< Previous 3-48 Environmental Technical Manual No. Question / Issue Additional information Status: OK/Yes/No /Not Applicable Notes and results of checks 74 Changing of general data? If so, this must be documented. The aeroplane operator should be informed. 75 Have emissions-relevant data been changed? If so, these must be documented. The aeroplane operator is to be informed in any case. 76 Other defects/ comments? Communication with aeroplane operator 77 Hearing necessary? 78 Content of hearing 79 Has hearing been sent? 80 Date of hearing, date of sending 81 Deadline for reply 82 Hearing conclusions Communication with verification body 83 Hearing necessary? 84 Content of hearing 85 Has hearing been sent? 86 Date of hearing, date of sending 87 Deadline for reply 88 Hearing conclusions 3.3.5 Conducting the verification activities It is anticipated that a typical verification will include: a) the collection of evidence to support the Emissions Report through interviews and observation (site visits or remote verification techniques); b) review of the greenhouse gas information system and its controls; and c) comparison of the implemented data flow, procedures, control activities and Fuel Use Monitoring Method against the requirements set out in Annex 16, Volume IV and the aeroplane operator’s Emissions Monitoring Plan. Before initiating the verification activities, however, it is important that the verification team understand the current status of the aeroplane operator’s Emissions Monitoring Plan, and has built up a sufficient understanding of the aeroplane Volume IV. Procedures for demonstrating compliance with the Carbon Offsetting and Reduction Scheme for International Aviation (CORSIA) Chapter 3 3-49 operator’s data flow, procedures and control activities, as detailed in the Emissions Monitoring Plan. These two important considerations are described in more detail below. 3.3.5.1 Status of the Emissions Monitoring Plan The verification body will take the Emissions Monitoring Plan as the starting point to conduct verification activities. This includes an assessment whether the approved Emissions Monitoring Plan is in accordance with Annex 16, Volume IV and whether procedures described in the Emissions Monitoring Plan have been sufficiently implemented by the aeroplane operator (e.g. data flow and control activities). The verification body verifies the Emissions Report against the Emissions Monitoring Plan and assesses whether the Emissions Report is free from material misstatements and material non-conformities. If the aeroplane operator has based its monitoring activities on a not-yet-approved Emissions Monitoring Plan or an updated but not yet approved Emissions Monitoring Plan, the verification body will pay particular attention whether the Emissions Monitoring Plan is in accordance with Annex 16, Volume IV, Part II, Chapter 2, 2.2.2. This has to be considered a very rare situation. However, a State might not always be in the position to approve an update of an Emissions Monitoring Plan on short notice in situations where the aeroplane operator discovers the need for a change to clarify a description between the Emissions Monitoring Plan and the actually implemented process shortly before the verification. In such situations, the verification body has to check whether the changes in the Emissions Monitoring Plan are likely to be acceptable under Annex 16, Volume IV to avoid a verification on the basis of an Emissions Monitoring Plan which is later not considered to be in conformity with the CORSIA MRV requirements. The aeroplane operator should also be advised by the verification body to contact the State to clarify the situation. If an approved (or not yet approved) Emissions Monitoring Plan fails to provide sufficient scope or certainty to design the verification approach, the verification body might conclude that the Emissions Report cannot be verified. It is recommended that the verification body advise the aeroplane operator to immediately contact the State in such cases. 3.3.5.2 Understanding data flow Data flow activities undertaken by the aeroplane operator should be defined in the Emissions Monitoring Plan along with primary data sources and the procedures controlling these data flows. It is essential that the verification body verify along the described data flows of the Emissions Monitoring Plan. The starting point of this verification activity is always the (external and internal) primary data source such as the fuel supplier invoices, fuel uplift statements, flight or technical logs, invoices from air navigation service providers, or ACARS messages. See Table 3-10 of additional examples of aviation data sources and related documentation. 3-50 Environmental Technical Manual Table 3-10. Aviation reference data sources and documentation Examples Categorization Technical explanation Usability rating Airline software systems Secondary internal data — Operational data containing details on flights, loads, routing etc. — Includes already processed data — Potentially internal quality assurance against primary data Medium-Low Flight / technical logs and typically included data Primary internal data — Operational data containing details on flights, loads, routing etc. — High level of reliability as safety relevant — Flight logs can be completed manually (hand written) or automatically High ATC flight plan and OFP Primary internal data — Operational data needed to operate a flight; contains i.e., aeroplane identification, flight route details — Does not provide evidence on fuel consumption or whether the flight has indeed taken place or not Medium Air traffic control data and invoices Primary external data — Operational data containing flight details, aeroplane, routing including speed and altitude — Data generated by third party (ATC); high reliability with sufficient evidence whether a flight took place or not High Fuel invoices Primary external data — Invoice from the fuel supplier (per flight) — Cross check with accounting data possible — Can be used for cross-checking