CHAPTER 4. ELECTRONIC RECORDS.
4.1 Purpose.
This chapter provides information and guidance to PAHs on managing and controlling information systems that generate and store records used in the manufacture of products and articles.
4.2 Background.
Several CFR sections require PAHs to maintain manufacturing and quality records as evidence that products and articles were produced in accordance with approved design requirements. As the aerospace industry has grown, many PAHs have developed or purchased information systems to generate and store manufacturing and quality records.
This chapter does not discuss what manufacturing and quality records should contain.
Rather, it describes the control mechanisms that a PAH should use for an information system that generates or stores records of products and articles manufactured to CFR requirements.
4.3 Electronic Manufacturing and Quality System Records.
The record system should detect and deter unauthorized disclosure, modification, or use of records. Record systems require protection to ensure an accurate history of the manufacturing process of a product or article. An information management system should be protected from intruders. The system should also be protected from employees with authorized access privileges who attempt to perform unauthorized actions. Protection is achieved not only by technical, physical, and personnel safeguards, but also by clearly articulating to all employees the organizational procedures regarding authorized system use.
4.3.1 Security Principles of Electronic Record Systems.
Although information management systems are diverse, common security attributes should be present in all record systems. An acceptable electronic record system should include the following:
4.3.1.1 User Identification.
Each system user should be uniquely identified in the system with an account number or other identification code. This code identifies who has logged onto the system and is the primary means of verifying access. The information management system should retain the user identification codes entered to verify the requests made on the system. This information should be available for review by the system manager.
4.3.1.2 Authentication of User.
There should be a means of verifying that the person entering the user identification code is the authorized individual. Typically, this 4-1
authentication is through a password known only to the authorized user.
This password would allow access to the system only when used together with the user identification code. Passwords should be updated periodically.
4.3.1.3 Principle of Least Possible Privilege.
The authorization capability of the record system should follow the principle that each person is limited to only the information and transaction authority required by their job responsibilities. Privacy locks may be used to ensure this principle is followed. The level of access at which information is guarded within the system will depend on the design of the system.
Based on the design of the information management system, privacy locks and keys may control single data elements or any combination of data elements. Levels of protection may include the following:
Data items, Data aggregates, Sets, Fields, Files, or The complete system.
4.3.1.4 Relation to Quality Data Responsibilities.
The system should ensure authorization privileges coincide with the responsibilities outlined in the organization’s quality system. For example, a manufacturing individual should not normally have write capability to an inspection acceptance field within a manufacturing record. Additionally, an inspector should not have access to a material review engineer disposition field within a material review record. The system should be capable of assigning each user the specific access authority needed. The various types of authorization may include the following:
Read-Only Access. Allows the user to read all or specific fields of information but does not allow any write or data manipulation capability.
Insert or Write Access Authorizations. Allows the user to enter data into specified fields or series of fields.
Change Access Authorizations. Allows the user to change entries in specified fields, but does not allow removal of the original entry.
Changes may be accomplished by adding information to a restricted field (which is only used when the information in a field will be retained) but the information is not correct. For example, when an article has been rejected by inspection, the rejection history may need to be retained even after the article is repaired. Change access authorization may be given to allow a senior inspector the authority to 4-2
change the inspection status of a reworked article; however, the record retains the original rejection indication and the user identification of the individual making the change.
Delete Access Authorizations. Allows the user to remove entries and leave the fields blank. While authorization to delete information by the user making the entry may be unrestricted, subsequent delete authorization should be closely controlled. Delete access authorization may be issued only to supervisors for deleting incorrect entries by subordinate employees. Subsequent to final approval of a product or article, information should not be deleted. After approval, incorrect data should be changed rather than deleted.
Security Access Authorizations. The system manager should retain the security access authorizations. These authorizations should only be exercised when properly executed documents allow their use, such as an approval letter signed by the director of quality.
