Most certification schedules are not set by the engineering plan. They are set, months earlier, by a column in the certification programme that says how each requirement will be shown.
Analysis or test. Similarity or new substantiation. Design review or flight test. That choice — the means of compliance — decides which documents get written, which rigs get booked, which specialists get involved, and how closely the authority expects to look.
Then the design moves on. A load case changes, a similarity argument stops holding, a test result comes back marginal, a supplier cannot qualify equipment the way everyone assumed. The means of compliance quietly changes in an engineer's head, in a spreadsheet, or in a meeting nobody minuted — and the certification programme the authority agreed to describes a project that no longer exists.
This article explains why means of compliance drift is one of the most expensive late surprises in Part 21J work, how it happens on otherwise well-run projects, and how to treat each MoC as a controlled decision rather than a planning assumption.
Why the MoC Is a Schedule Decision
For a major change, STC, or major repair, the certification programme breaks the work into compliance demonstration items. Each item names the requirements it addresses, the proposed means of compliance, and the compliance documents that will carry the evidence. EASA guidance uses a standard set of codes for the means:
| Code | Means of compliance | What it usually drives |
|---|---|---|
| MC0 | Compliance statement, reference to design data, election of methods, definitions | Document effort; relies on design data already being right |
| MC1 | Design review | Descriptions and drawings that must stand on their own |
| MC2 | Calculation / analysis | Validated methods, substantiation reports, analyst time |
| MC3 | Safety assessment | Safety analyses that depend on a stable architecture |
| MC4 | Laboratory tests | Test plans, specimens, lab slots, test reports |
| MC5 | Ground tests on related product(s) | Aircraft or rig availability, conformity, witnessing |
| MC6 | Flight tests | Flight test planning, permits, crew, weather, aircraft time |
| MC7 | Design inspection / audit | Inspection reports, physical access |
| MC8 | Simulation | Simulator credibility and validation evidence |
| MC9 | Equipment qualification | Qualification evidence, often from suppliers |
The applicant also supplies the information the authority uses to decide its level of involvement: how novel and complex each item is, how likely an unidentified non-compliance would be, and how much it would matter. EASA decides its involvement from that proposal.
Put those together and the point is obvious: changing the means of compliance changes the work, the evidence, the schedule, and potentially the authority's involvement — all at once. An MC2 analysis that becomes an MC4 test is not a documentation edit. It is a new specimen, a new lab slot, a new test plan, and possibly a new witnessing conversation, usually discovered when the calendar has no slack left.
Minor changes approved under the office's own privileges follow the same logic internally. The authority may not be involved, but the office still declares compliance by some means — and that declaration is only as good as the means behind it.
How Means of Compliance Drifts
Nobody decides to let the certification programme go stale. Drift accumulates through ordinary project events.
Optimistic Early Choices Are Never Validated
At programme start, similarity and analysis look cheap. The MoC is proposed as MC0 or MC2 on the assumption that a previous substantiation applies, or that an analysis method is acceptable. Nobody records what would have to be true for that assumption to hold — so nobody notices when it stops being true.
The MoC Lives in Two Places
The certification programme the authority holds says one thing. The team's working compliance matrix says another. They were identical on the day the programme was submitted; within weeks they diverge, because the spreadsheet is edited and the programme is not. This is the same decay described in requirement-to-evidence traceability, applied to the most schedule-sensitive column in the matrix.
Design Changes Invalidate the Plan Silently
A design change that alters load paths, materials, or system architecture may make the agreed MoC insufficient. If change impact assessment only asks "which drawings move?" and never "which compliance demonstration items does this touch?", the MoC stays nominally agreed while technically obsolete. That is the downstream version of the late-discovery trap in change classification.
Test Results Force a Switch Nobody Records
A marginal test result leads to additional analysis, or a failed analysis leads to a test. The engineering response is right. The record is wrong: the certification programme still shows the original MoC, and nobody can say when the change was decided, by whom, or whether the authority was told.
Supplier Evidence Is Assumed, Not Confirmed
MC9 equipment qualification often depends on a supplier's evidence. If the office assumed qualification data would cover the installation and it does not, the means has to change late — the same ownership gap covered in supplier design data.
Agreements Happen in Meetings
The authority specialist accepts an alternative approach in a technical meeting. Everyone leaves aligned. Three months later, the minutes are not in the record, the person who attended has moved project, and the agreement cannot be shown.
