Certificate Management of Production Approval Holders

8120.23B Chapter 1. General 1-1. Purpose of This Order. This Order explains the Aircraft Certification Service (AIR) certificate management program.

Note: This order is available to the public for information purposes only. Its content is not legally binding on the public in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Public conformity with the guidance document is voluntary only; nonconformity will not affect rights and obligations under existing statutes and regulations.

1-2. Audience. All Federal Aviation Administration (FAA) employees who participate in certificate management activities conducted at a production approval holder (PAH) and its suppliers.

Note: As used in this order, the term PAH encompasses both a PAH and its associate facilities.

1-3. Where to Find This Order. You can find this order on the FAA employee website, on the FAA public website, and in the FAA Dynamic Regulatory System (DRS). Unless stated otherwise, please refer to the latest version.

1-4. What This Order Cancels. This revision cancels the following order, deviations, and policy memorandums: a. FAA Order 8120.23A, CHG 2, Certificate Management of Production Approval Holders, dated June 6, 2025.

b. AIR-600-DM43, Deviation to FAA Order 8120.23, CH2, Certificate Management of Production Approval Holders, Implementation of Risk Within a Facility Assessment at AIR-582 Production Approval Holders, dated September 25, 2025.

c. AIR-600-DM34, Deviation to FAA Order 8120.23, CHG 1, Certificate Management of Production Approval Holders, to Allow for Additional Team Members-in-Training for Quality System Audits (QSA), dated April 10, 2025.

d. AIR-600-GM-09, Revision to FAA 8100-3, Quality System Report No.: FAA 8100-6, Approval/Certificate Management Activity Report, dated February 21, 2024.

e. AIR-100-14-140-GM13, Clarification of QSA Credit Received for Participation During MIDO Audits, dated July 21, 2017.

1-5. Explanation of Policy Changes. This revision: a. Organizes the ongoing certificate management process into four sections: scheduling audits, planning audits, conducting and documenting audits, and post-audit activities including processing noncompliances.

1-1 8120.23B b. Introduces the fourth pillar of the risk assessment: the process for determining risk within a facility and preparing the facility plan.

c. Integrates Safety Management System (SMS) compliance audits and their applicability to oversight of a PAH with a required or voluntary SMS (VSMS) into the order.

d. Emphasizes the selection of subtier suppliers and refines the selection of facilities for audits.

e. Establishes supplier risk indicators for suppliers and subtier suppliers as higher, moderate, or lower risk to factor into the facility selection process.

f. Adds guidance for auditing the PAH’s supplier control procedures during principal inspector (PI) audits.

g. Requires a documented audit plan for performing all PI audits, supplier control audits (SCA), and quality system audits (QSA).

h. Defines first article inspections (FAI) and emphasizes FAI under two product audit criteria (Inspection and Documentation) during the performance of a product audit.

i. Emphasizes the importance of reviewing previous findings as part of ongoing certificate management, and adds a step detailing when to determine if a finding is systemic or isolated for PI audits, SCAs, and QSAs.

j. Revises the definitions for systemic and isolated and updates instructions for completing FAA Form 8100-6, Noncompliance Record , with those revised definitions.

k. Adds noncompliance codes for SMS compliance audits.

l. Replaces Aircraft Certification Audit Information System (ACAIS) with the “oversight information system” as the certificate management (CM) automation tool.

m. Moves the QSA Auditor Appointment and Training subpart to a separate appendix.

n. Removes Table 3-3, Applicability of Product Audit Criteria to Product Audit Areas (Minimum).

o. Removes Chapter 4, Section 7, Determining Undue Burden or No Undue Burden to Align with FAA Order 8100.11, Requirements for Finding Undue Burden and No Undue Burden Under 14 CFR Part 21 p. Updates or revises the following figures, tables, and form: (1) Figure 2-1, Certificate Management Life Cycle Process; (2) Figure 3-1, Three Pillars of Risk Assessment to Figure 3-1, Four Pillars of Risk Assessment; 1-2 8120.23B (3) Figure 3-2, Risk Level Determination Process; (4) Table 3-1, Ongoing Certificate Management Audit Minimum Requirements; (5) Table D-1, Quality System Elements to Table E-1, Quality System Elements and; (6) FAA Form 8120-14, Production Approval/Certificate Management Activity Report.

1-6. Effective Date. This revision is effective on .

1-3

8120.23B Chapter 2. Certificate Management Overview 2-1. Purpose of This Chapter. This chapter provides an overview of the AIR certificate management program. It describes our statutory responsibilities to perform certificate management and explains how our policies fulfill those responsibilities.

Note: References to “Certificate Management Branch” or “CM branch” include branches responsible for the production approval and oversight aspects of this policy within the Integrated Certificate Management Division (AIR-500) and the System Oversight Division (AIR-800).

References to “certificate management section” or “CM section” include sections responsible for the production approval and oversight aspects of this policy within AIR-500 and AIR-800.

References to “certification branch” include branches and sections responsible for design approval and oversight aspects of this policy within the Compliance and Airworthiness Division (AIR-700) and AIR-500.

2-2. FAA’s Authority to Perform Certificate Management. Title 49 of the United States Code (49 U.S.C.) subtitle VII provides the general statutory authority for the AIR certificate management program and allows the FAA to perform oversight of PAHs at any time and take appropriate actions in the interest of safety. FAA inspectors may enter a PAH’s facility at any time to perform oversight. FAA inspectors must document oversight activities in accordance with paragraph 4-8, 4-17, 4-34(b), and 4-36 of this order and notify a PAH of noncompliances in accordance with Chapter 3, Section 5 of this order. Part 21 of 14 CFR includes specific requirements for PAHs to produce duplicate products or articles. Specifically, 14 CFR 21.137 requires a PAH to describe in writing a quality system that ensures each product and article conforms to its approved design and is in a condition for safe operation. Holders of production certificates (PC), parts manufacturer approvals (PMA), and technical standard order authorizations (TSOA) must meet the responsibilities of a holder as described in 14 CFR 21.146, 21.316, and 21.616, respectively.

2-3. Certificate Management Program Overview. The certificate management program consists of the policies, procedures, and associated information technologies by which the FAA fulfills its statutory responsibilities to ensure a PAH remains in compliance with those regulations that govern the manufacturing of its products or articles. It is a system approach to monitoring a PAH’s compliance with regulations that ensures appropriate corrective actions are taken. The applicable FAA CM section is responsible for all activities associated with the certificate management of PAHs. This program does not impose additional requirements on PAHs.

a. Ongoing Certificate Management. Ongoing certificate management consists of a four- step closed-loop process that is consistent with safety management system best practices. Figure 2-1 below provides a flowchart of this process. The process consists of the following four steps— (1) Scheduling certificate management, (2) Planning certificate management, 2-1 8120.23B (3) Conducting and documenting audits, and (4) Performing post-audit activities and processing noncompliances.

b. Approach to Reviewing Previous Findings. Scheduling and planning activities must also include reviewing and analyzing findings and noncompliances from previous audits and other oversight activities to identify and address systemic issues that occur at a PAH and its points of manufacture. A comprehensive review of findings from multiple past audits and other activities, rather than a review only during the audit, is essential to the FAA fulfilling its statutory responsibilities to ensure that a PAH remains in compliance with those regulations that govern the manufacturing of its products or articles.

c. Types of Audits. The FAA performs the following audits as part of its ongoing oversight of PAHs: (1) Principal Inspector (PI) audits, (2) Supplier control audits (SCA), and (3) Quality system audits (QSA).

d. Additional Oversight Responsibilities. The following tasks are accomplished on an as-required basis by the CM section responsible for a specific PAH within its assigned responsibilities. Any tasks required to be scheduled and conducted at a PAH or supplier facility located in another assigned CM section should be handled in accordance with paragraph 3-17 of this order.