4.3.2 Auditing Mechanisms.
The information management system should include mechanisms that detect security breaches. These breaches should include any attempt to circumvent security or modify data without authorization. When such a security breach is detected, the system should alert the security manager and note any fields that have been accessed. The security breach information should be retained within the system until reviewed by the system manager. Security breach logs should be available only to select individuals and be protected from modification or data alteration at all times. Normally the system operator will be warned of unauthorized activity. Serious events, such as repeated unauthorized access attempts, may generate alarms at the system level.
4.3.3 Protection Against Software and Hardware Destruction.
Information system records should be protected from destructive computer programs (that is, computer viruses) that attack or degrade the software. Information management systems should include virus detection programs that ensure viruses are not introduced into the environment through contaminated software or hardware.
4.3.3.1 Inventories.
Inventories of all software and hardware configurations and locations should be used to ensure unauthorized hardware/software does not enter the information management system’s environment.
4.3.3.2 Portable Equipment.
Portable computer equipment, such as laptops, represent special risks from destructive software; therefore, procedures should address their use in the information management system’s environment.
4-3
4.3.3.3 Network Security.
Many PAHs use large information management system networks with several interacting workstations or terminals. If a large interactive system is used, procedures should address additional protection necessary to control the network. The PAH should define the degree of protection, based on the complexity and application of the system.
4.3.3.4 System Backup.
Provisions should be developed for loss of data resulting from system failure. In all cases, lost data will be regenerated. The amount of time between backups will depend on the degree of risk the approval holder wishes to accept to reestablish lost information.
4.3.4 Media Control.
The media on which information is stored should be carefully controlled and protected.
Transportable media such as tapes, disks, and cartridges should be stored in secure locations. Media from external sources should be subject to validation to ensure they are from authorized sources. The listing below provides some examples of the types of media available.
4.3.4.1 Floppy disks and computer hard drives should not be used for long-term storage of quality and manufacturing records. Information that will be retained for more than 3 months should be transferred to optical disks or magnetic storage media such as chromium dioxide or metal particle tapes.
An external or electronic labeling system should be used that ensures retrieval of individual records.
4.3.4.2 Magnetic tapes should be tested within 6 months of use to verify the tape is free of errors and complies with the standards of the National Institute of Standards and Technology. Optimally, new tapes that have been maintained in a cool, dry environment should be chosen for storing records. Specific storage criteria for magnetic tapes include the following:
Environmental temperatures between 62 and 68 degrees Fahrenheit.
Relative humidity between 35 percent and 45 percent.
All tapes should be rewound under controlled tension every 3½ years.
All information that will be retained for more than 10 years should be transferred to new tapes before reaching 10 years.
Annually, a statistically valid sample of all tapes should be tested to identify any loss of data. Tapes with 10 or more errors due to storage conditions should have all data transferred to new tapes. If the sample contains defective tapes, all other tapes that might have been affected by the same cause (that is, poor quality tape, high usage, poor environment, or improper handling) should be tested and corrected.
4-4
Smoking, eating, or drinking in the magnetic tape storage or test areas should be prohibited.
4.3.4.3 Chromium dioxide tapes should be handled like magnetic tapes except for periodic rewinding and cleaning. Although unproven, some industry experts believe rewinding and cleaning can be destructive to these tapes.
4.3.4.4 Before use of any metal particle tapes for long-term storage, the PAH should ensure the tapes can maintain the integrity of the data stored.
4.3.4.5 Additional information regarding long-term storage of electronic media can be found in the National Institute of Standards and Technology’s Special Publication 500-101, Care and Handling of Computer Magnetic Storage Media. This publication is available from the Superintendent of Documents, U.S. Government Printing Office, Washington, DC 20402.
4.3.4.6 Optical disks are recommended for their greater durability over older media such as magnetic tapes or disks.
4.3.4.6.1 Gold compact disks or digital versatile disks are preferred over similar media for long-term data storage. This is preferred over aluminum and silver writing surfaces, which are susceptible to corrosion or oxidation.
4.3.4.6.2 The PAH should maintain data transferred to storage, and provide access and ensure integrity of information for the long term. This may require migrating data from one media to the next to avoid media obsolescence.
The devices necessary to read the discs should also be kept and maintained.
4.3.4.6.3 When obtaining archival grade discs, the PAH should consider the following: dye failure, bonding failure, scratches, and production quality.
