Aircraft Certification Service Voluntary Disclosure Reporting Program

10/01/2016 AC 00-68 3 RELATED REGULATIONS.

Title 14 CFR parts 21, 26, 39, 43, 45, and 183.

4 CHANGES.

This is the first issuance of this AC.

5 CANCELLATION.

This AC, which provides AIR-specific guidance for processing voluntary disclosures, as of its effective date, replaces the use of AC 00-58B, Voluntary Disclosure Reporting Program , dated 4/29/2009 for all FAA PAHs, DAHs, and AIR lead ODA Holders.

6 EFFECTIVE DATE.

This AC is effective 10/01/2016 7 BACKGROUND.

One of the FAA’s primary goals is to promote the highest level of safety and compliance with regulatory standards by using the most effective means to return a RE to full compliance. Typically, the FAA would use the compliance and enforcement processes set forth in FAA Order 2150.3, as amended, to bring REs back into compliance when noncompliance are found. The FAA believes aviation safety is well served by incentives for REs to identify and correct their own instances of noncompliance and to invest more resources in efforts to preclude their recurrence. Through this AC, the FAA is establishing processes under which it will not initiate compliance action, administrative action, or legal enforcement action when an entity detects noncompliance, promptly discloses them to the FAA, meets the criteria set forth in this AC, and takes prompt corrective action, acceptable to the FAA, to ensure the same or similar noncompliance do not recur. This incentive is designed to encourage compliance with regulations, foster safe operating practices, and promote the development of internal evaluation programs.

8 KEY TERMS.

The following key terms and phrases are defined to ensure a standard interpretation and understanding of the FAA ’ s voluntary disclosure policy.

8.1 Evidence.

For the purpose of voluntary disclosure, evidence generally consists of written documentation or reports that support a RE ’ s analysis of the disclosed apparent noncompliance and the resulting elements of the proposed corrective action plan (CAP) Evidence generally is derived from the following:  Documents or manuals reviewed,  Equipment examined, 10/01/2016 AC 00-68  Activities observed, and  Interview data.

8.2 Corrective Action. The action(s) taken by a regulated entity to eliminate ongoing noncompliance and to ensure future compliance.

8.3 Investigating Personnel (IP). AIR personnel normally involved in investigating apparent noncompliance. For the purposes of this AC, IPs may be any of the following:  Aviation safety inspectors for PAHs,  Aviation safety engineers and flight test pilots/engineers for DAHs, or  Organization management team (OMT) leads for ODAs.

Note: The OMT lead may choose to involve OMT members in processing a disclosure, but the lead should be the primary point of contact.

8.4 Noncompliance. As used in this process, describes any condition or discrepancy found that is not in compliance with the regulations or with any FAA-approved processes/procedures for which compliance is required, that requires corrective action.

8.5 Quality Escape. Products or articles that do not conform to type design which were not detected prior to leaving a quality system.

8.6 Regulated Entity (RE) . Any holder of an FAA-approved certificate, approval, or authorization.

8.6.1 Design Approval Holder (DAH) is a holder of an FAA approved Type Certificate; Supplemental Type Certificate, or Technical Standard Order.

8.6.2 Production Approval Holder (PAH) is a holder of an FAA-approved Production Certificate, Parts Manufacturing Approval, or Technical Standard Order Authorization.

8.6.3 Organization Designation Authorization (ODA) Holder is, for the purposes of this AC, the holder of an FAA-approved ODA which authorizes the ODA holder to perform approved functions on behalf of the Administrator , and whose lead managing office is AIR.

8.7 Remote Risk to Safety. A compromise to safety that is unlikely to occur or would seldom occur.

8.8 Systemic Noncompliance. The occurrence of noncompliance characterized by having similar, interconnected discrepancies throughout the system or organization and/or similar discrepancies that occur frequently.

10/01/2016 AC 00-68 9 VOLUNTARY DISCLOSURE REPORTING PROGRAM 9.1 The FAA believes the open sharing of information regarding noncompliance and a cooperative, as well as an advisory approach, to solving problems will enhance and promote aviation safety. When a noncompliance is discovered and disclosed, the RE and the IP should work together to identify the most appropriate means to gain compliance.

9.2 Under AIR’s VDRP there are two means by which an RE may disclose a noncompliance: either through the informal disclosure process (see section 10) or the formal disclosure process (see section 11). The appropriate disclosure process for a particular noncompliance depends on the type of the noncompliance being disclosed.