(1) Review any changes to a PAH’s quality system, (2) Investigate any § 21.3 reports, (3) Perform unscheduled audits and investigations, and (4) Provide guidance to a PAH.

2-2 8120.23B Figure 2-1. Certificate Management Life Cycle Process 2-3 8120.23B e. Certificate Management Website. The certificate management website is an informational site on which the FAA can add, delete, or change material as required. The certificate management website provides both current and historical information related to aspects of certificate management and may include the following: (1) Links to certificate management-related— (a) Data collection and analysis sites; (b) Work tools; (c) FAA publications, Quality Management System (QMS) documents, and correspondence; (d) Briefings, presentations, and articles; (2) Lessons learned, and (3) Any other information to support the certificate management process.

2-4

8120.23B Chapter 3. Ongoing Certificate Management Responsibilities Section 1. Introduction 3-1. Purpose of This Chapter. Sections 2 through 5 of this chapter provide detailed guidance for accomplishing ongoing certificate management responsibilities.

3-2. Audit Basics. Auditing is the key component of the certificate management program. An audit (PI audit, SCA, or QSA) is a systematic, independent, and focused data-driven, product based examination of an established PAH’s manufacturing system based on the quality system elements as defined in § 21.137 (refer to Appendix E to this order). Its purpose is for the CM section to validate that the PAH is effectively complying with regulations, and to determine conformity to approved design, quality system requirements, and safety management system (SMS) requirements, as required. An audit is conducted at the location of the PAH or its supplier/subtier supplier. The audit should be conducted at the point of manufacturing, on areas with the highest risk, as identified in the audit plan (refer to Appendix B to this order). All audit activities are documented and maintained in the oversight information system. The oversight information system contains all audit related forms and templates to be used by the CM section when scheduling, planning, conducting, and documenting audits (refer to Chapter 6 of this Order).

3-3. Assignment of Certificate Management Coordinator. Many of the tasks identified in this chapter for the CM branch and the CM sections are primarily administrative. A high degree of operational efficiency may be achieved by assigning many of these tasks to a designated certificate management coordinator. CM branch managers should consider whether such an assignment would be beneficial for their organizations. A CM coordinator may be responsible for the following tasks: a. Facilitate QSA candidate and auditor appointment and training.

b. Schedule audits and QSA team selection; obtain additional resources when required.

c. Maintain a supplier control audit list.

d. Provide general certificate management-related information.

3-4. Status of a PAH. For purposes of certificate management, the administrative status in the OIS of a PAH and its applicable projects can be identified as one of the following: a. Pending. The FAA has received the production approval application and is in the approval process; however, no production approvals have been issued.

b. Active. The FAA has issued a new production approval, or the PAH has produced products or articles within the past 12 months.

c. Inactive. The FAA has determined that the PAH has not produced products or articles within the past 12 months. While in an inactive status, the PAH must maintain its 3-1 8120.23B FAA-approved quality system in accordance with 14 CFR Part 21. A PAH may be placed in an inactive status, and noted in the oversight information system, under the following conditions: (1) The PI may make the determination to keep the PAH inactive up to 36 months from the initial inactive date.

(2) To keep the PAH inactive beyond the 36th month, it must be approved by the PI’s office manager.

(3) To keep the PAH inactive beyond the 48th month, it must be approved by the CM branch manager.

(4) An inactive PAH’s production approval will be cancelled in the 60th month unless approved by a deviation to the order signed by the Policy and Standards Division, AIR-600.

(5) If an inactive PAH resumes production and becomes active, the PI will conduct a risk assessment in accordance with paragraph 3-7 of this order to initiate FAA certificate management.

d. Canceled. The administrative status in the OIS indicating the PAH has surrendered their production approval, or the FAA has completed action to revoke or otherwise terminate the PAH’s production approval.

Note: If the PAH does not surrender its production approval and has no plans for future production, the FAA must follow specific due process procedures outlined in 49 U.S.C.

Particularly, 49 U.S.C. 44709 (b)(1)(A) grants the Administrator the authority to revoke various certificates, including production certificates, if, after investigation, the Administrator deems it necessary for safety and public interest. Revocation may require a formal legal enforcement action, which is handled by the Office of Chief Counsel (AGC).

3-2 8120.23B Section 2. Certificate Management Scheduling 3-5. General. Scheduling activities include conducting an annual in-depth risk assessment of each PAH and scheduling the audit activities based on the results of that risk assessment. AIR’s certificate management policy and its scheduling activities are designed to focus audits on the PAH and its points of manufacture that pose the greatest risk.

3-6. Risk Assessment. To ensure resources are being applied to the appropriate areas of risk and the correct level of oversight is being conducted, each active PAH is subject to a risk assessment. Each assessment employs four pillars, if applicable, to provide a consistent and justifiable basis for effective use of FAA resources when performing certificate management: a. Exposure within the National Airspace System (NAS), in accordance with paragraph 3-8 of this order; b. Organizational risk assessment, in accordance with paragraph 3-9 of this order; c. Facility selection, in accordance with paragraph 3-13 of this order; and d. Risk within a facility, in accordance with paragraph 3-18 of this order.

Figure 3-1. Four Pillars of Risk Assessment 3-7. Risk Assessment Preparation. The CM section must conduct an annual risk assessment of each PAH between January 1 and March 31, to support the audit schedule for the following fiscal year. Holders of a letter of a technical standard order (TSO) design approval, and PAHs in an inactive status are not subject to a risk assessment. The risk assessment must be conducted in accordance with the instruction provided in the oversight information system and paragraphs 3-8, 3-9, and 3-11 through 3-14 of this order. The PI must collect and verify all information needed to complete the risk assessment before entering the information into the oversight information system. When appropriate, the PI will contact each PAH to obtain current or clarifying information relevant to the risk assessment. The PI must contact each PAH previously designated as inactive to determine whether the PAH’s status has changed.

3-8. Exposure Within the National Airspace System (NAS). T he first pillar of the PAH’s overall risk assessment determines the PAH’s risk exposure in the NAS, using the Risk Level Determination Process, located in the oversight information system. The Risk Level Determination Process places the PAH in one of three risk levels, based on a series of questions.

Refer to Figure 3-2 of this chapter for the level determination decision flow: 3-3 8120.23B a. PAHs placed in Level 1 have the highest risk exposure in the NAS. These PAHs manufacture products, as defined by § 21.1, at high production rates, with greater complexity, and significantly outsource production to its suppliers. These products do not include unmanned aircraft (UA) produced as low-risk. Low-risk UAs, as identified within their type certificate data sheets (TCDS), are considered a Level 3 PAH.

b. PAHs placed in Level 2 manufacture either a product designated as a lesser risk than Level 1 or a critical article.