Testing is a highly recommended step in the process as conditions vary from machine to machine and among disks. It is recommended that the PAH keep multiple copies. Ideally one master copy should be stored under optimal conditions; one in-use copy should be stored for access purposes;
and one safety copy should be stored at a different location.
4.3.4.6.4 Rewritable disk formats are not recommended as their use can lead to accidental, but permanent, loss of data.
4.3.4.6.5 Optical disks, for all their resilience, are still susceptible to environmental factors. Optical disks should not be exposed to extreme temperatures or direct sunlight that may cause heat buildup in the disk or damage the data layer with ultraviolet rays. The environment should optimally be maintained between 65 and 75 degrees Fahrenheit, and between 30 and 50 percent humidity.
4-5
4.3.5 Documentation.
The information management system should be properly documented.
4.3.5.1 All software programs within the system, including program changes, should be fully documented.
4.3.5.2 Procedures should be developed that control all data entered into the system. The procedures should address all information management system and human interface activities.
4.3.6 Availability.
The information management system industry is extremely dynamic concerning the systems that are available for recordkeeping. If the PAH changes from one system to another, the records produced by the old system will remain accessible to the FAA in a usable format. The PAH’s documented quality control system should indicate how this accessibility is accomplished.
4.4 Information Management System Facility Management.
The information management system cannot be properly protected unless the facilities that house the equipment are properly protected from physical threats and hazards.
Areas that should be considered include the following:
4.4.1 Physical Security.
Each area where electronic records will be used should be surveyed for potential physical hazards. Fire and water are two of the most damaging forces regarding electronic information. Although not all hazards can be eliminated, opportunities for loss can be minimized by careful planning.
4.4.2 Environmental Conditions.
Procedures should address the environmental conditions (for example, temperature, humidity, static) of the areas where the record system computers and stored media are located. Manufacturer specifications provide a useful guide for developing procedures.
4.4.3 Disaster Recovery.
A contingency plan should be developed that will allow recovery of critical system information in case of a disaster, such as a fire. One acceptable method is to have a remote backup system to which data is regularly transferred.
4.5 Training.
Organizations that have elected to use electronic record systems should train each employee who is involved with any portion of that system. The subject matter and objectives should vary depending on the employee’s level within the organization and job responsibilities. Training should include security awareness, organizational policy, system operation, and record storage requirements. Training should be documented and those documents made available for review by the FAA.
4-6
CHAPTER 5. INTERNAL AUDIT PROGRAM.
5.1 Purpose.
This chapter provides information and describes criteria for establishing an internal audit program. This chapter may be used by PAHs and their suppliers to show compliance with § 21.137 regarding internal audits.
5.2 Background.
An internal audit program is a comprehensive, continuous monitoring process that is initiated and usually managed by top company and quality assurance (QA) management. The personnel conducting the various audits in support of the internal audit program may be internal or external to the process. The objective of this process is to promote attitudes and procedures that focus on controlling processes, rather than depending on corrections of deficiencies, to meet quality goals.
5.3 Types of Internal Audit Programs.
An internal audit program should be part of the overall quality system, be approved by top company and QA management, and have a detailed written description of the key elements of the program. Each PAH is unique regarding size, facilities, personnel, resources, and methods of operation. Therefore, different types of programs may be appropriate for individual organizations. The three basic audit programs commonly used are (1) a dedicated internal quality audit department, (2) a dedicated individual manager with part-time auditors provided from throughout the organization, and
(3) a combination of internal and external resources.
5.4 Elements of an Internal Audit Program.
An internal audit program is required by the rule to provide an adequate level of independence, a reporting process that ensures an accountable manager is aware of the audit results, and an effective corrective action process. The corrective action process should determine the root causes of deficiencies, correct these deficiencies, and prevent the recurrence of deficiencies. The program should have a structure and process designed to improve all system elements and processes that affect product quality.
