2.13.1.2 Records to be retained should include, but are not limited to, inspection and test records, calibration records, supplier records, special process certifications, MRB records, and production travelers.
2.13.1.3 Records should be legible, complete, and accurate. Any storage media used for record retention should exhibit legible data, acceptance stamps, and required signatures. Refer to chapter 4 of this AC for additional guidance on computer-generated or stored records.
2.13.2 Record Retention Schedule.
PAHs should establish a record retention schedule for various types of process, test, and quality and inspection system data.
2.13.3 Record Disposition.
The procedures should define how obsolete records will be dispositioned or destroyed.
2.14 Internal Audits.
Section 21.137(l) requires procedures for planning, conducting, and documenting internal audits to ensure compliance with the approved quality system. The procedures are required by the rule to include reporting results of internal audits to the manager responsible for implementing corrective and preventive actions. Chapter 5 of this AC provides additional information on internal audit programs.
2.14.1 Procedures.
PAHs should have procedures that establish an internal audit program. The internal audit program should verify compliance with established policies, procedures, and approved data.
2.14.2 Reporting.
PAHs should ensure the results of internal audits are reported to the appropriate level of management, and that audits are used for improving the quality system or product.
2.15 In-Service Feedback.
Section 21.137(m) requires procedures for receiving and processing feedback on in-service failures, malfunctions, and defects. These procedures are required by the rule to include a process to assist design approval holders to address any in-service problem(s) involving design changes and determine if any changes to the Instructions for Continued Airworthiness (ICA) are necessary.
2.15.1 Procedures.
PAHs should have procedures that establish a system for receiving, processing, and tracking of in-service failures, including how records are generated and maintained.
2-9
2.15.2 Corrective Actions.
PAHs should ensure that service problems, unairworthy conditions, unsafe features, and unsafe characteristics reported by the FAA, or users, a re investigated and receive prompt corrective action.
2.15.3 Service Bulletins and Maintenance Manuals.
P AHs should ensure service bulletins and changes to maintenance manuals are approved by authorized personnel and coordinated with FAA engineering.
2.16 Quality Escapes.
Section 21.137(n) requires procedures for identifying, analyzing, and initiating appropriate corrective action for products or articles that have been released from the quality system and that do not conform to the applicable design data or quality system requirements.
2.16.1 Procedures.
PAHs should have procedures that document how they will track, evaluate, categorize, and disposition all nonconforming products or articles. These procedures should include actions to correct deficiencies in the quality system that allowed the quality escape.
2.16.2 Analytical Tools.
PAHs should use trend analysis and risk assessment tools to determine the severity of, and long-term effects of, nonconformances.
2.16.3 Recalls.
A PAH should notify users of products or articles when those products or articles are recalled for suspected or known nonconformance.
2.17 Issuing Authorized Release Documents.
Any PAH that intends to issue authorized release documents must have procedures for doing so that meet the requirements of § 21.137(o). This rule requires a PAH to have procedures providing for the selection, appointment, training, management, and removal of individuals authorized by the PAH to issue authorized release documents.
A PAH may issue these documents for new aircraft engines, propellers, and articles it manufactures, and for used aircraft engines, propellers, and articles rebuilt or altered pursuant to § 43.3(j). When a PAH uses an authorized release document for export purposes, the PAH must comply with any applicable bilateral agreement. Furthermore, under § 21.137(o), a PAH must comply with the rules applicable to the export of new and used aircraft engines, propellers, and articles, specified in § 21.331, and the responsibilities of exporters, specified in § 21.335. Additional guidance on exports can be found in AC 21-2, Complying with the Requirements of Importing Countries or Jurisdictions When Exporting U.S. Products, Articles, or Parts, and AC 21-44, Issuance of Export Airworthiness Approvals Under 14 CFR Part 21 Subpart L.
2-10
2.17.1 Procedures.
Procedures established under § 21.137(o) must ensure that only qualified personnel issue authorized release documents. A PAH’s evaluation of these individuals’ qualifications should include an assessment of their knowledge, background, experience, and training. Qualifications should be commensurate with the complexity and type of product or article for which the PAH issues an authorized release document.
