Advisory Circular
Subject: Supplier Surveillance Date: 09/24/2009 Initiated by: AIR-200 AC No: 21-20C
1. Purpose.
a. This advisory circular (AC) describes methods acceptable to the Administrator for surveillance of suppliers by a Federal Aviation Administration (FAA) production approval holder (PAH).
b. This AC provides an acceptable means, but not the only means, of compliance with Title 14, Code of Federal Regulations (14 CFR), part 21, Certification Procedures for Products and Parts (hereafter referred to as part 21).
c. Prototype components for products used in type certification programs for which the FAA has requested a conformity inspection are not covered by the guidance outlined in this AC.
2. Who this AC affects. All PAHs.
3. Cancellation. AC 21–20B, Supplier Surveillance Procedures, dated April 22, 1996, is canceled by this revision.
4. Principal Changes.
a. Provides guidance for:
(1) Surveillance of suppliers by a PAH, including guidance for the initial evaluation, selection, periodic/ongoing evaluation, and disapproval of suppliers (including the need for the PAH to conduct onsite evaluations);
(2) Delegating some PAH tasks to suppliers;
(3) Reporting of all nonconforming items that may have left the supplier’s quality system;
(4) Mitigating potential undue burden issues;
(5) Utilizing industry shared processes, procedures, and methodology for supplier evaluation and surveillance;
(6) Controlling direct shipments from a PAH’s supplier directly to a customer for items manufactured under the PAH’s production approval; and
(7) Documenting an arrangement between a PAH and a supplier.
b. Recognizes that:
(1) Society of Automotive Engineers (SAE) Aerospace Recommended Practice 9134 (SAE ARP9134), Supply Chain Risk Management Guidelines (dated 3/3/2004), is an industry guideline that the FAA has reviewed and found acceptable to provide guidance for the identification of supplier risk factors;
(2) SAE Aerospace Standard 9102 (AS9102), Aerospace First Article Inspection Requirement (revision A, dated 1/13/2004), is an industry guideline that the FAA has reviewed and found acceptable to provide guidance in the establishment of first article processes and procedures; and
(3) SAE ARP9114, Direct Ship Guidance for Aerospace Companies (dated 9/9/2005), is an industry guideline that the FAA has reviewed and found acceptable to provide guidance in the establishment of direct shipment processes and procedures.
NOTE: Subsequent changes to industry standards are subject to FAA review for acceptability.
5. Definitions. For the purpose of this AC, the following definitions apply:
a. Airworthiness approval. Certification that an item conforms to approved design data and is in a condition for safe operation.
b. Applicable design data. All necessary drawings, specifications, and other technical information provided by the applicant for, or the holder of a design organization approval, type certificate (TC), supplemental type certificate (STC), technical standard order (TSO) authorization, parts manufacturer approval (PMA), or equivalent, and released in a controlled manner for production purposes.
c. Approved design data. Applicable design data that has been granted an approval (for example, TC, STC, TSO authorization, PMA, or equivalent) by the FAA or relevant civil aviation authority (CAA).
d. Direct ship authorization. The written authorization granted by a PAH responsible for the airworthiness of an item, to a supplier to ship items directly to end users. The items are not processed through the PAH’s own facility.
e. Direct ship declaration. A written statement from the supplier that accompanies a direct ship item stating the item was produced under the terms of the PAH.
f. Manufacturer. A person, as defined by 14 CFR part 1, Definitions and Abbreviations, who causes a product, or part(s) thereof, to be produced. A manufacturer may be a PAH or a supplier to a PAH.
g. Production approval. A document issued by the FAA to a person that allows the production of a product or article in accordance with its approved design and approved quality system. A production approval can take the form of a Production Certificate (PC), Parts Manufacturer Approval (PMA), Technical Standard Order (TSO) Authorization, or an Approved Production Inspection System (APIS).
h. Quality assurance. A management system for programming and coordinating the quality maintenance and improvement efforts of the various groups in a design and/or manufacturing organization, so as to permit design and/or production in compliance with regulatory and customer requirements.
i. Quality control. The conduct and direct supervision of the quality tasks (inspection of the item) to ensure that the quality requirements of the item are achieved.
j. Quality system. An organizational structure with responsibilities, procedures, processes, and resources that implement a management function to determine and enforce quality principles.
A quality system encompasses quality assurance and quality control.
k. Standard part. A part that is manufactured in complete compliance with an established government or industry-accepted specification that contains design, manufacturing, and uniform identification requirements. The specification must include all information necessary to produce and conform the part, and must be published so that any person/organization may manufacture the part.
l. Supplier. Any person contracted by a PAH to provide articles or services (at any tier).
