in your facility | Facility contractors, janitorial, security | Hangar access, property and security risk |
Step two: write the requirement once per category
For each category, write down the coverage types and limits, the endorsements (your company and, where your agreements require, your aircraft owners as additional insured), training, and any background check standard for people entering your hangar. Start from the airport’s published minimums and the FBO’s rules, then add your own. Our requirement layers example shows how those stack.
Step three: collect evidence, not promises
Certificates, endorsement pages, training records and badge status, each with an expiration date. Our guide to reading a certificate of insurance covers what to check, and the guide to additional insured and waiver of subrogation covers the wording that decides who pays.
Step four: check at the point of use
The record that matters most is the one from the day the vendor did the work. At home base, that means checking at the front desk or the hangar door. At an outstation, it means confirming the FBO’s vendor is current before the trip, not after an incident.
Step five: review and keep history
Expired items should be visible the day they expire, and old records should be kept, because an auditor or an insurer may ask what was on file eighteen months ago.
Outstations are the hard part
At home base you can know your vendors personally. On the road, the caterer, the car service and the cleaning crew are usually arranged through the FBO, and you may never see their paperwork. Two things help:
- Ask FBOs what they require of their vendors, and whether it meets your standard. Many FBOs already hold requirements from fractional customers that are stricter than yours.
- Look up the airport’s published rules before the trip. Our requirements library covers the busiest business aviation airports in the US.
Where ClearedVendor fits
ClearedVendor keeps the vendor side of your SMS current: your requirement sets layered on the airport’s and FBO’s, live status for every vendor, renewals chased automatically, and a one-click export of vendor records for an audit or an insurer review. It doesn’t replace your SMS software or your manual. It keeps the evidence those systems need. See the operators page for the details, or join early access.
Questions people ask
When is the SMS deadline for Part 135 operators?
Under the FAA’s 2024 final rule extending Part 5, existing Part 135 certificate holders must have a compliant safety management system in place by May 28, 2027.
Does SMS require vendor oversight?
The rule requires operators to identify hazards, assess risk and apply controls. Contractors and vendors who work on aircraft or with passengers are a source of hazards, so most operators include vendor qualification and monitoring in their SMS.
What do ARGUS, Wyvern and IS-BAO auditors look for in vendor records?
Each program has its own standard, but auditors commonly look for defined vendor requirements, evidence that vendors met them, and a process for catching expired insurance or training. Current, dated records for each vendor make that straightforward.
This guide is general information, not regulatory or legal advice. Refer to 14 CFR Part 5, FAA guidance and your audit program’s current standards.