fuel uplift e.g. with data contained in flight/ technical logs and airline software systems High Fuel slips Primary external data — Transaction document (per flight) — Can be used for cross-checking fuel uplift and (sometimes) density e.g. with data contained in flight/ technical logs and airline software systems High Maintenance /downtime records Primary and secondary internal data — Documentation/information in diverse forms, which document the block-off hours of each specific aeroplane due to maintenance or other down-time reasons — Maintenance reports might be necessary to track effects like emptying of tanks or longer periods of inactivity of a specific aeroplane due to technical reasons Medium Volume IV. Procedures for demonstrating compliance with the Carbon Offsetting and Reduction Scheme for International Aviation (CORSIA) Chapter 3 3-51 Examples Categorization Technical explanation Usability rating Fuel density records Primary external data — Usually supplied by external source (e.g. into plane agent, tank farm) — Density sometimes also included in fuel slip — Assessment of actual measuring method important High Blend tickets — Information concerning the blending of CORSIA eligible fuels located within the fuel’s associated Certificate of Analysis or Refinery Certificate of Quality (RCQ) Sustainability documentation — Information concerning CORSIA eligible fuels. Reports generated for other purposes, e.g. sustainability report Secondary internal data — Reports might have undergone data quality checks and verification Medium Wet lease agreements Primary internal data — Including specific CORSIA related information such as provisions on forwarding of fuel and emissions calculations to the lessor High Air operator certificate (AOC) Primary external data — A certificate authorising an operator to carry out specified commercial air transport operations (ICAO Annex 6) — Usually includes fleet information High Flight plans Primary internal data — Needed to operate a flight; contains i.e., aeroplane identification, route details — Planning document only — Does not provide evidence on fuel consumption or whether the flight has indeed taken place or not Low-Medium The verification body should build up a clear understanding of the actual relation of these primary data sources to the data flow, the information system and the data and information handling procedures contained in the Emissions Monitoring Plan (including any intermediate steps such as processing of the data, rounding of data, and interfaces between different IT systems). To assess the inherent risk, the verification body should assess whether the responsible staff of the aeroplane operator demonstrates a sufficient level of knowledge and experience with the specific data flow activities. After a sufficient understanding of the data flow has been achieved, specific emphasis should be given to assessing the procedures controlling the data flows in order to ensure their actual implementation and their effectiveness. This includes, but is not limited to, assessing procedures documented in the Emissions Monitoring Plan related to attributing flights, tracking the fleet and fuel consumption, tracking flights and their status within CORSIA, and handling data gaps, to name but a few. 3-52 Environmental Technical Manual 3.3.5.3 Assessing the GHG information systems and controls The procedures for controlling data flows are defined by the aeroplane operator and included in the Emissions Monitoring Plan. The objective is to ensure the quality of the data and to avoid bias in data processing that can lead to misstatements and non-conformities. In assessing controls, the verification body will compare the implemented control activities against the requirements set out in Annex 16, Volume IV and the aeroplane operator’s Emissions Monitoring Plan to ensure these: a) are present and properly documented and retained; b) reflect the information listed in the summary of the procedures in the approved Emissions Monitoring Plan; c) have been correctly implemented and are up to date; d) are applied throughout the year; and e) are effective to mitigate the inherent and control risks. To check an appropriate implementation of control activities as described in the Emissions Monitoring Plan, the verification body should develop a list of practical examples while accessing primary data sources. On the basis of these examples, interviews with responsible staff of the aeroplane operator can be conducted and/or the behaviour of automatic or manual control activities can be observed. Moreover, the inspection of internal documentation (e.g. internal audits such as the pre-verification approach or procedural instructions) might support the verification body to assess the reliability and robustness of control activities. Within CORSIA it is recommended to especially check the following control activities (including frequency, effectiveness with regard to their implementation, whether they are carried out manually or automatically, different responsibilities for data flow / processes and control activities, and sufficient documentation): a) Quality assurance and procedures for updating State pairs with and without offsetting requirements, as defined in Annex 16, Volume IV, Part II, Chapter 3, 3.1; b) Data filters to identify abnormal or obviously incorrect primary data such as unreasonably low average fuel burns, technically not feasible fuel uplifts, or questionably long downtimes; c) Control activities for avoiding the use of data gap procedures despite the fact that alternative primary data may be available; d) Existing control activities to ensure the consistency and completeness of the flight plan per aeroplane registration (e.g. following a flight from aerodrome A to aerodrome B, and checking that the following flight indeed departs from aerodrome B and not aerodrome C), including the use of invoices from air navigation service providers; and e) Effectiveness of control activities in place for any outsourced processes. After analysing the