Registration Management Committee (RMC) Workshop – June 21 - 22, 2007 “Regulatory Requirements” Federal Aviation Administration Supplier Control Audit

Registration Management Committee (RMC)Workshop – June 21 - 22, 2007“Regulatory Requirements”

Federal Aviation AdministrationFederal Aviation Administration

Supplier Control Audit (SCA)Supplier Control Audit (SCA)

Presented by:Presented by: Ed BayneEd BayneBoeing Enterprise and Industry Interface RepresentativeBoeing Enterprise and Industry Interface Representative

Prepared by:Prepared by: Brian SimonsBrian SimonsBoeing Oversight RepresentativeBoeing Oversight Representative


What is an SCA?What is an SCA?

• FAA Order 8120.2, Part 3, section 124. Certificate Management Activity:FAA Order 8120.2, Part 3, section 124. Certificate Management Activity:

– Certificate management activity will be focused on the Production Certificate management activity will be focused on the Production Approval Holder’s (PAH) control of its suppliers.Approval Holder’s (PAH) control of its suppliers.

– The FAA will determine if a PAH (e.g. The Boeing Company) is The FAA will determine if a PAH (e.g. The Boeing Company) is complying with its supplier control system by performing the complying with its supplier control system by performing the following activities:following activities:

• b. b. Supplier Control Audit. Supplier Control Audit. The Principle Inspector (PI) will The Principle Inspector (PI) will determine that the supplier complies with purchase order and/or determine that the supplier complies with purchase order and/or quality requirements.quality requirements.


What is an SCA? (Cont.)What is an SCA? (Cont.)

• FAA Order 8120.2, Part 6. Supplier Control Audit, section 139. General:FAA Order 8120.2, Part 6. Supplier Control Audit, section 139. General:

– A SCA is conducted as part of the Certificate Management of the A SCA is conducted as part of the Certificate Management of the PAH (e.g. The Boeing Company PC700).PAH (e.g. The Boeing Company PC700).

– Evaluates the outside sources’ (e.g. supplier) system to control Evaluates the outside sources’ (e.g. supplier) system to control parts, materials, supplies, and services.parts, materials, supplies, and services.

– The SCA determines that the supplier complies with purchase order The SCA determines that the supplier complies with purchase order and/or quality requirements, including any statistical sampling that and/or quality requirements, including any statistical sampling that may be utilized.may be utilized.


What are the results of an SCA?What are the results of an SCA?

• FAA Order 8120.2, Part 3, section 125. Determination of Supplier Control:FAA Order 8120.2, Part 3, section 125. Determination of Supplier Control:

– The PI determines whether a PAH is controlling its suppliers by The PI determines whether a PAH is controlling its suppliers by reviewing the results of the supplier control audits.reviewing the results of the supplier control audits.

– The PI looks for evidence that may indicate a system breakdown in The PI looks for evidence that may indicate a system breakdown in supplier control by the PAH.supplier control by the PAH.

– Corrective action is requested for a system breakdown.Corrective action is requested for a system breakdown.


What are the results of an SCA? (Cont.)What are the results of an SCA? (Cont.)• If the FAA identifies evidence indicating a system breakdown in supplier If the FAA identifies evidence indicating a system breakdown in supplier

control, a Letter of Investigation (LOI) or Surveillance Evaluation Reportcontrol, a Letter of Investigation (LOI) or Surveillance Evaluation Report(SER) is issued to the PAH.(SER) is issued to the PAH.

• LOI vs. SER depends on the severity of the issue(s)LOI vs. SER depends on the severity of the issue(s)

• The LOI/SER informs the PAH that the FAA is investigating the matter.The LOI/SER informs the PAH that the FAA is investigating the matter.

• The LOI/SER describes each of the identified nonconformances as follows:The LOI/SER describes each of the identified nonconformances as follows:

– Required Condition (e.g. AS9100 requirement, supplier procedure, etc.)Required Condition (e.g. AS9100 requirement, supplier procedure, etc.)

– Encountered Condition (e.g. “PAH failed to ensure AS9100…was implementedEncountered Condition (e.g. “PAH failed to ensure AS9100…was implementedat supplier”)at supplier”)

– Example (e.g. specific evidence collected during SCA: un-calibrated inspection Example (e.g. specific evidence collected during SCA: un-calibrated inspection tools, past due internal audits or management reviews, incomplete corrective tools, past due internal audits or management reviews, incomplete corrective action, missing training records, etc., etc., etc.)action, missing training records, etc., etc., etc.)


What are the results of an SCA? (Cont.)What are the results of an SCA? (Cont.)

• The PAH is requested to provide a response containing:The PAH is requested to provide a response containing:

– Additional evidence or statements addressing the conditions or Additional evidence or statements addressing the conditions or examplesexamples

– Mitigating circumstances relevant to the caseMitigating circumstances relevant to the case

– Nonconformance cause, and action to correct and prevent recurrenceNonconformance cause, and action to correct and prevent recurrence

– Response is typically due within 20 working days, upon receipt of LOIResponse is typically due within 20 working days, upon receipt of LOI

This language sounds like legalese, because it is!This language sounds like legalese, because it is!