Note: For Level 1 and Level 2 PAHs, the CM section may change the level determination one level, to either Level 1 or Level 2. If this type of change is made by the CM section, the rationale must be documented in the oversight information system.

c. PAHs placed in Level 3 have the least risk exposure in the NAS. Unlike PAHs placed in Level 1 or Level 2, these PAHs do not manufacture products or articles located on the category parts list (CPL) or designated as critical by the PAH. In addition, PAHs that only manufacture products or articles for low-risk UAs are placed in Level 3.

Note: When using the Risk Level Determination Process, the PI may use the PAH’s critical parts list in lieu of the AIR CPL, when approved by the assigned certification branch.

Figure 3-2. Risk Level Determination Process Risk Level Determination Level 1 Determination Decision The PAH must meet all three of the question criteria or use the option listed below: Question #1: Does the PAH produce annually more than 100 aircraft, 500 engines (to include rebuilt engines), or 1500 propellers annually?

Question #2: Does the PAH have 2 or more models in production?

Question #3: (a) Does the PAH have 20 or more external suppliers of critical parts/major assemblies 3-4 8120.23B 3-9. Organizational Risk Assessment. Following the determination of the risk level, the second pillar of the PAH’s overall risk assessment utilizes the risk-based resource targeting (RBRT) assessment tool to determine the organizational risk. The tool includes several factors that result in the identification of quality systems and complexities according to their potential to produce nonconforming products or articles and the consequential results associated with introducing those products or articles into the system. As a result of the RBRT assessment, a PAH is assigned one of the following organizational risk levels: a. High. A PAH with the greatest potential to produce nonconforming products or articles.

b. Medium. A PAH with a moderate potential to produce nonconforming products or articles.

c. Low. A PAH with low potential to produce nonconforming products or articles.

Note: The RBRT assessment questions and the guidance for completing the assessment are in the oversight information system.

3-10. Minimum Audit Requirements. The output of the PAH’s exposure to the NAS and the organizational risk assessment, specifically the risk level determination and the organizational RBRT designation, is used to define the CM section’s certificate management minimum audit requirements. Table 3-1 provides the minimum audit requirements and corresponding frequencies associated with the ongoing certificate management of PAHs.

Table 3-1. Ongoing Certificate Management Audit Minimum Requirements Level Level 3 Level 2 Level 2 Level 2 Level 1 Level 1 Level 1 3 Medium Low Medium High Low Medium High Low 1+ PI 1+ PI 1+ point of 2+ 4+ 6+ 12+ 18+ POM Audit Audit manufacturing POM POM POM POM Audits within within (POM) Audits Audits Audits Audits within every every 2 Audit within within within within within every FY 3 FYs every FY every every every every fiscal FY FY FY FY years 1 (FYs) QSA 1 1 1 1 1 NTE QSA QSA QSA QSA QSA 48 NTE NTE NTE NTE NTE months 36 24 36 24 24 months months months months months Note 1: All audits in the table above are only “minimum” audit requirements. The plus symbol (+) indicates that management of the CM section may determine that additional audits are required.

Note 2: Product audits must be conducted during all audits.

3-5 8120.23B Note 3: SMS Compliance audits, when applicable, are integrated with PI and QSAs.

3-11. Agreement of Risk Assessment. The RBRT assessment tool requires an approving official, usually the CM section manager or their delegate, to review the calculated risk level and the recommended certificate management requirements. To the greatest extent possible, the PI and the CM section manager or their delegate should agree on the final risk level. The CM section manager or their delegate will indicate approval in the oversight information system.

3-12. Modification of Risk Assessment. When any of the following conditions occur at a PAH the PI should complete a new level determination and a new RBRT assessment: a. Changes in a product or article’s criticality; b. Significant quality system changes; c. Significant turnover of key staff; d. Significant increases or reductions in workforce; e. Deliberate nonresponsiveness to corrective action requests; f. Significant service difficulties attributed to manufacturing or quality system problems; g. Addition or modification of a complex manufacturing process (e.g., additive manufacturing, composite fabrication, friction stir welding); h. Addition or significant modification of a complex product or article(s); i. Significant changes in the use of suppliers/outsourcing; j. Significant increases in the use of international suppliers; k. Movements or shifts of production locations or volumes; l. Expiration of a labor contract or potential labor unrest; or m. Changes in the SMS maturity assessment completed under FAA Order 8120.25, Safety Management Oversight of Design and Production Approval Holders, if applicable.

Note: When the audit schedules are impacted by a change in the assigned risk level, the PI should adjust the certificate management schedule accordingly.

3-13. Overview of Facility Selection and Scheduling. The third pillar of the PAH’s overall risk assessment is the CM section’s determination of which of the PAH’s manufacturing facilities, suppliers and subtier suppliers should be audited. The facility selection determination is a risk-based decision that determines how the required number of audits will be distributed among the PAH’s manufacturing facilities, suppliers and subtier suppliers. To aid in this decision, a facility selection process has been developed that prioritizes a PAH’s manufacturing facilities based on risk. Refer to paragraph 3-14 of this order. The third pillar also includes 3-6 8120.23B low-risk UAs, as identified within their TCDS. These UAs are considered low-risk, Level 3 PAHs. CM sections will not select a point of manufacturing audit at the UA’s supplier location.

All certificate management of low-risk UAs will be conducted at the PAH’s location or flight test area.

3-14. Facility Selection Process. After determining the results of a PAH’s exposure to the NAS and completing the organizational risk assessment (i.e., the number and frequency of certificate management audits), the CM section must select the specific point of manufacturing locations (whether PAH, supplier, or subtier supplier facilities) where the required audits will be conducted. This facility selection process is based on a review of the PAH and its supplier manufacturing activities, level determination, RBRT assessment, and the distribution of production responsibilities. As part of the facility selection process, the CM section must evaluate available information regarding the PAH’s suppliers and subtier suppliers, including articles produced and critical processes performed. Once the CM section determines the minimum number of audits and frequency, the PAH/supplier manufacturing ratio may guide the facility selection process, ensuring that the distribution of audits reflects the proportion of manufacturing between PAHs and their suppliers (e.g., if 80% of production is conducted by the PAH, approximately 80% of the audits should be allocated to PAH facilities). This approach ensures that certificate management audits are strategically assigned to facilities representing the highest risk and impact to the production system. The CM section may use a facility selection process other than the process described in this section, provided the alternate process is equivalent to or better than the facility selection process described in this section. Before its use, the CM section will submit its alternative facility selection process to the CM branch for review and acceptance. When a PAH has multiple facilities listed on the production approval, numerous suppliers producing critical articles, or both, the CM section will prioritize their audit locations by validating the following criteria: a. Will the facility produce any aircraft, aircraft engine, propeller, or article thereof in the next twelve months?

b. Does the facility perform any final testing for an aircraft, aircraft engine, propeller, or critical article?

c. Is the facility solely an assembler/ integrator?

d. Are special processes being performed on a critical article (e.g., heat treat, welding, composite, friction stir welding, chemical etching, additive manufacturing, etc.)?

e. Have key inspections or authorizations been delegated to this facility? (e.g., receiving inspection, supplier control, testing, first article inspection (FAI), in-process inspection, nondestructive inspection (NDI), final inspection, dock to stock, Material Review Board (MRB), etc.)?

f. Has the facility been added to the production approval or the supplier listing within the last 12 months?

g. Has the facility been relocated to a new address within the last 12 months?