The key elements of an internal audit program are as follows:
5.4.1 Audit Planning.
5.4.1.1 Audit Schedules.
Specific audit schedules should identify areas or activities subject to audit and ensure they are audited in a predetermined frequency and defined timeframe. Audit schedules should be based on the criticality of the activity being audited and should consider factors such as audit result history, production volume, process performance, high-risk areas, and management concerns.
5-1
5.4.1.2 Auditor Selection.
The internal quality audit program should specify that auditors receive training in auditing, audit principles, and systems analysis techniques.
When full-time dedicated audit resources are not practical, developed procedures should show that persons performing audits or supervising audit teams are not directly responsible for the areas being audited.
5.4.1.3 Audit Preparation.
The auditor needs to be cognizant of internal and external requirements and other factors that may impact the process.
5.4.1.4 Checklist Development.
A thorough audit program should determine and evaluate how an organization’s quality manual, operating procedures, process controls, methods, and practices account for and incorporate all internal and external requirements. The questions contained in a checklist, in effect, transpose standards, regulations, or procedural requirements into a series of questions.
The checklist denotes points to be checked and helps the auditor determine the correct order in which to proceed with an audit.
5.4.2 Conducting the Audit.
The auditor should use the audit checklist to gather evidence to determine compliance or noncompliance to the quality system or standard being evaluated. Evidence is gathered via review of products or articles, documents, observation of activities, record checks, and interviews with key individuals in the area(s) under review. Evidence gathered during the audit should be documented as the audit is conducted.
5.4.3 Reporting the Results.
A report should be prepared documenting the results of the audit. Procedures should be in place allowing straight-line reporting from the audit team to top company and QA management. The audit report should, at a minimum, include the following:
Date the audit was conducted, Auditor performing the audit, Standard or procedure the audit was conducted against (for example, part 21 requirements or the PAH Quality Manual), Summary of findings. This should include a brief description of the findings and supporting documents (for example, PAH procedures or records), Evaluation and relative importance of a finding (major or minor), and Summary of observations, both positive and negative.
5.4.4 Root Cause/Corrective and Preventive Action.
The PAH should determine root cause and develop a corrective and preventive action plan.
5-2
5.4.5 Close the Audit Findings.
After the process owner indicates completion of the corrective action, QA management should verify that process changes effectively corrected the existing deficiency and prevented recurrence. If the verification process indicates that the corrective action was not effective, top company management should be notified. QA management should then request additional corrective action and revalidation from the process owner.
5.4.6 File Report.
Audit reports, including corrective action and closure data, should be maintained.
5-3
CHAPTER 6. ADDITIONAL PAH REQUIREMENTS.
6.1 Quality Manual.
Sections 21.138, 21.308, and 21.608 state that each applicant or current PAH provide a manual describing its quality system to the FAA for approval. The manual is required by the rule to be in the English language and retrievable in a form acceptable to the FAA.
6.1.1 If the quality manual is stored digitally through a computer-based medium, it should be easily available to PAHs and FAA personnel who need to use the manual for performing their duties.
6.1.2 PAHs are reminded that the manual is required by the rule to address all of the quality system requirements in 21.137.
6.2 Location of or Change to Manufacturing Facilities.
Sections 21.139, 21.309, and 21.609 state that a PAH may obtain a production approval for manufacturing facilities located outside the United States, if the FAA finds no undue burden in administering the applicable requirements of Title 49 of the United States Code and this subchapter.
6.2.1 The PAH is required by the rule to obtain FAA approval before making any changes to the location of any of its manufacturing facilities.
6.2.2 The PAH is required by the rule to immediately notify the FAA, in writing, of any change to the manufacturing facilities affecting the inspection, conformity, or airworthiness of its product or article.
6.2.3 Each applicant for a production approval or current PAH should check with its local MIDO to determine approval and notification methods.
6.3 Inspections and Tests.
6.3.1 Sections 21.140, 21.310, and 21.610 state that each applicant or current PAH allow the FAA to— Inspect its quality system, facilities, technical data, and manufactured products or articles.
Witness any tests including any inspections or tests at any supplier facility (within the PAH’s supply chain) necessary to determine compliance with the applicable subchapter.