9.3 To be eligible for VDRP, whether disclosing under the informal or the formal disclosure process, the disclosure must meet the following requirements: 9.3.1 The FAA Was Notified. The RE has notified the FAA of the noncompliance promptly after detecting it and before the FAA has learned of it by other means.

9.3.2 The Noncompliance Was Inadvertent. The noncompliance was the result of inattention and did not result from a purposeful choice.

9.3.3 The Noncompliance Does Not Reflect a Lack of Qualification. The noncompliance does not indicate a lack, or reasonable question, of qualification of the RE.

9.3.4 Immediate Action Satisfactory to the FAA Was Taken. Immediate action, satisfactory to the FAA, was taken upon discovery to cease the conduct that resulted in the noncompliance.

9.3.5 Corrective Action Plan. The RE has developed, or is developing, a corrective action plan (CAP) and a schedule of implementation satisfactory to the FAA. For formal disclosures, the CAP should include a follow-up self-audit to ensure the action taken corrected the noncompliance. This self-audit is in addition to any audits conducted by the FAA.

Note: If there are minor deficiencies in the disclosure, the IP may work with the RE to correct those prior to making a determination of acceptance.

9.4 As a condition for consideration under the VDRP, an RE must enter into an agreement for tolling statutory or regulatory time limitations for the initiation of a legal enforcement action in the event of a failure to complete corrective action. The agreement will specify that the tolling period begins on the date the RE discloses the noncompliance and extends through the date in the event the FAA makes a final determination that the RE failed to complete corrective action. The statutory or regulatory time limitation for the initiation of a legal enforcement action will be extended by a period equal to the duration of the tolling period. By submitting either an informal or formal VDRP, the RE is thereby acknowledging this agreement for tolling statutory or regulatory time limitations from the date the RE discloses the noncompliance to the date in the event the FAA makes a final determination that the RE failed to complete corrective action.

10/01/2016 AC 00-68 10 INFORMAL VOLUNTARY DISCLOSURE REPORTING PROCESS.

10.1 The informal disclosure process is a streamlined means for a RE to voluntarily disclose certain noncompliance and for an IP to process such disclosures. The IP may accept a disclosure under the informal VDRP when: 10.1.1 The disclosure meets the requirements of section 9.3 of this AC, 10.1.2 The RE and the IP have executed an Informal Disclosure Agreement as described in section 10.2, and 10.1.3 The disclosure does not involve:  A noncompliance that poses more than a remote risk to safety;  A quality escape for articles and parts other than cosmetic flaws (flaws that do not affect fit/form/function); or  A systemic discrepancy to production quality system procedural requirements.

10.2 Informal Disclosure Agreement . An RE may disclose eligible noncompliance under the informal process only if it has executed an informal disclosure agreement with the responsible IP ’s office prior to the informal disclosure. This agreement defines when and by what means the RE discloses noncompliance. This agreement must contain the following: 10.2.1 An agreement to the type of noncompliance that the RE may disclose informally (e.g., non-systemic low risk noncompliance; quality escapes due to cosmetic flaws).

10.2.2 An agreement to the timeframe and means by which the RE will disclose noncompliance to the FAA (e.g., daily, weekly, quarterly). The timeframe must not exceed a quarterly disclosure period.

10.2.3 An agreement to the information that the RE must report to the FAA at the time the noncompliance(s) is disclosed. At a minimum, the RE must report the following information:  A description of the apparent noncompliance  A causal analysis of the apparent noncompliance  A corrective action taken/planned  A date by which the RE will complete the corrective action 10.3 IP Review and Documentation of Informal Disclosures. Once the RE discloses a noncompliance using the informal VDRP, the IP is responsible for documenting and tracking the disclosure until the IP has verified the RE’s completion of the corrective action to the satisfaction of the FAA. The responsible IP, at a minimum, must document:  The name of the RE; 10/01/2016 AC 00-68  The description of the noncompliance;  A description of the corrective action that the RE will take;  Whether or not the RE implemented the corrective action to the satisfaction of the FAA; and  The date that the IP verified that the RE implemented the corrective action.

10.4 If compliance cannot be gained through the informal VDRP, the responsible IP will follow the AIR Compliance and Enforcement Business Process to determine the appropriate action needed to gain compliance.