These procedures should also include requirements for completing FAA Form 8130-3 that meet chapters 1, 2, and 4 of FAA Order 8130.21, Procedures for Completion and Use of the Authorized Release Certificate, Airworthiness Approval Tag. Refer to appendix E to this AC for additional guidance on issuing authorized release documents for aircraft engines, propellers, and articles.
2.17.2 FAA Form 8130-3.
A PAH’s authorized personnel should issue authorized release documents using FAA Form 8130-3.
2.17.3 Conditional Requirement.
Section 21.137(o) is only applicable to a PAH that wants to issue an authorized release document. Any PAH not issuing an authorized release document may continue to obtain airworthiness approvals from the FAA.
2-11
CHAPTER 3. SUPPLIER CONTROL PROGRAM.
3.1 Purpose.
This chapter provides information on, and describes criteria for, establishing and maintaining a supplier control program. PAHs may use this document in support of their responsibilities under §§ 21.137, 21.307, and 21.607.
3.2 Background.
Part 21 requires PAHs to establish and maintain a quality system. Part 21 also requires that this quality system ensure supplier-produced components (for example, software, articles, and subassemblies), services (for example, special processes and calibration), and customer or buyer-furnished equipment or material conform to the PAH’s requirements.
3.3 Supplier Control.
3.3.1 Contract Requirements.
A PAH is required by § 21.137(c) to have a quality system that ensures all products or articles provided by its suppliers, including subtier suppliers, conform to the PAH’s requirements. The PAH’s requirements will depend on the complexity of supplied products or articles and whether or not the supplier holds a production approval for similar products or articles.
3.3.2 PAH Responsibilities.
The PAH should ensure access to, and cooperation of, all involved facilities in the supply chain for the PAH and the FAA. The PAH is responsible for supplier adherence to the requirements flowed-down through the supply chain. A PAH does not delegate responsibility under its production approval to a supplier.
3.4 Use of Suppliers in Other Countries.
A PAH may use suppliers in other countries when the PAH has established and implemented a supplier control system acceptable to the FAA. A PAH that plans to use a supplier in another country should notify the FAA as soon as possible to determine the FAA’s ability to perform surveillance.
3.5 FAA Surveillance of Supplier Control Systems.
The FAA does not approve suppliers, but may conduct surveillance of the supplier control system at both PAH and supplier facilities in accordance with FAA Order 8120.23, Certificate Management of Production Approval Holders. The FAA may also request technical assistance from a bilateral partner civil aviation authority (CAA) to act on behalf of the FAA. The PAH cannot rely on FAA or CAA surveillance as a means of supplier control.
3-1
3.6 Elements of a Supplier Control System.
A PAH is responsible for ensuring that each product or article conforms to the FAA-approved design data, and is in a condition for safe operation. This responsibility remains the same whether the PAH produces the entire product or article at its facility, or uses suppliers to furnish related articles. The supplier control program is required by the rule to be FAA-approved and defined in a manual. Implementation and maintenance of the supplier control system is subject to evaluation by the FAA. FAA production approvals are based on the ability of the quality system to ensure production of conforming products or articles. Therefore, the supplier control system should contain procedures that include the following:
3.6.1 Organizational Structure.
Establishment of an organizational structure that ensures appropriate authority, sufficient resources, and adequate expertise to control supplier activities.
3.6.2 Supplier Arrangement.
Documentation of the supplier arrangement, generally through a contract, that defines all necessary elements and procedures between the PAH and a supplier. Appendix F to this AC contains elements that should be defined in the arrangement between the PAH and the supplier.