What are the results of an SCA? (Cont.)What are the results of an SCA? (Cont.)

• The PAH, and it’s suppliers, are required to maintain a quality The PAH, and it’s suppliers, are required to maintain a quality management system per Code of Federal Regulations, 14 CFR management system per Code of Federal Regulations, 14 CFR 21.165.21.165.

• The PAH’s Production Certificate is at risk during every SCAThe PAH’s Production Certificate is at risk during every SCA

• The PAH is at risk for civil penalties stemming from LOIsThe PAH is at risk for civil penalties stemming from LOIs

• By law, 14 CFR 13.14; Each violation is subject to civil penalty of By law, 14 CFR 13.14; Each violation is subject to civil penalty of not more than $25,000 per occurrence. (i.e. each individual bolt not more than $25,000 per occurrence. (i.e. each individual bolt improperly torqued, each part improperly heat treated)improperly torqued, each part improperly heat treated)


What are the results of an SCA? (Cont.)What are the results of an SCA? (Cont.)• Past supplier Issues resulting in a civil penalty have included:Past supplier Issues resulting in a civil penalty have included:

Special Manufacturing Processes (9100 clause 7.5.2) – Improper Heat TreatingSpecial Manufacturing Processes (9100 clause 7.5.2) – Improper Heat Treating

Design Control (clause 7.3) – Revision Control of Drawings & Specifications, Design Control (clause 7.3) – Revision Control of Drawings & Specifications, Parts Manufactured Without Proper Engineering ApprovalParts Manufactured Without Proper Engineering Approval

Material Control (clause 8.3) – Level of Control Over Non-conforming Product – Material Control (clause 8.3) – Level of Control Over Non-conforming Product – Parts Not Properly Identified for ScrapParts Not Properly Identified for Scrap

Tool & Gauge Control (clause 7.6) – Non-compliance of Calibration/Certification Tool & Gauge Control (clause 7.6) – Non-compliance of Calibration/Certification SystemSystem

Inspection System (clause 8.2.4) – Control of Sampling System (Lack Training, Inspection System (clause 8.2.4) – Control of Sampling System (Lack Training, Audits)Audits)

Manufacturing Control (clause 7.5.1) – Inadequate Work InstructionsManufacturing Control (clause 7.5.1) – Inadequate Work Instructions

Certifications (clause 6.2.2) – Employees Not Properly Certified Performing Certifications (clause 6.2.2) – Employees Not Properly Certified Performing OperationsOperations


Why should the Certification Bodies (CBs) Why should the Certification Bodies (CBs) and their auditors care about SCA results?and their auditors care about SCA results?

• PAH supplier approval is based on 9100 certification recognitionPAH supplier approval is based on 9100 certification recognition

• The majority of tier 1 and tier 2 aerospace suppliers are 9100 certifiedThe majority of tier 1 and tier 2 aerospace suppliers are 9100 certified

• The supplier QMS processes assessed during the SCA are the same The supplier QMS processes assessed during the SCA are the same ones assessed by the CB during initial and surveillance activityones assessed by the CB during initial and surveillance activity

• FAA verbal comment following a recent SCA audit, regarding a certified FAA verbal comment following a recent SCA audit, regarding a certified supplier that did not have an established FAI process, per AS9100supplier that did not have an established FAI process, per AS9100clause 8.2.4.2 requirements:clause 8.2.4.2 requirements:

““He (FAA auditor) is concerned that they are CRB approved and itHe (FAA auditor) is concerned that they are CRB approved and itapparently wasn’t identified as an issue by the approving CRB”apparently wasn’t identified as an issue by the approving CRB”


SCA Statistics (The Big Picture Show)SCA Statistics (The Big Picture Show)

• FAA supplier control audits conducted at Boeing Commercial Airplane FAA supplier control audits conducted at Boeing Commercial Airplane (BCA) division suppliers from October 2005 through March 2007:(BCA) division suppliers from October 2005 through March 2007:

– 52 clients (9100 certified suppliers)52 clients (9100 certified suppliers)

– 28 domestic / 24 non-domestic clients28 domestic / 24 non-domestic clients

– 21 clients had at least 1 identified QMS nonconformance21 clients had at least 1 identified QMS nonconformance• 40% of total40% of total

– 86 total nonconformances identified86 total nonconformances identified• Average per client: 4Average per client: 4• Top client: 9Top client: 9


SCA Statistics (The Good, The Bad, The Ugly)SCA Statistics (The Good, The Bad, The Ugly)


SCA StatisticsSCA Statistics Top Nonconforming 9100 ClausesTop Nonconforming 9100 Clauses

• FAA SCAs conducted at BCA division suppliers from October 2005 FAA SCAs conducted at BCA division suppliers from October 2005 through March 2007:through March 2007:

– 7.5.1 Control of Production and Service Provision (13)7.5.1 Control of Production and Service Provision (13)