3-7 8120.23B h. Does evidence indicate that no on-site evaluations have been performed at this facility in the last 12 months?

i. Have any FAA-documented noncompliances at the facility resulted in compliance and enforcement action within the last 2 years?

j. Has the facility had any quality escapes events within the last 24 months?

k. Is the facility located in a non-bilateral country or a bilateral country where the foreign civil aviation authority (CAA) cannot support the FAA?

l. Is there new or novel manufacturing being implemented at the facility?

m. How many quality systems elements are applicable to the facility (refer to Appendix E to this order)?

n. Other criteria, as applicable.

3-15. Supplier Risk Indicators. The following risk indicators, including any information from paragraph 4-6 of this order, should factor into the facility selection process for suppliers and subtier suppliers: a. Higher Risk. Suppliers with two or more of the following characteristics should be assigned a higher risk level: (1) New critical suppliers.

(2) Suppliers that produce critical parts or perform special processes.

(3) Suppliers with known noncompliances or documented quality escapes.

(4) High supplier activity (active purchase orders) (5) Suppliers that have not undergone a recent FAA audit.

(6) Suppliers that produce parts not inspectable upon receipt.

b. Moderate Risk. Suppliers with one or more of the following characteristics should be assigned a moderate risk level: (1) Suppliers that produce fewer critical parts or perform fewer special processes than higher risk suppliers.

(2) Moderate supplier activity (active purchase order within the past 12 months) (3) Suppliers with a history of noncompliances.

(4) Suppliers with a history of FAA oversight, however no recent FAA audit.

3-8 8120.23B c. Lower Risk. Suppliers with one or more of the following characteristics should be assigned a lower risk level: (1) Suppliers that produce minimal critical parts or perform minimal special processes.

(2) Low supplier activity (no active purchase order within the past 12 months) (3) Suppliers with a recent FAA audit.

(4) Suppliers with a consistent history of compliance.

Note: The CM section will not select PAHs as suppliers for an SCA unless a special justification exists, or the supplied articles are not part of that PAH’s production approval. If the supplier is a PAH and the supplied articles are listed on the PAH’s production approval, the CM section will conduct the audit following the applicable PAH audit procedures in Chapter 4, Section 2 of this order.

3-16. Scheduling Certificate Management Audits. A certificate management schedule assists the CM section in scheduling and tracking audits and the performance of PAHs and its applicable suppliers and subtier suppliers.

a. After facility selections have been completed, the CM section will develop a certificate management schedule annually for those PAHs that have oversight activities scheduled for the upcoming fiscal year. The CM section will adjust the certificate management schedule when changes occur that affect any of the four pillars of risk.

b. At a minimum, the certificate management schedule will include the following: (1) The name and location of the PAH or applicable supplier subjected to an audit.

(2) Schedules for the audits to be conducted by the CM section.

(3) Prioritization of the locations to be audited based on the level determination, the RBRT assessment, and the facility selection process. For the number of audits to be conducted at the PAH or supplier locations, refer to table 3-1 of this order. The objective is to conduct oversight at the facilities with the greatest risk. Additional audits at a manufacturing facility may be warranted if the FAA’s confidence in the PAH’s quality system has diminished.

(4) A list of hand-offs or CAA requests sent, including, as a minimum, the name of the assigned office that has accepted the hand-off or the CAA that has accepted the oversight request from the CM section. Also include the type of audit requested, the name of the manufacturing facility receiving the audit, and the name of the responsible PAH. Refer to paragraph 3-17 of this order for more information about hand-off procedures.

Note: Hand-off activity duration can be for any given period of time from a one-day event to multiple days or trips in a given fiscal year. Example: The hand off CM section can request the CAA or other assigned office to perform the audit once a year or once a quarter per year, or multiple years until cancelled.

3-9 8120.23B (5) A list of hand-offs or CAA requests received, including, as a minimum, the name of the CM section or CAA that has requested the hand-off, the type of audit or oversight requested, and the name of the applicable manufacturing facility.

(6) The scheduling function in the oversight information system is intended to provide a starting point in the development of the certificate management schedule. Should an inconsistency develop between the number generated in the oversight information system, frequencies, or scheduled dates of certificate management activities and the requirements in table 3-1 of this order, table 3-1 will take precedence. If the number of audits exceeds the certificate management chart minimums, additional certificate management tasks should be considered at the discretion of the CM section.

3-17. Hand-off Procedures. The following hand-off procedures are applicable to QSA, PI audits, SCAs, and product audits: a. The requesting CM section will submit, in the oversight information system, a memorandum to the assigned office no later than May 1 of each year. The memorandum will indicate the type of audit that should be conducted and will include all pertinent information regarding the audit, including— (1) The name and address (including country, as applicable) of the PAH or supplier, the actual address where the audit will occur, as well as the PAH’s project number; (2) The name, title, and telephone number of the accountable manager at the PAH’s facility or the person to contact at the supplier who can furnish purchase orders, quality system data, technical data, and other pertinent information; (3) Notification from the CM section to the assigned office, if a PI audit with no advance notice is requested as described in paragraph 4-3 of this order; (4) Any other information regarding specific PAH or supplier activities that should be audited, such as a new process or new technology; (5) Information pertinent to a product or article to be audited, such as part number and description, next level of assembly, or service difficulty or warranty return history; and (6) In the case of an SCA— (a) Notification from the CM section to the assigned office to provide reduced notice to the PAH, if reduced notice is requested as described in paragraph 4-15 of this order, (b) A copy of the PAH’s or supplier’s quality system procedures that are required to be implemented at the particular supplier’s facility, unless these documents are available to the FAA at the supplier’s facility, (c) Any delegation of MRB or technical data change control authority, and (d) Any authority permitting direct shipment.

3-10 8120.23B b. When an assigned office receives a request to conduct an audit, it will— (1) Acknowledge the receipt of the request in the oversight information system, (2) Add the audit to its certificate management schedule, if applicable, and (3) Provide updated audit lists to the other CM branch managers.

c. At the completion of the audit, the assigned office will document the audit in accordance with Chapter 3, Section 4, to include a memorandum that summarizes the results of the audit.

All applicable objective evidence will be provided to the requesting CM section. This memorandum will also close-out the hand-off audit.

Section 3. Certificate Management Planning 3-18. Risk Within a Facility. The fourth pillar, risk within a facility, provides a systematic approach for determining and identifying areas or processes within the facility with the highest risk, those that have the greatest impact on producing critical parts or processes, or both.

a. This assessment: (1) Is required for all Level 1 and Level 2 High PC holders, however, the CM section may use this assessment to determine risk within a facility for all other PAHs.

(2) When required, must be conducted quarterly and when significant changes are identified within the facility.

(3) Directs evaluation of the facility to determine which areas require targeted oversight, recognizing that some areas may be excluded due it being outside the scope of FAA oversight. The PI will exercise discretion to consider elements such as complexity, critical processes, production impact, historical findings, and other relevant factors.

(4) Requires the collection and use of necessary facility information. PIs are not limited to these sources and may gather any relevant data needed to accurately assess risk. Examples include, but not limited to: (a) PAH internal data such as statement of work, production nonconformances, quality escapes, and internal audit results.