10.5 If the IP finds that a noncompliance disclosed by the RE under an agreed-upon informal VDRP is not eligible for acceptance because it involves any of the three exclusionary factors in paragraph 10.1, the IP will notify the RE of such ineligibility. The IP will offer the RE the option to disclose the noncompliance under the terms of the formal VDRP as outlined in section 11 of this AC .

Note: If the RE discloses to the FAA an apparent noncompliance during, or in anticipation of, an AIR audit/oversight activity, or in association with an accident or incident, the IP may forgo the use of the VDRP and may take administrative action or recommend legal enforcement action in accordance with Order 2150.3, as amended, and the AIR Compliance and Enforcement Process.

11 FORMAL VOLUNTARY DISCLOSURE REPORTING PROCESS.

The formal VDRP employs a six-stage process. Responsibility for each stage is assigned either to the RE or the IP, as described below. The FAA accepts a RE’s voluntary disclosure under the formal VDRP when:  The disclosure meets the requirements of section 9.3 of this AC, and  The RE has not executed an Informal Disclosure Agreement prior to the disclosure and thus is ineligible to voluntarily disclose under the informal VDRP, or  The RE is eligible to voluntarily disclose under the informal VDRP but such disclosure is excluded under the criteria in 10.1.3.

Note: In the context of the AIR VDRP, “ other means ” (see section 9.3.1) does not include in- service items reported through the RE’s Continued Operational Safety Process (COSP) or the Monitor Safety/Analyze Data (MSAD) process. If the RE reports an in-service issue through COSP or MSAD that was later discovered to be a quality escape, the disclosure is still acceptable provided it meets the criteria outlined in section 9.3 of this AC.

11.1 Stage I — Initial RE Notification to the FAA of an Apparent Noncompliance .

The following guidance applies when the RE notifies the FAA of an apparent noncompliance: 11.1.1 Notification must be directed to the appropriate IP who has oversight of the RE.

10/01/2016 AC 00-68 11.1.2 Notification must be submitted to the IP via written hardcopy or email.

11.1.3 Notification should be submitted by the RE within 24 hours of the RE discovering the apparent noncompliance. An IP may use discretion and accept disclosures that exceed the 24-hour policy when the IP determines that a later submission is justified based on the specific circumstances. The RE should not delay notification for any reason. The following are examples of discretion for VDRP notification acceptance: 11.1.3.1 A voluntary disclosure may be accepted if received later than 24 hours after discovering the noncompliance if the FAA has learned of an apparent noncompliance from an ASAP report as described in AC 120-66, Aviation Safety Action Program (ASAP) , as amended.

11.1.3.2 A voluntary disclosure may be accepted if received later than 24 hours after the RE discovers the apparent noncompliance if (1) the RE discovered the noncompliance as a result of an ODA self-audit and (2) the noncompliance does not pose more than a remote risk to safety. If the noncompliance poses more than a remote risk to safety, the 24 hour policy applies. The RE must disclose the noncompliance in accordance with this AC and note the noncompliance in the self-audit report as described in FAA Order 8100.15, Organization Designation Authorization Procedures .

11.1.4 Notification must address the following items: 11.1.4.1 Brief Description of Apparent Noncompliance. A brief description of the apparent noncompliance, including an estimate of the duration of time that it remained undetected, as well as by whom, where, how, and when it was discovered.

11.1.4.2 Verification the Noncompliance has Ceased. Verification that noncompliance ceased after the apparent noncompliance was identified.

11.1.4.3 Brief Description of Immediate Action. A brief description of the immediate action taken after the apparent noncompliance was identified, the immediate action taken to terminate the conduct that resulted in the apparent noncompliance, and identification of the person responsible for taking the immediate action.

11.1.4.4 Verification of Evaluation. Verification that the RE is evaluating its operations to determine if there are any systemic problems and the corrective steps necessary to prevent the apparent noncompliance from recurring.

11.1.4.5 Identification of Responsible Person. Identification of the person responsible for the implementation of the CAP.

11.1.4.6 Acknowledgement of Written Report. Acknowledgment that a detailed written report will be provided to the IP within 10 working days.

10/01/2016 AC 00-68 11.2 Stage II — FAA Response to the RE .

After receiving the RE’s initial notification , the IP will do the following: 11.2.1 The IP will review the disclosure and confirm that the submission meets the requirements set forth in paragraph 9.3 of this AC.