– 8.2.4 Monitoring and Measurement of Product (8)8.2.4 Monitoring and Measurement of Product (8)

– 8.2.4.2 First Article Inspection (7)8.2.4.2 First Article Inspection (7)

– 7.5.1.1 Production Documentation (6)7.5.1.1 Production Documentation (6)

– 7.5.5 Preservation of Product (6)7.5.5 Preservation of Product (6)

– 4.2.3 Control of Documents (5)4.2.3 Control of Documents (5)

– 4.2.1 Documentation Requirements (4)4.2.1 Documentation Requirements (4)

– 4.2.2 Quality Manual (4)4.2.2 Quality Manual (4)


7.5.1 Control of Production and Service Provision7.5.1 Control of Production and Service Provision

• Production work order issues:– Obsolete/inaccurate drawing and specification call-out

– Missing or omitted manufacturing/inspection operation entries

– Different part counts between operations (Part accountability)

– Manufacturing/inspection practice does not match operation instruction

– Manufacturing practice does not meet engineering/specification requirements

• Recommendations for CB auditor:– Increase audit time in manufacturing/inspection areas

– Increase production work order sample size during audits• Review for part accountability, required entries, evidence of operation completion

– Compare work order to drawing/specification requirements

– Witness manufacturing/inspection practice vs. work order, drawing, specification, instruction, etc.


The Loud and Clear MessageThe Loud and Clear Message• Aerospace QMS certification/registration scheme:Aerospace QMS certification/registration scheme:

– The FAA allows the PAH to use other-parties to perform supplier assessments, The FAA allows the PAH to use other-parties to perform supplier assessments, surveillance, and certification. It is an earned privilege, not guaranteed.surveillance, and certification. It is an earned privilege, not guaranteed.

– FAA perception of effectiveness is based on facts collected during SCA activityFAA perception of effectiveness is based on facts collected during SCA activity

• Certification body management and auditor responsibilities:Certification body management and auditor responsibilities:

– Ensure theEnsure the integrity of the audit process and the validity of the issued certificateintegrity of the audit process and the validity of the issued certificate

– Recognize the inherent conflict of interest perception (Clients pay for certificates)Recognize the inherent conflict of interest perception (Clients pay for certificates)

– Demonstrate ethical behavior to build trust and confidence with the PAH and FAADemonstrate ethical behavior to build trust and confidence with the PAH and FAA(i.e. no soft grading of nonconformances, thorough CA verification, etc.)(i.e. no soft grading of nonconformances, thorough CA verification, etc.)

• CB auditor’s role is critical for PAH’s Certificate ManagementCB auditor’s role is critical for PAH’s Certificate Management


Proposed Process ImprovementsProposed Process Improvements

• Direct communication of SCA results from PAH to responsible CBDirect communication of SCA results from PAH to responsible CB– OASIS feedback loopOASIS feedback loop

– Formal PAH report (e.g. Boeing Strengths and Issues document)Formal PAH report (e.g. Boeing Strengths and Issues document)

• Participation by CB in LOI corrective action responseParticipation by CB in LOI corrective action response

• Participation of CB auditor, along with PAH personnel, during a SCAParticipation of CB auditor, along with PAH personnel, during a SCA

• Direct communication of SCA results to accreditation body (e.g. ANAB) Direct communication of SCA results to accreditation body (e.g. ANAB) for CB oversight planning and auditing activityfor CB oversight planning and auditing activity


The Reality of the Civil Aviation Industry.......The Reality of the Civil Aviation Industry.......

PAH and FAA personnel:PAH and FAA personnel:• Are not as constrained by audit agendas/plans or time during their audit Are not as constrained by audit agendas/plans or time during their audit

activityactivity• Audit trails can be methodically followed and investigated, allowing Audit trails can be methodically followed and investigated, allowing

greater possibility of exposing process nonconformancesgreater possibility of exposing process nonconformances• Spend the majority of audit time focused on manufacturing/inspection Spend the majority of audit time focused on manufacturing/inspection

processes processes

Shouldn’t the Certification Body Personnel:Shouldn’t the Certification Body Personnel:• Ensure audit planning policies and CB/Client agreements meet the Ensure audit planning policies and CB/Client agreements meet the

intent of AS9104 clause 8.2.2 Duration of Assessment:intent of AS9104 clause 8.2.2 Duration of Assessment:– It is anticipated that the requirements of the AQMS Standards shall It is anticipated that the requirements of the AQMS Standards shall

add on-site assessment timeadd on-site assessment time• Justify and utilize additional on-site assessment time to emphasize Justify and utilize additional on-site assessment time to emphasize

manufacturing/inspection documentation, personnel competence, and manufacturing/inspection documentation, personnel competence, and process conformance process conformance


Supplier Control Audit - SCASupplier Control Audit - SCA

• Questions or clarifications?Questions or clarifications?

• Comments?Comments?

• Discussion?Discussion?

• Email feedback to Email feedback to [email protected]@boeing.com

• FAA CFR's and Orders:FAA CFR's and Orders: http://www.faa.gov/http://www.faa.gov/