effectiveness of the control activities and together with the inherent risks related to the data flow activities as described in (a), the verification body has to assess the overall risk for misstatements and non-compliances in the aeroplane operator’s Emissions Report. New observations have to be reflected in the risk analysis and in the verification plan. Volume IV. Procedures for demonstrating compliance with the Carbon Offsetting and Reduction Scheme for International Aviation (CORSIA) Chapter 3 3-53 Testing of IT controls Data on aviation emissions will, most of the time, be collected and analyzed by means of the aeroplane operator’s IT system. Against this background, IT systems play an important role in complying with the CORSIA requirements. Therefore, assessing IT related risk is an essential task for the verification body. IT systems consist of hardware, software, IT environment/organization, IT based processes, IT applications as well as IT infrastructure. IT system related risks can be subdivided as follows: a) Risks associated with IT infrastructure refer to the vulnerability to interference and breaches of information security. This may lead to an increased risk for the collation, transfer, processing, analysis, aggregation, storage and reporting of data; b) Risks concerning IT applications relate to a malfunctioning of these applications, a lack of backup procedures, a lack of input controls, process controls as well as output controls, and possible software coding or scripting errors; c) Risks related to IT processes include a lack of data-flow transparency (black boxes), a malfunctioning of the interface(s), the general risk that control measures only address part of the process, and IT system failures. The latter risk may lead to a failure in data collecting from automated monitoring equipment during the time of the IT system break-down; and d) Human errors may, of course, also lead to risks associated with the aeroplane operator’s IT system. For instance, deleting current emission data by mistake. It is important that the verification body have a good understanding of the potential risks associated with the aeroplane operator’s IT system for complying with the CORSIA requirements. Verification bodies also need to consider whether the IT system and processes are being managed under an effective IT Management System such as ISO/IEC 20000 (ISO /IEC 20000-1:2011 “Information Technology -- Service Management -- Part 1: Specification”; and ISO /IEC 20000-2:2012 “Information Technology -- Service Management -- Part 2 -- Code of Practice”. Also, the appropriate use of calculation formulae and access controls, the possibility of recovering data, continuity planning and security with respect to IT will have to be taken into account by the verification body. The verification body checks the control measures implemented in the IT system and electronic interfaces to provide for: a) timeliness, availability and reliability of data; b) the correctness and accuracy of data, e.g. to avoid, among other things, double counting; c) the completeness of data; d) the continuity of the data to avoid data being lost and to ensure traceability of data; e) access rights: i.e. who has the right to access and modify data; and f) the integrity of data: i.e. to ensure that data are not modified by unauthorized persons. These measures could include a manual check on whether the IT system is functioning and whether the aforementioned points are met. It will include control activities and maintenance tools built into the IT system such as access controls, backups, recovery, continuity planning, change management and security. The type of testing carried out by the verification body depends on whether these control measures are manual or electronic. 3-54 Environmental Technical Manual Testing of outsourced processes by the verification body Even though many parts of the data flow can be outsourced to third parties in principle, the aeroplane operator remains responsible for the data resulting in the Emissions Report. Activities such as flight planning are in fact outsourced by many commercial aeroplane operators. Therefore it is important that the aeroplane operator controls the quality of these activities. In this respect, the verification body has to investigate two questions: Firstly, to what extent has a certain data flow activity been outsourced by the aeroplane operator? Secondly, how does the aeroplane operator control that its service providers carry out their activities in accordance with the necessary quality? The latter refers to conducting tests for e.g. assessing the procedures for procurement, internal audit (including the frequency of audits), carrying out plausibility checks on the data, checking service level agreements with fuel suppliers, instrument engineers, checking how an aeroplane operator ensures that its service providers carry out their activities according to the service level agreement, etc. 3.3.5.4 Assessing CO2 emissions data and information The emissions data and information are usually assessed at the same time as the information system and controls, in accordance with the verification and sampling plans. If any issues that have the potential to lead to an error, omission or misrepresentation are identified during the collection of evidence, the sampling and testing activities can be amended to gather more evidence. For example, if one data sample proves to have discrepancies, the sample number may increase for the data set. Examples of things to consider when assessing the data and information include: a) Completeness, consistency, accuracy, transparency, relevance and conservativeness of the greenhouse gas information, including raw data; b) Application of the Annex 16, Volume IV emissions monitoring and reporting requirements by the aeroplane operator in accordance with the Emissions Monitoring Plan; and c) Maintenance and calibration programme for measurement and monitoring equipment. The verification body should be aware that verifications within the CORSIA