Registration Management Committee (RMC)

Workshop June 21 - 22, 2007

Regulatory Requirements

Federal Aviation Administration

Supplier Control Audit (SCA)

Presented by: Ed Bayne

Boeing Enterprise and Industry Interface Representative
Prepared by:

Brian Simons
Boeing Oversight Representative

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What is an SCA?
FAA Order 8120.2, Part 3, section 124. Certificate Management Activity:
Certificate management activity will be focused on the Production
Approval Holders (PAH) control of its suppliers.
The FAA will determine if a PAH (e.g. The Boeing Company) is
complying with its supplier control system by performing the following
activities:
b. Supplier Control Audit. The Principle Inspector (PI) will
determine that the supplier complies with purchase order and/or
quality requirements.

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What is an SCA? (Cont.)

FAA Order 8120.2, Part 6. Supplier Control Audit, section 139. General:
A SCA is conducted as part of the Certificate Management of the
PAH (e.g. The Boeing Company PC700).
Evaluates the outside sources (e.g. supplier) system to control
parts, materials, supplies, and services.
The SCA determines that the supplier complies with purchase order
and/or quality requirements, including any statistical sampling that
may be utilized.

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What are the results of an SCA?

FAA Order 8120.2, Part 3, section 125. Determination of Supplier Control:
The PI determines whether a PAH is controlling its suppliers by
reviewing the results of the supplier control audits.
The PI looks for evidence that may indicate a system breakdown in
supplier control by the PAH.
Corrective action is requested for a system breakdown.

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What are the results of an SCA? (Cont.)

If the FAA identifies evidence indicating a system breakdown in supplier
control, a Letter of Investigation (LOI) or Surveillance Evaluation Report
(SER) is issued to the PAH.
LOI vs. SER depends on the severity of the issue(s)
The LOI/SER informs the PAH that the FAA is investigating the matter.
The LOI/SER describes each of the identified nonconformances as follows:
Required Condition (e.g. AS9100 requirement, supplier procedure, etc.)
Encountered Condition (e.g. PAH failed to ensure AS9100was implemented
at supplier)

Example (e.g. specific evidence collected during SCA: un-calibrated inspection

tools, past due internal audits or management reviews, incomplete corrective actio
missing training records, etc., etc., etc.)

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What are the results of an SCA? (Cont.)

The PAH is requested to provide a response containing:
Additional evidence or statements addressing the conditions or
examples
Mitigating circumstances relevant to the case
Nonconformance cause, and action to correct and prevent recurrence
Response is typically due within 20 working days, upon receipt of LOI

This language sounds like legalese, because it is!

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What are the results of an SCA? (Cont.)

The PAH, and its suppliers, are required to maintain a quality
management system per Code of Federal Regulations, 14 CFR
21.165.
The PAHs Production Certificate is at risk during every SCA
The PAH is at risk for civil penalties stemming from LOIs
By law, 14 CFR 13.14; Each violation is subject to civil penalty of
not more than $25,000 per occurrence. (i.e. each individual bolt
improperly torqued, each part improperly heat treated)

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

What are the results of an SCA? (Cont.)

Past supplier Issues resulting in a civil penalty have included:

Special Manufacturing Processes (9100 clause 7.5.2) Improper Heat Treating
Design Control (clause 7.3) Revision Control of Drawings & Specifications,
Parts Manufactured Without Proper Engineering Approval
Material Control (clause 8.3) Level of Control Over Non-conforming Product
Parts Not Properly Identified for Scrap
Tool & Gauge Control (clause 7.6) Non-compliance of Calibration/Certification
System
Inspection System (clause 8.2.4) Control of Sampling System (Lack Training,
Audits)
Manufacturing Control (clause 7.5.1) Inadequate Work Instructions
Certifications (clause 6.2.2) Employees Not Properly Certified Performing
Operations

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

Why should the Certification Bodies (CBs)

and their auditors care about SCA results?