What a Late MoC Switch Costs
| Failure mode | What it looks like | What you pay |
|---|---|---|
| Unvalidated similarity | MC0/MC1 argument rejected at document review | New substantiation or test, written under deadline |
| Analysis-to-test switch | Method not accepted or margins too thin | Specimens, lab slots, test plan, report — weeks to months |
| Stale certification programme | Programme shows MoC the team abandoned | Credibility loss; programme revision and re-review |
| Unrecorded agreement | "EASA agreed in the meeting" with no minute | Re-litigation of a settled decision |
| Silent design impact | Design change breaks an agreed MoC | Late discovery during compliance document review |
| Supplier evidence gap | Qualification data does not cover your installation | New qualification work outside your control |
The biggest cost is rarely the extra test itself. It is that the switch is discovered when compliance documents are being finalised — the point in the programme where every week is already allocated, and where reopening the certification programme feels like admitting the plan was wrong.
Treating the MoC as a Controlled Decision
Offices that avoid late MoC surprises do not have better engineers. They treat each means of compliance as a decision with a lifecycle, not a cell in a planning sheet.
One Record per Compliance Demonstration Item
Each item has a single MoC record: the requirements covered, the chosen means, the compliance documents expected, the owner, and the current status. Not one version in the programme and another in a spreadsheet — one record that both the programme and the working matrix are derived from.
Rationale and Validity Conditions
Every MoC carries a short rationale and the conditions that must stay true for it to remain valid: similarity holds while the attachment geometry is unchanged; analysis acceptable if the method is validated against the previous test campaign. Validity conditions turn a hidden assumption into something a change can visibly break.
Explicit States and a Freeze Point
A simple lifecycle is enough: proposed → agreed → frozen. "Agreed" means the authority (or, for internal work, the responsible compliance role) has accepted it, with the evidence of that acceptance attached. "Frozen" means downstream work — test planning, document production, rig booking — has started against it, and changing it now requires a recorded decision with impact.
Change Triggers That Reopen the MoC
The MoC record is reopened automatically when something that touches it changes: a design change affecting the item, a test result outside expectation, a supplier evidence gap, or an authority comment. Reopening does not mean the MoC changes. It means someone with authority confirms it still holds — on the record.
Authority Communication on the Record
When a certification programme revision is sent, the record shows what changed and when. When an alternative is agreed in a meeting, the minute is attached to the MoC it changed. "We agreed it" becomes "here is where we agreed it."
Baselines at Programme Milestones
At each programme milestone, the MoC set is captured alongside the design state, so the office can show what it planned to demonstrate and how, at the point it made commitments. That is the role certification milestone baselines play for documents, applied to the compliance plan itself.
A Practical Path for Active Programmes
You do not need to restructure every programme at once. Start where the schedule risk is highest.
- Reconcile the programme with the working matrix. For each active project, compare the MoC column in the certification programme as last sent with the team's working copy. Every difference is either an unrecorded decision or an error.
- Mark assumption-heavy items. Flag every item resting on similarity, an unvalidated method, or supplier evidence not yet received. These are where late switches come from.
- Write validity conditions for the flagged items. One or two sentences each. If nobody can write them, the MoC is a hope, not a plan.
- Add MoC impact to change assessment. Every new change asks which compliance demonstration items it touches, not only which documents.
- Introduce the freeze point. Before booking a test or starting a compliance document, the MoC moves to frozen with a named owner. Changes after that point need a recorded decision.
- Attach authority agreements. Back-fill the most important meeting agreements now, while the people who attended still remember them.
Offices that start with step 5 alone tend to create a freeze nobody trusts. Reconciliation first gives the freeze something real to protect.
Signals Your MoC Plan Is Drifting
- The certification programme and the compliance matrix disagree, and nobody is sure which is current
- "We'll cover it by similarity" appears without a written statement of what makes it similar
- Test bookings are made against MoC choices the authority has not yet seen
- Design changes are assessed for drawings and documents, never for compliance demonstration items
- Authority agreements are remembered, not recorded
- The last certification programme revision was sent months before the design last changed materially
- Supplier qualification evidence is "expected" for items whose MoC depends on it
If two or more of these are true, the schedule is resting on means of compliance that may no longer be valid — and the discovery will arrive at document review, not before.
Final Takeaway
The means of compliance is not an administrative label on a requirement. It is the decision that sets the evidence plan, the test calendar, and the authority's expectations for each part of the programme.
When MoC choices live in a spreadsheet, a meeting memory, and an outdated programme at the same time, the office finds out which one was true at the worst possible moment. When each MoC has one record, a rationale, validity conditions, a freeze point, and triggers that reopen it, late switches become early decisions — still sometimes painful, but made while there is schedule left to absorb them.
The practical test is simple: for any compliance demonstration item on an active programme, can you show — without archaeology — the current means of compliance, why it was chosen, what would invalidate it, who agreed it and where, and whether anything has changed since? If yes, the certification programme describes the project you are actually running. If not, the schedule is built on a plan nobody is still following.