11.2.2 If the IP determines the disclosure is acceptable, the IP will:  Issue a written acknowledgment (letter/electronic method). This acknowledgement should include a request for a written report, as described in 11.3 of this AC;  Assign a VDRP tracking number to the disclosure; and  Enter all required VDRP information into the office tracking system.

11.2.3 If the IP determines the disclosure is not acceptable, the IP will follow the AIR Compliance and Enforcement Business Process to determine the appropriate action and will notify the RE.

11.3 Stage III — Written Report of the RE ’s Apparent Noncompliance .

The RE will provide the written report to the IP within 10 working days after the RE makes the initial notification, regardless of whether the RE has received the IP’s written acknowledgement of receipt of the RE’s initial notification . If the RE does not fully develop a proposed CAP within 10 working days, the RE will provide at least an overview of its CAP in the written report submitted within the 10 working days. The RE must submit a detailed description of the CAP within 30 calendar days after initial notification. The written report must include the following information: 11.3.1 Regulation or Procedure Violated . A list of the specific FAA regulation(s) or procedure(s) for which compliance is required that may have been violated.

11.3.2 Summary of the Noncompliance . A description of the noncompliance, including the duration of time it remained undetected, as well as how and when it was detected.

11.3.3 Immediate Action Taken. A description of the immediate action(s) taken to terminate the conduct that resulted in the noncompliance occurring. This includes when the action was taken and who was responsible for taking the action.

11.3.4 Explanation of How the Noncompliance Was Inadvertent . An explanation that demonstrates the apparent noncompliance was inadvertent. Inadvertent conduct (1) is the result of inattention and (2) does not result from a purposeful choice to engage in the conduct that results in the noncompliance.

11.3.5 Analysis of the Noncompliance. Analysis includes the identification of all causes associated with the noncompliance, as well as a summary of the evidence and supporting documentation that demonstrates the scope of the noncompliance.

11.3.6 Corrective Action Plan. A detailed description of the proposed CAP, outlining the planned corrective actions, proposed long-term corrective actions, the responsibilities for 10/01/2016 AC 00-68 implementing the corrective action, a timeline for completing the CAP, and a self-audit following implementation to ensure the corrective action(s) is effective. The following are examples of the types of questions or issues the CAP should address:  Does the noncompliance involve equipment, facilities, or individuals beyond those addressed in the initial notification and for which immediate action was taken?

 Are procedural or organizational changes necessary?

 How will the RE determine whether or not any procedural or organizational changes are effective?

 What procedures will the RE develop to ensure that it will periodically review the affected area in order to identify and mitigate risk concerns before a noncompliance results?

 Who will be responsible for performing periodic reviews?

 To whom in the RE’s organization will the results of those periodic r eviews be reported, and how will they be documented?

 A schedule for completion of a self-audit by the RE following implementation of the CAP to verify the action taken was effective in correcting noncompliance. The proposal should also include identification of the individual(s) responsible for conducting the self-audit. This self-audit is in addition to any audit conducted by the FAA.

11.3.7 Responsible RE Focal Point. Identification of the RE focal point responsible for monitoring the implementation and completion of the CAP.

11.4 Stage IV — Written Report Review and Corrective Action Plan Agreement .

The IP will work with the RE to ensure the RE has identified all cause(s) and systemic issue(s) that led to the noncompliance. This collaboration helps ensure the corrective action(s) contained in the CAP are acceptable to the FAA.

11.4.1 If the IP has agreed to the RE’s CAP, the IP will:  Issue written notification (letter/electronic means) to the RE indicating the proposed CAP is accepted and the disclosure is closed subject to reopening as a legal enforcement action if the RE fails to implement the corrective action agreed upon in the CAP.

 Update the office VDRP tracking system with the required fields.

11.4.2 If after working with the RE, the IP and the RE cannot agree on a CAP under the VDRP that is satisfactory to the FAA, the IP will pursue the appropriate enforcement action by taking administrative action or recommending legal enforcement action in accordance with Order 2150.3, as amended, and the AIR Compliance and Enforcement Process.