PAH supplier approval is based on 9100 certification recognition

The majority of tier 1 and tier 2 aerospace suppliers are 9100 certified

The supplier QMS processes assessed during the SCA are the same
ones assessed by the CB during initial and surveillance activity

FAA verbal comment following a recent SCA audit, regarding a certified

supplier that did not have an established FAI process, per AS9100
clause 8.2.4.2 requirements:
He (FAA auditor) is concerned that they are CRB approved and it
apparently wasnt identified as an issue by the approving CRB

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

SCA Statistics (The Big Picture Show)

FAA supplier control audits conducted at Boeing Commercial Airplane

(BCA) division suppliers from October 2005 through March 2007:
52 clients (9100 certified suppliers)
28 domestic / 24 non-domestic clients
21 clients had at least 1 identified QMS nonconformance
40% of total
86 total nonconformances identified
Average per client: 4
Top client: 9

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

SCA Statistics (The Good, The Bad, The Ugly)

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

SCA Statistics
Top Nonconforming 9100 Clauses

FAA SCAs conducted at BCA division suppliers from October 2005 through
March 2007:
7.5.1 Control of Production and Service Provision (13)
8.2.4 Monitoring and Measurement of Product (8)
8.2.4.2 First Article Inspection (7)
7.5.1.1 Production Documentation (6)
7.5.5 Preservation of Product (6)
4.2.3 Control of Documents (5)
4.2.1 Documentation Requirements (4)
4.2.2 Quality Manual (4)

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

7.5.1 Control of Production and Service Provision

Production work order issues:

Obsolete/inaccurate drawing and specification call-out

Missing or omitted manufacturing/inspection operation entries
Different part counts between operations (Part accountability)
Manufacturing/inspection practice does not match operation instruction
Manufacturing practice does not meet engineering/specification requirements

Recommendations for CB auditor:

Increase audit time in manufacturing/inspection areas
Increase production work order sample size during audits
Review for part accountability, required entries, evidence of operation completion

Compare work order to drawing/specification requirements

Witness manufacturing/inspection practice vs. work order, drawing,
specification, instruction, etc.

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

The Loud and Clear Message

Aerospace QMS certification/registration scheme:

The FAA allows the PAH to use other-parties to perform supplier assessments,
surveillance, and certification. It is an earned privilege, not guaranteed.
FAA perception of effectiveness is based on facts collected during SCA activity

Certification body management and auditor responsibilities:

Ensure the integrity of the audit process and the validity of the issued certificate
Recognize the inherent conflict of interest perception (Clients pay for certificates)
Demonstrate ethical behavior to build trust and confidence with the PAH and FAA
(i.e. no soft grading of nonconformances, thorough CA verification, etc.)

CB auditors role is critical for PAHs Certificate Management

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

Proposed Process Improvements

Direct communication of SCA results from PAH to responsible CB

OASIS feedback loop
Formal PAH report (e.g. Boeing Strengths and Issues document)

Participation by CB in LOI corrective action response

Participation of CB auditor, along with PAH personnel, during a SCA

Direct communication of SCA results to accreditation body (e.g. ANAB)

for CB oversight planning and auditing activity

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

The Reality of the Civil Aviation Industry.......

PAH and FAA personnel:

Are not as constrained by audit agendas/plans or time during their audit

activity
Audit trails can be methodically followed and investigated, allowing
greater possibility of exposing process nonconformances
Spend the majority of audit time focused on manufacturing/inspection
processes

Shouldnt the Certification Body Personnel:

Ensure audit planning policies and CB/Client agreements meet the intent
of AS9104 clause 8.2.2 Duration of Assessment:
It is anticipated that the requirements of the AQMS Standards shall
add on-site assessment time
Justify and utilize additional on-site assessment time to emphasize
manufacturing/inspection documentation, personnel competence, and
process conformance

Registration Management Committee (RMC)

Workshop June 21 - 22, 2007
Regulatory Requirements

Supplier Control Audit - SCA

Questions or clarifications?
Comments?
Discussion?
Email feedback to brian.d.simons@boeing.com
FAA CFR's and Orders: http://www.faa.gov/