6. General Discussion.
a. Establishment of a quality control/fabrication inspection system. Part 21 requires an applicant for a production approval to establish a quality control/fabrication inspection system as a prerequisite to the issuance of an FAA production approval, and to maintain the system after the approval has been issued. The PAH’s quality system should provide a means to determine whether supplier-produced products, parts, appliances, software, consumables, materials, standard parts, and services (all referred to as “items” for the purposes of this AC) conform to FAA-approved design data.
b. Supplier control. A PAH’s system must ensure that all items furnished by its suppliers, including sub-tier suppliers, conform to contract/purchase order requirements. The contract/purchase order requirements will depend on the complexity of supplied items and whether or not the supplier holds a production approval for similar items. The PAH is responsible for supplier adherence to the requirements flowed-down through the supplier chain. A PAH does not “delegate” responsibility under its production approval to a supplier; the PAH remains responsible.
c. Use of suppliers in other countries. PAHs may use suppliers in other countries when the PAH has established and implemented a supplier control system acceptable to the FAA. A PAH who plans to use a supplier in another country should notify the FAA as soon as possible to allow the FAA to determine the FAA’s ability to perform surveillance.
d. FAA surveillance of supplier control systems. The FAA does not “approve” suppliers, but may conduct surveillance of the PAH’s supplier control system at both PAH and supplier facilities in
4 accordance with FAA Order 8120.2, Production Approval and Certificate Management Procedures.
The FAA may also request technical assistance from a bilateral CAA to act on behalf of the FAA.
However, the PAH cannot rely on FAA or CAA surveillance as a means of supplier control.
7. Elements of a Supplier Control System. A PAH is responsible for ensuring that each item conforms to the FAA-approved design data and is in a condition for safe operation. This responsibility remains the same whether the PAH produces the entire item at its facility or uses suppliers to furnish related items. Implementation and maintenance of the supplier control system is subject to evaluation by the FAA. FAA production approvals are based on the ability of the quality system to ensure production of conforming items. Therefore, the PAH’s supplier control system should contain the following elements:
a. Organizational structure. An organizational structure that ensures appropriate authority and sufficient resources, as well as adequate expertise, to control supplier activities.
b. Supplier arrangement. Documentation of the supplier arrangement through a contract/purchase order that defines all necessary elements and procedures between the PAH and a supplier. Appendix A contains the elements that should be defined in the arrangement between the PAH and the supplier.
c. Supplier evaluation and selection. A process that evaluates and selects suppliers based on their capability to perform all manufacturing activities, inspections, and tests necessary to determine conformity of items to the applicable design data and their ability to meet the specified requirements.
The process should include criteria for the initial evaluation, selection, periodic/ongoing evaluation, and disapproval of suppliers. These should include the following:
(1) Initial evaluation of suppliers to determine their capability to meet requirements. The PAH should make this determination before permitting the supplier to furnish any items. The need for the PAH to conduct onsite evaluations should be based on a supplier control process as described in 7.e below. The FAA strongly encourages PAHs to conduct initial onsite evaluations based on risk factors such as:
(a) Category of the part as listed on the FAA’s Aircraft Certification Service Category Parts List (available on the FAA website);
(b) Number of supplier tiers, and number of suppliers within each tier, used by the supplier (including, if necessary, onsite evaluations of sub-tier suppliers);
(c) Design and manufacturing complexity of the part;
(d) Ability of the PAH to inspect the part upon receipt; and
(e) Other risk factors as discussed in 7.e.1 below.
(2) Periodic/ongoing evaluations to ensure continued adherence to the requirements and methods for determining the extent and type of evaluations (e.g., onsite evaluations, process reviews, document reviews, or independent product evaluations) based on the type, complexity, method of control, and criticality of the items procured. The need for the PAH to conduct onsite evaluations
5 should be based on a supplier control process and verification of supplier product as described in 7.e and 7.f below. The FAA strongly encourages PAHs to conduct periodic/ongoing onsite evaluations.
d. Approved supplier list. Suppliers under the PAH quality system are included in, or referenced to, a controlled list together with their associated scope. Procedures ensure that purchase documentation is issued only to suppliers on this list.
e. Supplier control process. A process that describes the means of supplier control, based on the criticality and complexity of the item or service provided to ensure conformity. The techniques described are not all-inclusive, but are provided to assist the PAH in developing supplier control procedures applicable to the organization.