11.5 Stage V —RE’s Implementation of a Corrective Action Plan 10/01/2016 AC 00-68 11.5.1 After the FAA has accepted the RE’s CAP, the RE will begin/continue to implement corrective action(s) as outlined in the CAP. During the implementation period, the IP and RE should continue to work together. During the implementation, the RE is responsible for:  Ensuring that it completes all corrective action(s) outlined in the written report as agreed upon by the RE and the IP, and  Conducting a self-audit at the completion of the corrective action(s) to ensure proper implementation and the effectiveness of the implementation.

11.5.2 Changes can be made to the CAP when either the RE or the IP have identified the need.

If a change to the CAP is needed, the RE should submit the proposed change in writing to the IP. The IP should review the proposed change and issue an amended written notification if the change is accepted.

11.5.3 The IP should monitor the implementation of the corrective step(s) and assess the RE’s corrective effort(s). If, during this period, the IP determines the step(s) taken by the RE are not those documented in the CAP or the corrective action agreed upon is not being completed satisfactory to the FAA, the closure of the VDRP may be rescinded and legal enforcement action initiated.

11.6 Stage VI — FAA Verification of Completed Corrective Action Plan Once the RE has completed all corrective action(s) under the CAP, the RE will notify the IP of such completion. After receiving notification of the completed CAP, the IP will verify whether or not the corrective action is satisfactory to the FAA. The IP should conduct the verification during the next scheduled oversight activity or earlier at the discretion of the IP.

11.6.1 If the IP verifies that the RE implemented the CAP to the satisfaction of the FAA, the IP documents the completed verification in the IP’s local office’s VDRP tracking system.

The IP should notify the RE either orally or in writing that the IP has verified that the RE has completed the CAP to the satisfaction of the FAA.

11.6.2 If the RE did not implement the CAP as agreed upon between the RE and the IP and to the satisfaction of the FAA, the IP pursues legal enforcement action for both the original noncompliance and any subsequent noncompliance that have occurred due to the lack of corrective action.

12 ORGANIZATION DESIGNATION AUTHORIZATION SELF-AUDIT DISCLOSURES.

When an ODA self-audit identifies noncompliance that do not pose more than a remote risk to safety, the RE can disclose those noncompliance with the self-audit report and do not need to meet the initial 24 hour reporting requirement as outlined in this process. The IP and the RE will still follow the processes outlined in this AC for corrective action once the disclosure is made.

10/01/2016 AC 00-68 For any noncompliance found during an ODA self-audit that pose more than a remote risk to safety, the ODA must disclose within the 24 hour timeframe and follow the formal VDRP process outlined in this AC.

13 REPEATED NONCOMPLIANCE.

If a repeated noncompliance occurs, notwithstanding the fact that a CAP was satisfactorily completed and followed, the procedures outlined in this AC may apply to the disclosure of the repeated noncompliance. Upon consideration of the facts and circumstances surrounding the repeated noncompliance, the IP will determine on a case- by-case basis whether to accept a report involving repeated noncompliance under the VDRP in accordance with this AC. REs and IPs are encouraged to evaluate the systemic issues and circumstances surrounding each apparent noncompliance.

14 DISPUTE RESOLUTION.

When disputes occur regarding the acceptance of a proposed comprehensive fix or a modification thereto before the fix is considered satisfactory, the IP and the RE may request that the issue be resolved at the next level of management within the FAA. This allows for an independent assessment of the areas in disagreement.

15 APPLICABILITY OF THE FREEDOM OF INFORMATION ACT (FOIA) TO SELF-DISCLOSURE RECORDS.

Information submitted by the RE to the FAA for review pursuant to this voluntary self- disclosure program is protected from release to the public in accordance with the provisions under 14 CFR Part 193.

16 WHERE TO FIND THIS AC.

16.1 You may find this AC at http://www.faa.gov/regulations_policies/advisory_circulars/ .

16.2 If you have any suggestions for improvements or changes, you may use the template provided at the end of this AC.

David W. Hempe Deputy Director, Aircraft Certification Service

10/01/16 AC 00-68 Appendix A Appendix A. ADVISORY CIRCULAR FEEDBACK INFORMATION If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) complete the form online at https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx or (2) emailing this form to 9-AWA-AVS-AIR- DMO@faa.gov Subject: AC Date: ___________ Please check all appropriate line items: An error (procedural or typographical) has been noted in paragraph _______ on page _______ .

Recommend paragraph _______ on page _____ __ be changed as follows: In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)

Other comments: I would like to discuss the above. Please contact me.

Submitted by: _________________________________ Date: __________________ A-1