3.6.3 Supplier Evaluation and Selection.
A process that evaluates and selects suppliers based on their capability to perform all manufacturing activities, inspections, and tests necessary to determine conformity of articles to the applicable design data. Additionally, the supplier evaluation and selection process should determine the supplier’s ability to meet other PAH specified requirements. The process should include criteria for the initial evaluation, selection, periodic or ongoing evaluations, and disapproval of suppliers. These should include the following:
3.6.3.1 Initial evaluation of suppliers to determine their capability to meet requirements. The PAH should make this determination before permitting the supplier to furnish any articles. The need for the PAH to conduct onsite evaluations should be based on a supplier control process as described in paragraph 3.6.5 of this AC. The FAA strongly encourages PAHs to conduct initial onsite evaluations based on risk factors such as:
Category of the part as listed on the FAA’s Aircraft Certification Service Category Parts List (available on the FAA website);
Number of supplier tiers, and number of suppliers within each tier, used by the supplier (including, if necessary, onsite evaluations of subtier suppliers);
Design and manufacturing complexity of the article;
Ability of the PAH to inspect the article on receipt; and Other risk factors as discussed in paragraph 3.6.5.1 of this AC.
3-2
3.6.3.2 Periodic or ongoing evaluations of suppliers to ensure their continued adherence to the requirements.
3.6.3.3 Methods for determining the extent and type of evaluations (for example, onsite evaluations, process reviews, document reviews, or independent product evaluations). The extent and type of evaluations should be based on the type, complexity, method of control, and criticality of the articles procured. The need for the PAH to conduct onsite evaluations should be based on a supplier control process and verification of supplier product as described in paragraphs 3.6.5 and 3.6.6 of this AC. The FAA strongly encourages PAHs to conduct periodic/ongoing onsite evaluations.
3.6.4 Approved Supplier List.
Suppliers under the PAH quality system are included in, or referenced in, a controlled list, along with each supplier’s associated scope. Procedures ensure purchase documentation is issued only to suppliers on this list.
3.6.5 Supplier Control Process.
A process that describes the means of supplier control, based on the criticality and complexity of the article or service provided to ensure conformity. The techniques described below are not all-inclusive but are provided to assist the PAH in developing supplier control procedures applicable to the organization.
3.6.5.1 Risk assessment includes both supplier and product risk factors. Product risk factors include safety classification from the design approval process, special process, and design and manufacturing complexity. SAE ARP9134, Supply Chain Risk Management Guidelines (dated 3/3/2004), is an industry guideline that the FAA has reviewed and found acceptable to provide guidance for the identification of supplier risk factors.
3.6.5.2 Qualification and auditing of a supplier’s quality system.
3.6.5.3 Monitoring continued capability, throughout the supply chain, to perform all manufacturing activities, inspections, and tests to determine conformity of articles to applicable design data. The PAH will determine and apply acceptance standards for the physical condition, configuration status, and conformity of articles (including customer/buyer-furnished equipment).
This determination will be made whether the articles are to be used in production, or as replacement or spare articles.
3.6.5.4 First article inspection to verify the article conforms to the approved data, and any additional contract requirements, including destructive testing.
A first article inspection should be conducted for a new production line, changes to the manufacturing or quality processes, or a new supplier.
SAE AS9102A, Aerospace First Article Inspection Requirement (revision A, dated 1/13/2004), is an industry standard that has been 3-3
reviewed and found acceptable by the FAA to provide guidance in establishing first article processes and procedures.
3.6.6 Verification of Supplier Product.
Methods used to verify that articles conform to specified requirements, including customer-supplied materials and customer-designated sources. These methods include, but are not limited to, the following:
3.6.6.1 For articles accepted at the PAH’s facility, inspection may be accomplished on receipt, or when characteristics remain accessible, at any time before the final acceptance of the end item. The procedures should encompass a complete inspection (for example, all dimensional characteristics, nondestructive testing, hardness checks, spectrographic analysis, and functional tests). When the PAH has established that the supplier’s production or process methods will consistently produce articles that conform to its requirements, use of statistical quality control methods may be acceptable. The inspection plan used is required by the rule to preclude the acceptance of any nonconforming articles. Additionally, when it is necessary to determine material integrity, the following methods should be considered:
Laboratory analysis to verify an article’s complete chemical and physical properties when tests can be performed without destroying the article (for example, by test coupon or small section of the article).
When laboratory analysis cannot be performed without destroying the article, a sample of such articles should be subject to a qualitative and quantitative analysis (for example, by test coupon or small section of the article). This analysis will verify the article’s complete chemical and physical properties.