The PAH should ensure FAA access to, and cooperation of, all involved facilities in the supply chain. The PAH should also ensure access to, and cooperation of, all involved facilities in the supply chain for itself or its representatives.
6-1
6.3.2 Section 21.310 also prescribes prohibitions unique to that section. PAHs operating under subpart K should refer to the applicable section to ensure they are not in violation of those prohibitions.
6.4 Issuance of a Production Approval.
Sections 21.141, 21.311, and 21.611 states that the FAA issues a production approval after finding that the applicant complies with the requirements of the applicable subpart.
6.4.1 Applicants for a production approval should ensure they have reviewed and documented how they have met the applicable requirements so the FAA may complete a timely review.
6.4.2 Applicants for a production approval that are part of a multinational and/or multicorporate consortium may refer to appendix G to this AC for further guidance on how to comply with § 21.137.
6.5 Production Limitation Record.
Section 21.142, Production limitation record, states that the FAA will issue a PLR as part of a PC. A PLR lists the TC number and model of every product the PC holder is authorized to manufacture, as well as every interface component a PC holder is authorized to manufacture and install under part 21. PC holders should ensure the PLR accurately reflects any product it intends to manufacture and any interface component it intends to manufacture and install.
6.6 Duration.
6.6.1 Sections 21.143, 21.313, and 21.613 state that a production approval be considered effective until it is surrendered, suspended, revoked, or terminated by the FAA.
There are minor differences between the duration of a PC and that of a PMA or TSO authorization. Applicants receiving a production approval should refer to the applicable section for information on the duration of a particular production approval.
6.6.2 Section 21.613 also sets forth the requirements for revised or canceled TSOs. The holder of an affected FAA letter of acceptance of a statement of conformance, TSO authorization, or letter of TSO design approval, may continue to manufacture articles that meet the original TSO without obtaining a new acceptance, authorization, or approval. However, the holder is required by the rule to comply with the requirements of this chapter.
6.7 Transferability.
Sections 21.144, 21.314, and 21.614 state that a PAH may not transfer the production approval or letter of TSO design approval.
6-2
6.7.1 The FAA prohibits that transfer of a production approval, but the FAA recognizes that companies do change ownership. In many cases, design data, quality systems, and manufacturing processes are all transferred as part of the change in ownership, and in these instances the FAA will support the establishment of a new production approval.
6.7.2 Applicants for new production approvals based on previously issued production approvals should consult their local ACO and MIO for assistance.
6.8 Privileges.
Section 21.145, Privileges, identifies privileges associated with a production certificate.
PAHs should refer to the applicable section to ensure that they know these privileges.
6.9 Responsibility of Holder.
Sections 21.146, 21.316, and 21.616 prescribe a PAH’s responsibilities. PAHs should refer to the appropriate rule section for the type of production approval they wish to obtain or maintain to ensure they understand all of the applicable requirements.
6.9.1 The PAH is responsible for controlling the manufacture of completed products and articles in conformity with the FAA-approved type design data and quality system requirements. This responsibility cannot be delegated to, or relieved by, the use of approved suppliers, risk and revenue sharing partners, or co-producers.
6.9.2 Although this responsibility never changes, the PAH may be relieved of some of the burden of inspection and testing duties when it uses type-certificated products or articles manufactured under another person’s production approval. This relief may be extended to include products or articles manufactured in a foreign country and imported into the United States under the provisions of a bilateral agreement pursuant to part 21, subpart N, Approval of Engines, Propellers, Materials, Parts, and Appliances: Import.
6.9.3 All types of PAHs now have substantially similar responsibilities, as described below.
6.9.3.1 Paragraph (a) of each section requires the PAH to document any organizational changes. Such documentation is accomplished by amending the document required by §§ 21.135, 21.305, and 21.605, respectively, detailing how the organization will comply with the provisions of the respective subpart. The PAH is required by the rule to provide these amendments to the FAA. This requirement ensures the FAA remains informed of changes in a PAH’s organization as well as its continued compliance with the respective subpart.
6.9.3.2 Paragraph (b) of each section requires a PAH to maintain its quality system in compliance with the data and procedures approved for its production approval.
6-3