(b) FAA data such as compliance and enforcement history and prior audit noncompliances, observations from previous oversight, and interviews with PAH employees.

(c) Emerging risk such as new technologies, process changes, production increases, or organizational instability.

(5) Supports understanding of the facility’s manufacturing processes, design approval, and any special processes.

3-11 8120.23B Note: The PI or auditor should be familiar with all audited manufacturing areas. If an inspector is not familiar with an area, the CM section should develop and document a plan to ensure that the PI has the experience and knowledge of the manufacturing areas.

(6) Should identify hazards that may affect conformity of part(s), if any, and any mitigation factors associated with the hazards, such as hazards associated with work transfers, relocation of parts, line movements, out of work sequences, etc.

b. The PI will analyze the collected data using a structured, standardized, and documented method. Tools or methods (e.g., matrix, spreadsheet, scoring system) may vary based on facility characteristics, but must allow identification and comparison of high-risk areas.

c. The determination of risk within a facility will support a facility plan as described in paragraph 3-19 of this order.

3-19. Facility Plan. Once the risk within a facility has been determined, the PI must prepare a facility plan identifying areas to target oversight, which may include programs, processes, parts, departments, or physical locations. This plan is particularly important when multiple audits are scheduled at the same facility. If there are changes associated with the risk within a facility determination, the PI should update the plan or conduct an unscheduled audit in accordance with Chapter 5, Section 5 of this order. The CM section should track manufacturing processes previously audited and consider processes or areas that have not been audited. The plan should take into consideration the following: a. If a process is only performed during non-duty hours, e.g., night shift or weekend, the plan should include auditing during non-duty hours.

b. If an area or process that was planned for an audit is not available, the PI should reschedule the audit or follow up with an unscheduled audit.

c. Areas of highest risk to target oversight, those that have the greatest impact on producing critical parts or processes (e.g., additive manufacturing, heat-treat, composite layup, and noncompliances/quality escapes, etc.), or both.

3-20. Audit Plan. For all audits, the PI must prepare an audit plan before each PI audit and SCA, and the audit Team Leader must prepare an audit plan before each QSA. The audit plan should be scalable to the facility, using guidance found in Appendix B to this order. Audit planning should support the PI’s familiarity with the audited facility. If an audit is handed off per paragraph 3-17 of this order, the requesting CM section and assigned CM section should coordinate who is responsible for developing the audit plan. An audit plan may be found in the OIS, however the division may use an alternate plan not found in the OIS and include a copy in the OIS.

3-12 8120.23B Section 4. Conducting and Documenting Audits Part 1. Overview 3-21. Product-Based System Audits.

a. AIR employs a product-based system audit approach when conducting audits. A product-based system audit is a planned and recorded activity that relies on using selected products and articles for determining— (1) Whether that product or article conforms to approved data, (2) Whether a PAH complies with quality system requirements, including procedures and special processes established to meet those requirements, and (3) Whether a supplier is furnishing products, articles, or services that conform to the PAH’s requirements.

b. Two types of audits are conducted: (1) Audits using the point of manufacturing methodology. This is a focused, data driven audit of an article or process performed in the manufacture of a product or article, conducted at any location where the product or article is manufactured or where the process is being performed (that is, the PAH, associate facility, supplier, or subtier supplier location). This methodology uses a combination of a PI audit and a product-based SCA. The PI assigned certificate management responsibility normally performs this activity. These audits focus on areas of high risk within the PAH’s or supplier’s facilities.

(2) QSAs. A QSA is a comprehensive product-based system audit designed to ascertain whether a PAH meets the applicable requirements of 14 CFR and complies with the procedures established to meet those requirements. It applies standardized noncompliance codes that are described in Appendix E to this order.

Note: Though PI audits, SCAs, and QSAs are product-based system audits, a product audit must still be conducted during all scheduled audits and whenever determined to be necessary by the CM section.

Part 2. Product Audits 3-22. What Is a Product Audit? A product audit evaluates the effectiveness of the PAH’s quality system and the airworthiness of products using critical and certain noncritical characteristics, processing attributes generated during the manufacturing process, or both. A product audit is required to be conducted during all audits and whenever determined to be necessary by the PI or CM section, and may be initiated at any point in the manufacturing process after inspections have been completed. The product audit is conducted at a PAH, supplier, or subtier supplier facility where a product or article is manufactured. If specific expertise is required during this audit, the PI should advise the CM section manager.

3-13 8120.23B 3-23. Selection of Product Audit Characteristics. The product audit will be conducted using critical characteristics, critical processing attributes generated during the manufacturing process, or both. The product audit may also be conducted using certain non-critical characteristics, non-critical processing attributes, or both. These characteristics and attributes are defined as follows: a. Critical characteristics are those where failure to maintain conformity could cause loss of function and create an unsafe condition. Critical process attributes are those where lack of conformity directly affects the product or article(s) and could cause failure or create an unsafe condition. The selection of the critical characteristics, critical process attributes, or both, is determined by reviewing the following (this review does not need to be documented): (1) Known service problem areas.

(2) Characteristics/attributes that are operator controlled. Operator-controlled characteristics/attributes are controlled by people rather than machines or computers.

(3) Characteristics/attributes classified as critical as defined by the PAH’s engineering drawings, process specifications, test specifications, and quality system procedures.

(4) Service difficulty reports (SDR). Information related to service difficulty reports (SDR) can be found on the Service Difficulty Reporting System website.

(5) Characteristics/attributes that are highly process-driven. Process-driving characteristics/attributes are those dictated by precise and often automated processes in the manufacturing process (e.g., additive manufacturing, composite fabrication, friction stir welding, etc.)

b. The PI may select certain noncritical characteristics, noncritical processing attributes, or both. These attributes could include radii, surface finishes, machine to cast features, cad plating, or nondestructive inspection.

3-24. Product Audit Areas. The product audit may be divided into one or more of the following: a. Product (aircraft, aircraft engine, or propeller) b. Article (material, part, component, process, or appliance) 3-25. Product Audit Criteria. The audit criteria used in the performance of a product audit to establish conformity to approved design are listed below. These audit criteria are a minimum and not all inclusive.

Note: A product audit is not a reinspection by the FAA representative. Rather, it is the FAA witnessing the reinspection by the PAH or applicable supplier. The PAH’s or applicable supplier’s personnel are responsible for the handling of the articles during the product audit.

a. Operational/functional. Verify that the product or article conforms to the functional/operational test criteria (for example, revalidating test results, test setup, software 3-14 8120.23B revision, software checksum, rig approval, certified equipment, use of approved procedures, certified test parameters, use of required rig, and calibration).

b. Dimensional. Compare actual recorded measurements of the selected characteristic with the approved design data. Verify that characteristics are inspected using the correct calibrated tooling, gauging, fixtures, etc., surface finish dimensions and radius meet drawing tolerances, inspections are performed in proper sequence (following work instructions); for example, review or revalidate inspection records.

c. Inspections. Verify visual inspections of articles for obvious external defects, for example, corrosion, burrs, handling damage, and scratches. Verify key inspections of production processes to ensure they meet approved design requirements, such as, but not limited to, receiving inspection, random sampling, FAI, in-process inspection, NDI, and final inspection.

d. Identification. Compare actual identification plates, tags, markings, etc., with approved design data or purchase order requirements and verify that identification is maintained throughout the product line; for example, part numbers, serial numbers, lot numbers for raw material, and inspection stamps. For software revision verification, verify that the software number can be displayed on screen or software load verified by documentation review.

e. Documentation. Verify the latest revision level or changes, and that the product audit area meets the approved procedures and design requirements. This may include verifying applicable FAI records, proper use of work instructions, completed operations, and proper authorizations. Also verify proper use of statistical sampling, certificate of conformance, work travelers, blueprints, and specifications.

f. Special Processes. Verify that special processes are in accordance with approved process specifications. Verify operator qualification/certification, training requirements for operators, test set ups and test coupons, and oven surveys/calibration. For a chemical process such as plating, verify that control has been established over tank cleanliness and chemical concentration.

g. Material. Verify that the PAH has verified that incoming raw material meets its specification requirements.