(1) Risk assessment, which takes into account the combination of supplier and product risk factors. Product risk factors include safety classification from the design approval process, special process, and design and manufacturing complexity. SAE ARP9134 is an industry guideline that the FAA has reviewed and found acceptable to provide guidance for the identification of supplier risk factors.
(2) Qualification and auditing of a supplier’s quality system.
(3) Monitoring continued capability throughout the supply chain in performing all manufacturing activities, inspections, and tests necessary to determine conformity of items to applicable design data. The PAH must determine and apply acceptance standards for the physical condition, configuration status, and conformity of items (including customer/buyer-furnished equipment) whether to be used in production or as replacement or spare items.
(4) First article inspection (FAI), to verify that the article conforms to the approved data and any additional contract/purchase order requirements, including, if necessary, destructive testing. A FAI should be conducted for a new production line, changes to the manufacturing/quality process, or a new supplier. SAE AS9102 is an industry standard the FAA has reviewed and found acceptable to provide guidance in the establishment of first article processes and procedures.
f. Verification of supplier product. Methods for verifying items conform to specified requirements. This includes customer-supplied materials and customer-designated sources. The techniques described are not all-inclusive.
(1) For items accepted at the PAH’s facility, inspection may be accomplished upon receipt, or when characteristics remain accessible, at any time before the final acceptance of the end item. The procedures should encompass a complete inspection (e.g., all dimensional characteristics, nondestructive testing, hardness checks, spectrographic analysis, functional tests, etc.). Statistical quality control methods may be acceptable when the PAH has established that the supplier’s production/process methods will consistently produce items that conform to the approved design data.
The inspection plan used must preclude the acceptance of any nonconforming items. In addition, when it is necessary to determine material integrity, the following methods should be considered:
(a) Laboratory analysis for complete chemical and physical properties to be performed on each item when such tests can be performed without destroying the item; and
(b) When laboratory analysis of items cannot be performed without destroying the item, a sample of such items should be subjected to a qualitative and quantitative analysis to verify complete chemical and physical properties (e.g., by test coupon or small section of the item).
(2) For items that cannot or will not be inspected upon receipt, the PAH’s procedures should include, at a minimum, inspection and testing of first articles to verify that the articles conform to the approved design data and periodic inspection thereafter. This may be accomplished at the supplier facility when the PAH can show that such inspections and tests will be accomplished under controlled conditions acceptable to the FAA. More than one article may require such inspection or testing until the production repeatability of the supplier has been established. These procedures should include methods to control, identify, and segregate items waiting for testing or inspection from those already approved.
(3) The PAH may allow a supplier to perform an appropriate inspection/major inspection when it has established that the supplier is capable of performing such an inspection function. The FAA should approve any delegation of the following activities beyond the first-tier supplier:
(a) Major inspections. These include properties classified as critical by the approved design holder’s engineering drawings, process specifications, test specifications, and quality control procedures; or properties that cannot be verified except by a destructive test of each item or extensive disassembly; and
(b) Material review. These include the identification and maintenance of relevant Material Review Board (MRB) procedures that define the scope and authority of the supplier MRB;
and the process for submittal to the PAH of supplier nonconformances that must be approved before being considered as changes to the FAA-approved type design.
(c) Statistical techniques.
(4) The PAH must have supplier information available to the FAA upon request. This information should include, but is not limited to:
(a) The name and address of each supplier;
(b) The name and address of each supplier who performs major inspection/material review for the PAH;
(c) The name and address of each supplier who furnishes items when conformance to the approved design data cannot, or will not, be made upon receipt at the PAH’s receiving facility;
(d) Where, and by whom, the item will undergo inspection;
(e) The title and telephone number of the person to contact at the supplier facility who can furnish the purchase order(s), quality control data, technical data, and other pertinent data/information to the FAA;
(f) Identification of each supplier with direct ship authorization; and
(g) Results of the PAH’s supplier evaluations, audits, and/or other surveillance activities.
(5) The PAH must have a method for generating and maintaining receiving inspection records.