3.6.6.2 For articles that cannot or will not be inspected on receipt, the PAH’s procedures should include, as a minimum, inspection and testing of first articles to verify the articles conform to the PAH’s requirements and periodic inspection thereafter. Inspections and tests completed for the purpose of showing conformity to contract requirements may be accomplished at a supplier’s facility. These inspections and tests are required by the rule to be conducted according to a documented process within the PAH’s FAA-approved quality system. More than one article may require such inspection or testing until the production repeatability of the supplier has been established. These procedures should include methods to control, identify, and segregate articles waiting for testing or inspection from those already approved.
3.6.6.3 The PAH may allow a supplier to perform an appropriate or major inspection when it has established that the supplier is capable of performing such an inspection function. However, the PAH should approve any 3-4
delegation of inspection or use of statistical techniques beyond the first tier supplier. Such delegation includes the following:
Major inspections. These include properties classified as critical by the approved design holder’s engineering drawings, process specifications, test specifications, and quality control procedures; or properties that cannot be verified except by destructive test of each article or extensive disassembly.
Material review. This includes the identification and maintenance of relevant MRB procedures that define the scope and authority of the supplier MRB. Material review also includes the process for submitting, to the PAH, supplier nonconformances that are required by the rule to be approved before they can be considered as changes to the FAA-approved type design.
Statistical techniques.
3.6.6.4 The PAH is required by the rule to have supplier, including subtier supplier, information available to the FAA on request. This information should include, but is not limited to, the following:
The name and address of each supplier.
The name and address of each supplier that performs major inspection or material review for the PAH.
The name and address of each supplier that furnishes articles when conformance to PAH requirements cannot, or will not, be made on receipt at the PAH’s receiving facility.
Where, and by whom, the article will undergo inspection.
The title and telephone number of the person to contact at the supplier facility that can furnish the purchase order(s), quality control data, technical data, and other pertinent data or information to the FAA.
Identification of each supplier with direct ship authorization.
Results of the PAH’s supplier evaluations, audits, or other surveillance activities.
3.6.6.5 The PAH is required by the rule to have a method for generating and maintaining inspection records. These procedures should include the following:
Contents of each record used for the article inspected. This should include, as a minimum, the name, part or article number, serial number (if applicable), sample size, type and number of inspections made, conformance or nonconformance, number and description of nonconformances found, and action taken.
3-5
Requirements for record legibility, completeness, accuracy, and retention periods.
Requirements that tools used for record retention (for example, tape files and microfilm) exhibit legible data and acceptance stamps or signatures.
3.6.7 Supplier Rating.
A system that exhibits the performance, capability, and reliability of suppliers.
3.6.8 Notification to the FAA.
A procedure to ensure advance notification to the FAA of any significant change in the scope of any supplier arrangements.
3.6.9 Reporting of Supplier Nonconformances.
A supplier-reporting process for products, articles, or services that have been released from or provided by a supplier and subsequently found not to conform to the PAH’s requirements.
3.6.10 Change Control.
A system that ensures changes in requirements are properly controlled and incorporated as agreed between the supplier and the PAH. These include, but are not limited to— Submittal to the PAH for approval of supplier designs and changes before incorporation, when required;
Submittal to the PAH of changes to a supplier’s manufacturing process, when required;
Submittal to the PAH of changes to a supplier’s quality system that may affect inspection, conformity, or the airworthiness of the article; and Methods used to act on notifications of nonconforming articles, and ensuring proper investigation and corrective action is taken.
3.6.11 Direct Ship.
Methods for controlling direct shipments from a PAH’s supplier to a customer for articles manufactured under the PAH’s production approval. The customer may order articles from either the PAH or the supplier. SAE ARP9114, Direct Ship Guidance for Aerospace Companies (dated 9/9/2005), is an industry guideline that has been reviewed by the FAA and found acceptable to provide guidance in establishing direct shipment processes and procedures. There may be restrictions on the direct shipment of articles from suppliers not located in the United States. The FAA Manufacturing Inspection District Office (MIDO) may be contacted for more specific information. Direct shipment may only be used when the PAH—
3.6.11.1 Has approved quality procedures that will compensate for the absence of inspections normally conducted at the PAH’s facility. Compensating factors 3-6
should include onsite evaluations of the supplier and the inspection of the article as either— A source inspection performed by the PAH, or An inspection by the supplier under a delegated inspection authority from the PAH.