3-26. Recording Product Audit Results. All product audit results will be recorded on FAA Form 8100-1, Conformity Inspection Record. When unsatisfactory conditions are identified, also prepare FAA Form(s) 8100-6 (refer to Appendix D to this order). The PI will retain all applicable objective evidence to support unsatisfactory conditions in accordance with FAA Order 2150.3.

3-27. Recording Completion of a Product Audit. The completion of a product audit will be recorded on FAA Form 8120-14 by the person conducting the audit. However, FAA Form 8120- 14 is not required for a QSA unless an onsite supplier audit is done as a part of the QSA. When a product audit is conducted in conjunction with a PI audit or SCA, one form should be completed for all product audits. Prepare this form in accordance with Appendix C to this order.

3-15 8120.23B Section 5. Post-Audit Activities and Processing Noncompliances 3-28. General. FAA certificate management responsibilities often result in identifying PAH noncompliances. The PI will record all identified noncompliances, including those reported by a CAA while performing certificate management activities for the FAA, on FAA Form 8100-6.

FAA Form 8100-6 includes determining the scope of the noncompliance: systemic or isolated.

The FAA will notify a PAH of noncompliances found at its supplier. The FAA will not reveal noncompliances to anyone other than the particular PAH involved unless a formal request has been processed in accordance with the Freedom of Information Act (refer to FAA Order 1270.1, Freedom of Information Act Program).

Note: SMS noncompliances identified in a VSMS are not formally documented through enforcement records, and resolution is managed through collaborative corrective actions. The aviation safety inspector (ASI) or aviation safety engineer (ASE) requests that VSMS participants initiate corrective action to address noncompliances identified during oversight of the VSMS participant’s SMS. VSMS participants that do not implement requested corrective action may have their SMS acceptance letter revoked (Refer to FAA Order 8120.25).

3-29. Documenting Noncompliances. All noncompliances are documented and maintained in the oversight information system. If a noncompliance is substantiated, the PI must process the noncompliance in accordance with FAA Order 2150.3, FAA Compliance and Enforcement Program, and the AIR Compliance and Enforcement Process, as described in Technical Business Process AIR-002-035.

3-30. Processing Noncompliances. The PI must review each item on FAA Form 8100-6 to determine if the noncompliance is substantiated. The following are additional considerations when determining the proper means to document a noncompliance: a. If a facility provides objective evidence subsequent to the issuance of an FAA Form 8100-6 that justifiably negates the basis of the reported noncompliance, a request for corrective action of that noncompliance will not be required. The PI must retain the negated FAA Form 8100-6, justification, and any applicable objective evidence in the oversight information system.

b. If the noncompliance meets the definition of a suspected unapproved part (SUP), as described in FAA Order 8120.16, Suspected Unapproved Parts Program, the PI must report the SUP in accordance with FAA Order 8120.16.

c. If the noncompliances identified on FAA Form(s) 8100-6 are found during an audit conducted as the result of a hand-off, the FAA Form(s) 8100-6 must be transmitted to the requesting CM section for action.

d. If the PI determines, after the audit is finalized, that the noncompliance recorded on FAA Form 8100-6 is incorrect and should be changed, the PI must— (1) Prepare a justification for changing the type of noncompliance through a memorandum or the oversight information system.

(2) Obtain approval from their manager.

3-16 8120.23B (3) Inform the team leader or principal auditor of the change, if applicable.

(4) Complete a revised FAA Form 8100-6, corresponding to the changed type of noncompliance.

(5) Retain the original FAA Form 8100-6, the approved justification, the revised FAA Form 8100-6, and any applicable objective evidence.

3-31. Obtaining Corrective Action. Corrective action for all noncompliances must be performed in accordance with FAA Order 2150.3 and the AIR Compliance and Enforcement Process, as described in Technical Business Process AIR-002-035.

3-32. Performing Post-Audit Activities. Post-audit activities are performed to— a. Validate the PAH’s corrective actions.

b. Update the PAH’s profile in the oversight information system.

c. Update data for scheduling and planning. The PI must ensure that the outcome of the noncompliance and corrective action are incorporated into certificate management scheduling and planning. This includes integration into the PAH’s organizational risk assessment, facility selection process, and risk within a facility, when applicable.

3-17

8120.23B Chapter 4. Types of Audits Section 1. Introduction 4-1. General. Sections 2 through 4 of this chapter provides guidance for accomplishing the following types of ongoing certificate management audits: PI audits, SCAs, and QSAs.

Section 2. PI Audits Part 1. Overview 4-2. What Is a PI Audit? A PI audit employs a product-based system approach to evaluate whether a PAH is complying with its approved quality procedures. It is conducted at a PAH’s facility by the CM section having the assigned certificate management responsibility for that PAH. When PAHs are required to comply with 14 CFR Part 5 or are participating in the VSMS program, an SMS compliance audit is integrated with the PI audit, as outlined in Section 2, part 4 of this chapter. The CM section will: a. For PAHs designated Level 1 and Level 2: (1) Audit the top five systemic noncompliant quality system elements annually, as identified by each division through an analysis of data in the oversight information system; and (2) audit all quality system elements between QSAs.

b. For PAHs designated Level 3, at a minimum, audit the top five systemic noncompliant quality system elements, as identified by each division through an analysis of data in the oversight information system.

Part 2. Scheduling PI Audits 4-3. Scheduling a PI Audit. The PI audit will be scheduled by the CM section based on the PAH’s risk assessment in accordance with paragraph 3-6 of this order. A CM section may schedule additional PI audits at specific facilities when required to ensure continued operational safety. CM sections may conduct PI audits with no advance notice to ensure continued operational safety, to facilitate oversight, or to facilitate compliance, or a combination of the previous. The duration of the PI audit may be one day or multiple days, depending on factors such as the PAH’s size, location, production lines, buildings, etc. If specific expertise is required during a PI audit, the PI should advise the manager of the CM section.

Part 3. Conducting PI Audits of a PAH’s Supplier Control 4-4. Review of PAH Supplier Control System Element During PI Audits. The PI may determine whether the PAH is controlling its suppliers by reviewing the PAH’s supplier procedures, any results of prior audits and any corrective actions required by the PAH. During the review, the PI should look for evidence that may indicate a system breakdown in supplier control by the PAH. If the PI identifies evidence of a system breakdown, the PI must ensure that 4-1 8120.23B the outcome of the review is incorporated into the facility selection process as identified in paragraph 3-14 of this order, including suppliers and subtier suppliers, and risk within a facility as identified in paragraph 3-18 of this order, when applicable.