These procedures should include the following:
(a) Contents of each record used for the item inspected, to include, at a minimum, the name, part/item number, serial number (if applicable), sample size, type and number of inspections made, conformance or nonconformance, number and description of nonconformances found, and action taken;
(b) Requirements for record legibility, completeness, accuracy, and retention periods; and
(c) Requirements that tape files, microfilm, digital media, and similar tools used for record retention exhibit legible data, and acceptance stamps and/or signatures.
g. Supplier rating. A system that exhibits the performance, capability, and reliability of suppliers.
h. Notification to the FAA. An agreed procedure that defines the process and criteria for providing advance notification to the FAA of significant changes to supplier arrangements.
i. Reporting of supplier nonconformances. Processes and/or procedures that require suppliers to report a nonconforming item that may have left the supplier’s quality system. Suppliers must report this information to the PAH, and to the FAA (for suppliers that are also a PAH), in accordance with part 21 requirements.
j. Change control. A system that ensures that changes in requirements are properly controlled and incorporated as agreed between the supplier and the PAH. These include, but are not limited to:
(1) Submittal of supplier designs and changes to the PAH, for approval before incorporation, when required;
(2) Submittal of changes of supplier manufacturing process to the PAH, when required;
(3) Submittal of changes to a supplier’s quality system to the PAH that may affect the inspection, conformity, or airworthiness of the item to the PAH; and
(4) Methods used to act upon notifications of a nonconforming item and ensure that proper investigation and corrective action is taken.
k. Direct ship. Methods for controlling direct shipments from a PAH’s supplier directly to a customer for items manufactured under the PAH’s production approval. The customer may order items from either the PAH or the supplier. SAE ARP9114 is an industry guideline that the FAA has reviewed and found acceptable to provide guidance in the establishment of direct shipment processes and procedures. There may be restrictions on the direct shipment of items from suppliers not located in the United States (such as an FAA designee not available to issue FAA Form 8130-3, Authorized Release Certificate). The cognizant FAA manufacturing inspection district office may be contacted for more specific information. Direct shipment may only be used when the PAH:
(1) Has approved quality procedures that will compensate for the absence of inspections normally conducted at the PAH’s facility. Compensating factors must include onsite evaluations of the supplier and the inspection of the article as either:
(a) Source inspection performed by the PAH; or
(b) Inspection by the supplier under a delegated inspection authority from the PAH.
(2) Provides direct ship authorization to a supplier.
(3) Issues and maintains records of direct ship authorization and makes them available to regulatory authorities upon request.
(4) Ensures that the requirements of the importing country will be met before authorizing direct shipment to a customer located outside the United States.
(5) Obligates the supplier to:
(a) Direct ship the item;
(b) Meet any special customer requirements accepted by the PAH;
(c) Maintain evidence that the supplier has direct ship authorization from the PAH;
(d) Maintain evidence of direct shipments made on the behalf of the PAH;
(e) Provide a signed direct ship declaration with the shipment;
(f) Provide a signed/stamped statement of conformance certifying that the item conforms to approved data with the shipment;
(g) Provide traceability of the shipment to the customer purchase request;
(h) Provide evidence with the shipment that acceptance/inspection has been accomplished by the PAH or through a delegated inspection authority; and
(i) When delegated inspection is used, provide a statement with the shipment that delegation of inspection authority has been granted by the PAH and that the inspection was performed on behalf of the PAH.
l. Other-party supplier surveillance. Methods for the use of other-party supplier surveillance may be used by a PAH provided they meet the requirements of FAA Order 8120.12, Production Approval Holder Use of Other-Parties to Supplement Their Supplier Control Program, and are documented either in their quality manual or as part of their fabrication inspection system.
m. Suppliers holding a production approval. Methods addressing suppliers that hold a production approval for the item to be supplied. A PAH’s surveillance of individual suppliers may be reduced, but not eliminated, provided:
(1) That satisfactory interface between the two quality systems can be demonstrated to the FAA;
(2) That the items to be supplied are included in the scope of their production approval; and
(3) If the supplier is located outside the United States, a bilateral agreement for airworthiness is in effect between the United States and the country of the supplier. The bilateral agreement must include provisions for United States acceptance of the types of items or products produced under the supplier’s production approval.
n. Use of suppliers located outside the United States. Methods for utilizing suppliers (including sub-tier suppliers) outside the United States. These should include provisions for the following:
(1) The PAH providing early notification to the FAA of the proposed use of a supplier in another country or jurisdiction;
(2) The PAH making available to the FAA information on non-U.S. suppliers when requested;
(3) The PAH ensuring that there are processes, agreements, or procedures in place to eliminate any undue burden on the FAA that would inhibit the FAA from performing its regulatory functions and certificate management responsibilities; and
(4) The PAH assuring access to the supplier. Assurance of access must be provided by the supplier, or when no regulatory agreements are in place, the government of the country or jurisdiction in which the supplier is located. This assurance of access must be made available to the FAA. If access is at any time obstructed or denied, the FAA may instruct the PAH to cease using the supplier.
o. FAA surveillance in other countries. When a PAH uses a supplier in a jurisdiction with which the United States has a bilateral agreement, the FAA may use a bilateral CAA to perform surveillance activities and/or conduct inspections on behalf of the FAA. The following procedures should be used:
(1) The PAH must afford the FAA or CAA any necessary support in their surveillance activity; and
(2) When specifically requested by the FAA/CAA to facilitate surveillance activities, suppliers located outside the United States must make appropriate data available to the FAA through the PAH for certificate management purposes. This data must be in the English language.