involve large amounts of data. Depending on the monitoring method (and other factors) more than 10 data points per flight can be needed to calculate CO2 emissions and attribute these emissions correctly within CORSIA. Consequently, actual data verification by using analytical procedures should always be the dominating part of the entire verification engagement. This also includes the check between primary data (e.g. fuel invoice or uplift statement) against corresponding data in the IT systems of the aeroplane operator. The sampling technique and method (number of samples) is based on the results of the risk analysis which has to be adjusted if for instance the samples reveal an insufficient data transfer process between the primary data and the corresponding value in the IT systems of the aeroplane operator (whose values do not match). The sampling has to be representative of the overall population (reporting year and control activities in place). The sample size will be stated in the Verification Report. It is highly recommended to use computer assisted auditing techniques and not rely solely on samples. Despite the comparison between primary data and the data included in the IT system (and later processed in the Emissions Report) of the aeroplane operator, it is important to also develop an understanding of the data quality of all data which will be used to calculate the emissions figures in the Emissions Report. Therefore, it is absolutely essential that the verification body have a sufficient understanding and also practical experience in applying analytical procedures to large datasets. In most cases it will be necessary that the verification body request the aeroplane operator to provide an export file of all relevant data from the IT system of the aeroplane operator in order to apply cross and consistency Volume IV. Procedures for demonstrating compliance with the Carbon Offsetting and Reduction Scheme for International Aviation (CORSIA) Chapter 3 3-55 checks. Verification bodies should develop a set of standard cross checks already implemented in an appropriate spreadsheet software. This allows verification bodies to instantly calculate key indicators regarding data quality and consistency by simple copy paste of data in the spreadsheet software. Data supplied by the aeroplane operator can be split into separate files if the spreadsheet software is not capable of processing large amount of data sets. The verification body should invest a sufficient amount of time in developing its own appropriate cross checks, this can include for example: a) Calculation of average fuel burns and applying them on individual flights as reference (check whether maximum, minimum and average fuel burn per hour is reasonable or can be explained by aeroplane operator); b) Maximum tank capacity and uplift per flight; c) Average fuel burn according to aeroplane age; d) Calculation of average densities, including graphical representation to identify any data pattern, average fuel density at specific aerodromes and potential deviations; e) Expected fuel burn for data gaps in comparison to estimated emissions; f) Tracking of aeroplane registrations within the aeroplane operator’s data to check consistency of data; g) Use of data (e.g. invoices) from air navigation service providers if available in a digital format; and h) Checks to ensure the correct set of State pairs included in the offsetting requirements of the CORSIA. 3.3.5.4.1 Fleet and operations data Critical to the verification is confirmation that the aeroplane operator has correctly identified all of its international flights for accounting purposes in the CORSIA. Verification of the flight data set should include: a) Comparing the fleet provided in the Emissions Report, and therefore being used to track CORSIA-related flight activities, with the information of the applicable air operator certificate(s) throughout the reporting period; b) Identification of lease agreements within the reporting year and their impact on the reported emissions, including contractual beginning and end of lease, cause for lease, responsibilities, data transfer, and applicable control procedures; c) Systematic cross-checks with air traffic control invoices; d) Confirmation of the attribution method used by the aeroplane operator to ensure that all international flights during the reporting year have been appropriately accounted for including data filters or procedures used to determine the correct offsetting requirements under the CORSIA for a specific year (included and excluded State pairs); 3-56 Environmental Technical Manual e) Confirmation that the aeroplane operator has correctly applied technical exemptions, including internal attribution of specific flight service types such as humanitarian and medical which qualify for an exemption under the CORSIA, are assigned correctly and in accordance with the Annex 16, Volume IV. Data filters used for exempted flights are working properly; and f) Evaluating the completeness and accuracy of the data set. Further considerations related to each of these are detailed below. Reported aeroplane fleet The verification team should compare the fleet of aeroplanes reported in the Emissions Report with that reported in the Emissions Monitoring Plan for the purpose of identifying any major differences between the two. For the most part, differences are expected and would not be considered material. If a major difference is identified, for example, where very few of the aeroplane listed in the approved Emissions Monitoring Plan appear to have been used during the actual reporting year, the verification body should investigate further. Both commercial fleet databases and free solutions available online may help building up confidence in the actual fleet size and composition. Flight attribution The verification body must confirm that all flights have been accounted for and attributed appropriately to the aeroplane operator. In this context, it is important to check that all flights are included in the reporting. As a basis