Note: The PAH is solely responsible for all supplier-furnished articles and services.

Therefore, certificate management activity will focus on how well the PAH controls its suppliers.

The FAA does not approve suppliers. However, the PI should review a PAH’s list of suppliers to verify that any suppliers outside the United States have been previously evaluated for undue burden determination as required by FAA Order 8100.11.

4-5. Verification of PAH’s Supplier Control Procedures. The PI should verify that the PAH is implementing and complying with its documented supplier control procedures. This verification should focus on confirming that the PAH has established, documented, and is effectively executing processes that address supplier control. This includes reviewing: a. The PAH’s documented process for supplier selection, approval, and ongoing control.

b. The PAH’s procedures for identifying, documenting, and resolving supplier-related nonconformances.

c. The PAH’s process for evaluating or auditing suppliers to ensure continued compliance with PAH-established quality and design flow-down requirements.

4-6. Use of Risk-Based Oversight for Supplier Control. Using information obtained from verification activities, prior audits, and other oversight data, the PI should apply a risk-based approach to determining the scope, depth, and prioritization of supplier-related oversight. This approach ensures FAA resources are directed toward areas presenting the greatest risk. In addition, the following should be considered for the facility selection process as identified in paragraph 3-14 of this order. When determining oversight priorities, the PI should consider the following risk indicators: a. Supplier control noncompliances identified during previous FAA audits.

b. Repeat or systemic supplier-related nonconformances indicating ineffective corrective action or weak supplier controls.

c. The PAH’s response and effectiveness in addressing known supplier-related quality escapes.

Note: When systemic supplier control issues are identified at a PAH, the PI should coordinate with the CM section manager to determine if increased oversight is necessary.

Part 4. Conducting PI Audits with SMS Compliance Audits 4-7. SMS Compliance Audits Integrated with PI Audits. When PAHs are required to comply with 14 CFR Part 5 or are participating in the VSMS program, an SMS compliance audit is scheduled, planned and conducted with the PI audit. Refer to FAA Order 8120.25 and QMS document AIR-002-600-005-F12 for PI/SMS audit data collection tool (DCT).

4-2 8120.23B Part 5. Documenting PI Audit 4-8. Recording a PI Audit. Record a PI audit on FAA Form 8120-14 (refer to Appendix C to this order). Complete one form for each PI audit conducted. Prepare this form in accordance with Appendix C to this order. Document noncompliances on FAA Form 8100-6 (refer to Appendix D to this order). At the conclusion of the audit, determine if the noncompliances should be categorized as isolated or systemic.

Note: When performing a PI audit that includes a review of a PAH’s supplier records, the PI will record the information required in paragraph 4-32d(2) of this order on FAA Form 8100-1.

Section 3. Supplier Control Audits Part 1. Overview 4-9. What Is a Supplier Control Audit? An SCA is a systematic and independent examination, employing a product-based system audit approach, to determine supplier compliance with the PAH’s purchase order, quality requirements, technical data, or specifications. An SCA is conducted to evaluate the PAH’s established supplier control system to control the articles, materials, supplies, and services provided by outside sources. This audit is conducted by the CM section assigned certificate management responsibility for the PAH or as handed off per paragraph 3-17 of this order. An SCA is applicable to suppliers and subtier suppliers of a PAH as determined by the selection process identified in paragraphs 3-14 and 3-15 of this order.

4-10. Purpose of a Supplier Control Audit. The purpose of the SCA is to determine whether a PAH is satisfactorily controlling its suppliers. The SCA will determine whether the supplier complies with PAH’s requirements, including any statistical sampling that may be used. An SCA is not conducted to audit the performance of the suppliers. However, specific supplier issues or corrective action implementation should be audited when identified.

4-11. General PAH Supplier Control Responsibilities. A PAH may use suppliers when it has established an FAA approved quality system that provides assurance that all articles or services furnished by its suppliers are in compliance with its particular production approval and 14 CFR.

The PAH must ensure each supplier-provided product, article, or service conforms to the PAH’s requirements.

a. This responsibility is applicable regardless of— (1) Where the suppliers may be located; (2) Whether the products or articles received by the PAH are also FAA approved (PMA or TSOA); (3) Whether materials are accompanied by airworthiness approval tags, or their equivalent, issued by the CAA of a bilateral country; (4) Whether materials or equipment are supplied by the end product purchaser (customer furnished equipment, buyer furnished equipment, or government furnished equipment); 4-3 8120.23B (5) Whether the FAA performs an audit at the supplier; (6) Whether the articles received by the PAH are commercial or standard parts; (7) Whether the supplier has been delegated major inspection authority; or (8) Whether the quality system data received from the supplier are in English.

b. Place special emphasis on controlling those suppliers that the PAH has authorized to ship directly to a user/operator. Suppliers may ship replacement and modification articles directly to the user/operator without the articles first being processed through the PAH’s receiving inspection facilities only if the PAH— (1) Authorizes to the supplier, in writing, the authority to ship directly to a user/operator.

An individual written authorization is not required for each direct shipment. The authorization may include limitations such as specific part numbers, time periods, or particular user/operators.

This authorization will be maintained by the PAH for review by the assigned CM section.

(2) Includes, in its FAA approved quality system, controls to compensate for the absence of inspection normally conducted at the PAH’s location—for example, receiving inspection and test. Compensating factors should include onsite audits of the supplier and the inspection of the article at the supplier by— (a) The PAH, or (b) The supplier under a delegated inspection authority from the PAH.

(3) Ensures that each of these shipped articles is accompanied by a shipping ticket, invoice, or other document containing a declaration that the individual article was produced under the terms of the production approval, and that inspection/acceptance has been accomplished by either the PAH or by delegated inspection authority. The shipping document for subcomponents manufactured for TSO articles should contain the TSO number. When FAA Form 8130-3, Authorized Release Certificate, is used for this purpose, the direct ship authorization will be annotated in accordance with FAA Order 8130.21, Procedures for Completion and Use of the Authorized Release Certificate, FAA Form 8130-3, Airworthiness Approval Tag.

(4) Provides the appropriate article marking information to the supplier.

(5) Advises its assigned CM section of each direct ship authorization.

c. Take measures to prevent suppliers from manufacturing articles without proper authority.

For example, the PAH could limit projected overruns and request, in its contract with the supplier, that any unnecessary overrun articles be scrapped. The PAH may also include a clause in its contract that no articles are to be sold under any circumstances other than those described in the contract.

d. Make available to the FAA a current list of its suppliers.

4-4 8120.23B e. Notify its suppliers that its facilities are subject to FAA certificate management.

4-12. Coordination of Requests for Supplier Oversight Assistance With Other CAAs.

a. When a supplier to a U.S. PAH is located in a country or jurisdiction having an applicable bilateral agreement with the United States, the FAA may seek supplier oversight assistance from the bilateral CAA. Such assistance requests may take various forms at the PAH’s supplier (for example, ongoing oversight, SCAs, or product audits), and may or may not be agreed to by the CAA, depending on factors such as its availability of resources and common production approval facilities. Requests for one-time or ongoing supplier oversight assistance should be transmitted from the CM branch or division manager to a counterpart CAA production contact. If the CAA agrees to the request and the assistance is recurring, a management plan must be formulated between the FAA and the supporting CAA. The management plan must outline information such as the details of the type of audit/inspection support requested, the methodology by which it will be performed (this is usually the normal audit/inspection procedures, and documentation of the local CAA), the frequency of the audit/inspection activity, and documentation expectations (that is, data and evidence that is useful to the compliance and enforcement program).