3.6.11.2 Provides direct ship authorization to a supplier.
3.6.11.3 Issues and maintains records of direct ship authorization and makes them available to regulatory authorities on request.
3.6.11.4 Ensures the requirements of the importing country will be met before authorizing direct shipment to a customer located outside the United States.
3.6.11.5 Obligates the supplier to— Direct ship the article.
Meet any special customer requirements accepted by the PAH.
Maintain evidence that the supplier has direct ship authorization from the PAH.
Maintain evidence of direct shipments made on behalf of the PAH.
Provide a signed direct ship declaration with the shipment.
Provide a signed or stamped statement of conformance certifying that the article conforms to approved data with the shipment.
Provide traceability of the shipment to the customer purchase request.
Provide evidence with the shipment that acceptance or inspection has been accomplished by the PAH or through a delegated inspection authority.
Provide a statement with the shipment that delegation of inspection authority has been granted by the PAH, and that the inspection was performed on behalf of the PAH when delegated inspection is used.
3.6.12 Other-Party Supplier Surveillance.
Methods for the use of other-party supplier surveillance may be used by a PAH provided the processes used meet the requirements identified in FAA Order 8120.12, Production Approval Holder Use Of Other-Parties To Supplement Their Supplier Control Program, and are documented in the PAH’s quality manual.
3.6.13 Suppliers Holding a Production Approval.
Methods used to address suppliers that hold a production approval for the article to be supplied. A PAH’s surveillance of individual suppliers may be reduced, but not eliminated, provided that— 3-7
Satisfactory interface between the two quality systems can be demonstrated to the FAA;
The articles to be supplied are included in the scope of their production approval; and If the supplier is located outside the United States, a bilateral agreement for airworthiness is in effect between the United States and the country of the supplier. The bilateral agreement will include provisions for United States’ acceptance of the types of articles or products produced under the supplier’s production approval.
3.6.14 Use of Suppliers Located Outside the United States.
Methods for the use of suppliers (including subtier suppliers) outside the United States.
These should include provisions for the following:
The PAH providing early notification to the FAA of the proposed use of a supplier in another country or jurisdiction.
The PAH is required by the rule to make available to the FAA information on non- U.S. suppliers when requested.
The PAH should ensure the FAA has access within the country where its supplier (including subtier suppliers) is manufacturing. It should also ensure all necessary processes, agreements, or procedures are in place to mitigate any undue burden on the FAA. Such burdens could inhibit the FAA from performing its regulatory functions and certificate management responsibilities.
The PAH is required by the rule to ensure access to its suppliers. Assurance of access should be provided by the supplier, or when no regulatory agreements are in place, the government of the country or jurisdiction in which the supplier is located.
This assurance of access will be made available to the FAA. If access is at any time obstructed or denied, the FAA may instruct the PAH to cease using the supplier.
3.6.15 FAA Certificate Management in Other Countries.
When a PAH uses a supplier in a country or jurisdiction that has a bilateral agreement with the United States, the FAA may use a bilateral partner CAA to perform surveillance activities and/or conduct inspections on behalf of the FAA. The following procedures should be used:
The PAH will afford the FAA or CAA any necessary support in its surveillance activity.
When specifically requested by the FAA/CAA to facilitate surveillance activities, suppliers located outside the United States will make appropriate data available to the FAA through the PAH for certificate management purposes. This data should be in the English language.
3-8
Note 1: FAA Order 8100.11, Decision Paper Requirements for Undue Burden and No Undue Burden Determinations Under 14 CFR part 21 for Production and Export Airworthiness Approvals, is used by FAA personnel when notified by the PAH of its intent to use a supplier outside the United States.
Note 2: When the FAA requests a bilateral partner CAA to conduct surveillance activities or conformity inspection(s) at a supplier facility, the PAH will be responsible for any charges imposed by the CAA to accomplish the request(s).
3-9