NOTE: FAA Order 8100.11, Decision Paper Criteria for Undue Burden and No Undue Burden Determinations Under 14 CFR Part 21, is used by FAA personnel when notified by the PAH of their intent to utilize a supplier outside the United States.
10 NOTE: When the FAA requests a bilateral partner CAA to conduct surveillance activities or conformity inspection(s) at a supplier facility, the PAH will be responsible for any charges imposed by the CAA to accomplish the request(s).
Frank P. Paskiewicz Manager, Production and Airworthiness Division
Appendix A A-1
APPENDIX A PAH – SUPPLIER ARRANGEMENT
The following list comprises elements typically found in the arrangement between the PAH and the supplier, if applicable. Guidance on the content of each element is provided, but this is not intended to be comprehensive.
NOTE: The supplier arrangement may indicate whenever the PAH finds one or more of the elements to be inapplicable.
1. Scope.
a. Identify items to be provided by the supplier and the associated supplier facilities.
NOTE: The term “item” in this appendix comprises products, parts, or appliances as well as consumables, materials, standard parts, or services.
b. Identify any limitation(s) defined by the PAH.
2. PAH Evaluation. Stipulate that the supplier is acting under the PAH quality system and all the corrective actions requested by the PAH are to be implemented.
3. Implementation Procedures. Attach a quality plan or equivalent documentation to the contract.
4. Internal Quality System.
a. Identify methods for the PAH to evaluate the internal quality system of the supplier.
b. Describe the interface between the quality systems of the PAH and the supplier in the quality plan.
5. Design Data and Configuration Control.
a. Identify the design data package provided by the PAH, which includes all pertinent data required for the supplied item(s) to be identified, manufactured, inspected, used, and maintained.
b. Establish procedures for the management of design changes.
6. Manufacturing Data. Identify the manufacturing data developed by the supplier, if any, based on the design data (refer to paragraph 5 of this appendix) submitted by the PAH.
7. Test and Inspections (Including Incoming).
a. Identify procedures to define the necessary test and inspection processes:
(1) To ensure and determine conformity of the supplied item(s) during the supplier’s manufacturing activities and at receipt by the PAH; and
Appendix A
A-2
(2) To be performed for qualification of the supplier (including first article inspection) and the related documentation requirements.
b. The PAH may rely on inspection/tests performed by supplier, provided:
(1) Personnel responsible for these tasks satisfy the quality standards of the PAH;
(2) Quality measurements are clearly identified; and
(3) The records or reports show ing evidence of co nformity are available for review and audit.
8. Identification and Traceability. Stipulate that the PAH flow-down to the supplier, and any subtier suppliers, item identification and traceability requirements.
9. Supplier Personnel Competence. Identify the PAH’s requirements for the competence of supplier personnel (i.e., production, inspection, and quality staff) competence, based on qualifications, education, training, skills, and experience.
10. Calibration.
a. Ensure that calibration is traceable to a national standard acceptable to the FAA.
b. Ensure that certificates are submitted where suppliers perform calibration services for the PAH.
11. Handling, Storage (Segregation), and Packing.
a. Identify requirements from the PAH concerning handling, storage, packing, and shelf-life to be followed by the supplier.
b. Address segregation of approved and non-approved items as well as nonconforming items.
12. Record Completion and Retention. Identify procedures for document management and retention by the supplier.
13. Nonconformities. Identify procedures for handling and documenting nonconformities between the PAH and the supplier, addressing the:
a. Identification, documentation, and classification (major, minor) of nonconformities; and
b. The disposition of nonconformities and the subsequent segregation and control of the nonconforming items, including the secure disposition of scrap items to avoid reuse (refer to paragraph 11 of this appendix).
NOTE: The disposition of nonconformities is generally the responsibility of the design approval holder. Nevertheless, it may be acceptable to the FAA for the design approval holder to delegate the approval of nonconformities to persons located in the organization of the PAH and its suppliers, thus acting as part of the design approval holder.