for such a check, the verification body must understand how flights are to be attributed to aeroplane operators in the CORSIA framework. The Emissions Monitoring Plan requires that aeroplane operators specify the means for having its international flights attributed to it. Accordingly, the Emissions Report should specify any differences from the Emissions Monitoring Plan. Two potential means of flight attribution are possible. These are as follows: a) ICAO Designator: where the ICAO Designator (or Designators) is used in Item 7 of the operator’s flight plans as means for flight attribution. It should be noted that more than one ICAO Designator may only be used by an aeroplane operator in exceptional cases where the State has explicitly approved this; and b) Registration marks: where the operator does not use an ICAO Designator, but rather, uses the nationality or common mark, and the registration mark of the aeroplane in Item 7 of the flight plan as a means for flight attribution. This option requires that the operator possess an AOC and that a copy of this AOC be provided with the Emissions Monitoring Plan to the State. Using a risk-based approach, the verification body should conduct verification activities focused on testing the accuracy and reliability of the attribution method used by the aeroplane operator to ensure that all international flights during the reporting year have been appropriately accounted for. This includes access to the aeroplane operator’s flight operations management software and databases, interviews with responsible staff of the aeroplane operator, as well as cross-checks with air traffic control invoices. In the context of aeroplane designation, the verification body should be aware of the following: a) In many cases, persons or firms are shown as (business) aeroplane owners in a State’s aeroplane register. These may not be the actual aeroplane operator; Volume IV. Procedures for demonstrating compliance with the Carbon Offsetting and Reduction Scheme for International Aviation (CORSIA) Chapter 3 3-57 b) An aeroplane registration may be shown on more than one Emissions Report, as the aeroplane concerned may be operated by a number of aeroplane operators during the same year; c) Some State aeroplane registries reissue aeroplane registrations during the year. It is therefore possible for more than one aeroplane to carry the same registration during a reporting year; d) An aeroplane operator with a wholly owned subsidiary aeroplane operator that is legally registered in the same State can be treated as a single consolidated aeroplane operator liable for compliance with the requirements under CORSIA. If such a consolidated approach is taken for a group of carriers, verification has to be conducted at the group level and not at the individual aeroplane operator level; and e) Leasing arrangements including code sharing, dry leasing, wet leasing and long or short term leasing should have no bearing on flight attribution. The ICAO Designator in Item 7 of the flight plan or, if the ICAO Designator is not available, the registration mark of the aeroplane is the determining factor for assessing whether a flight falls under the responsibility of an aeroplane operator to monitor and report on that particular flight. If it cannot be determined by the ICAO Designator or the registration mark that a particular flight falls under the responsibility of an aeroplane operator, the flight should be allocated to the owner of the aeroplane. Data set completeness and accuracy An important verification activity includes assessing the completeness of the reported flight data set to provide assurance that the aeroplane operator has appropriately accounted for its international flights in its Emissions Report. This requires access to the aeroplane operator’s traffic data, and may also be assisted by timetable data and other data on aeroplane operator’s traffic from e.g. air traffic control sources. It should be noted that timetable and other data submitted within the CORSIA framework (Emissions Monitoring Plan, Emissions Report) may not always be a perfect match, (e.g. because data from external providers may not be totally aligned with the applicability requirements of Annex 16, Volume IV, because a flight included in a timetable may not actually be operated on a given day or because the geographical scope of external data may not be fully consistent with the geographical scope of the CORSIA). The verification body also needs to check the procedures and control activities that the aeroplane operator has in place to ensure completeness of flights. Short-term aeroplane leasing arrangements (either dry or wet leased) can increase the verification risk depending on their complexity. Hence, the verification team should be aware of any leasing arrangements and should confirm that international flights using leased aeroplane are appropriately accounted for in the Emissions Report. In general, the collection of data by the aeroplane operator is regulated through the leasing agreement. During the verification, the verification body will check the control activities the aeroplane operator has in place to ensure accurate data is transferred (e.g. leasing agreements, cross-checks on manual input of collected data in internal systems, electronic interface if IT systems are used etc.). To ensure reproducibility of the determination of the emissions by verification bodies or the State, the aeroplane operator will ensure that data on the leased aeroplane is documented. Application of technical exemptions Annex 16, Volume IV, Part II, Chapter 2, 2.1 defines the scope of applicability of MRV requirements and also includes specific exemptions. During the verification, the verification body has to check whether the aeroplane operator has indeed applied the scope of applicability and exemptions correctly. It is not sufficient to just rely on the applied filters in the flight database to identify or mark specific flights that are outside the scope of applicability. The aeroplane operator Next >