Note: Most of the FAA’s bilateral agreements include provisions for technical assistance between authorities. Certain CAAs may charge a fee for oversight activities performed on behalf of the FAA at a PAH’s facility located in its country or jurisdiction. A PAH should be aware that, though CAA fees may not have been charged in the past, fees may be incurred in the future.

This change in the charging of fees for oversight activities is partly due to the scarcity of resources brought about by the globalization of aircraft manufacturing. In any case, any CAA oversight activity fees incurred are solely the responsibility of the PAH.

b. If the FAA must conduct the supplier oversight activity itself in another country or jurisdiction, for any reason, the PI will perform the following activities: (1) Notify the responsible CAA and invite CAA participation as an observer through a formal letter signed by the division/CM branch manager or delegated signatory. The letter should be addressed to the production contact for the CAA. A list of CAAs and respective contacts is available from the AIR International Office. Send an electronic facsimile (fax), scanned copy, or email of the letter at least 50 days before the audit, followed by mailing the formal letter. Notify the CAA of any changes in the audit’s schedule. The CAA’s participation in the audit is not mandatory, and the choice to provide an observer is at its discretion. The letter should, as a minimum, include the following information: (a) Identity of the supplier facility to be audited.

(b) Type of supplier oversight activity to be conducted (such as an SCA, a product audit, or ongoing oversight). Provide a general outline of what will be included in the scheduled activity.

(c) Dates of the scheduled activity.

(d) Number of FAA auditors participating in the scheduled activity.

4-5 8120.23B (e) Name, address, telephone number, and email address of the responsible PI.

(2) Provide the PAH’s CM section with details of any noncompliance encountered during the oversight activity. For example, if there is a trend showing recurring test failures or nonconforming articles, it may be evidence of a system breakdown or a compliance problem at that facility. The PAH’s CM section will determine if there are any system issues or major problems that should be forwarded to the applicable CAA for its consideration because the PAH’s supplier may coincidentally hold a local production approval.

Part 2. Scheduling of Supplier Control Audits 4-13. Division Supplier Control Audit Schedule. Subsequent to the supplier selection process described in paragraph 3-14 of this order, the divisions will develop a supplier control audit schedule annually. The divisions should coordinate their schedules, to the greatest extent possible.

a. The division supplier control audit schedule will include the name of the selected supplier, the name of the responsible PAH, the scheduled date of SCAs to be conducted by the CM section, and identification of any SCAs that may be handed off to other divisions or may require the assistance of a CAA in a bilateral country.

b. Each CM section will maintain supplier control audit data in accordance with the instructions provided in the oversight information system. This data will be used to plan resource allocation in the next fiscal year. The CM branch manager will ensure the data submitted by each CM section is reviewed for completeness and for identification of duplicate suppliers. When the same supplier is selected by multiple CM sections, the CM branch manager should coordinate with the CM sections to conduct a single audit at that supplier; however, the audit should address the applicable requirements of all relevant PAHs. The CM branch manager should also determine which CM section will conduct the audit, and whether representation from other CM section is required. When all potential discrepancies with the data are resolved, the CM branch manager will ensure the consolidated division supplier control audit data is prepared and made available in the oversight information system in the applicable PAHs’ files.

c. The completed division data, described in paragraph 4-13b of this order, must be available in the oversight information system to all other CM branch managers. All CM branch managers should ensure supplier control audit data received from other divisions are reviewed to identify duplicate suppliers, potential hand-offs that affect their offices and supplier control audits to be conducted by the FAA at multiple international suppliers in the same country.

4-14. Coordination of SCAs. Coordination between assigned offices and the CM section should ensure only one audit is scheduled at a supplier and that all affected PAHs will be audited as part of the audit, as well as to identify audit participants. During the audit, the PAHs with the higher risk assessment results will have priority over PAHs with lower risk assessment results.

a. SCAs To Be Conducted by the FAA at International Suppliers. CM branch managers should identify one FAA office as a lead office to coordinate all international audit activities, which includes notifying the responsible CAA and inviting its participation.

4-6 8120.23B b. Coordination of Corrective Action Validation. Occasionally, it may be necessary to validate corrective actions at a supplier facility located outside of the area of the responsible CM section. When a hand-off to the CM section is appropriate for this purpose, the following hand- off procedures will be used: (1) The CM section will forward a memorandum to the assigned office with responsibility of the area in which the supplier is located. The memorandum will identify whether the corrective action to be validated is a short term or long-term action and will include all pertinent information regarding the corrective action to be validated. The memorandum also will specify a date for responding to the corrective action validation request. The memorandum should include as a minimum— (a) The name and address of the supplier and the responsible PAH, including the PAH’s project number, (b) The name, title, and telephone number of the person to contact at the supplier and accountable managers at PAH facilities that can furnish purchase orders, quality system data, technical data, or other pertinent information, (c) A copy of the PAH’s or supplier’s quality system procedures that are required to be implemented at the particular supplier’s facility, unless these documents are available to the FAA at the supplier’s facility, (d) A copy of the noncompliance record, (e) A copy of the PAH’s corrective action response, and (f) A copy of the supplier’s corrective action response to the PAH.

(2) When a CM section receives a request for a corrective action validation at a facility located within its assigned responsibilities, it will— (a) Advise the requesting CM section of receipt of the request within 30 days.

(b) Submit a memorandum to the requesting CM section upon completion of the corrective action validation. This memorandum should summarize the results of the corrective action validation and include all applicable FAA Form(s) 8100-6 or 8100-1, as well as all true copies of supporting objective evidence. The requesting CM section will consider its hand-off request complete upon receipt of this memorandum.

4-15. Notifying a PAH.

a. Before conducting an SCA, the assigned office that will be conducting the audit will notify the responsible PAH. The assigned office will notify the PAH, in writing, no more than 14 days before the audit. However, the assigned office may, at its discretion, provide no more than 7 days’ notice to the PAH before conducting an SCA. For international SCAs, the assigned office will notify the PAH, in writing, no more than 30 days before the audit. This reduced notice 4-7 8120.23B is applicable when urgent action is necessary in the interest of safety or to facilitate oversight, to facilitate compliance, or both.

b. The PAH is responsible for notifying the supplier of the scheduled SCA. If changes occur after the written notification has been sent, notify the PAH by appropriate means. If an SCA has been handed off as described in paragraph 3-17 of this order, the PAH will be advised accordingly, and the requesting office will be provided a copy of the written notification through the oversight information system. Figure 4-1 of this order contains a sample notification letter.

4-8 8120.23B Figure 4-1. Sample Supplier Control Audit Notification Letter U.S. Department of Transportation West CM Branch Aircraft Certification Service Federal Aviation Seattle CM Section Administration 2500 East Valley Road, Ste C2 Renton, Washington 98055 July 13, 2016 Molly Brown c/o Tight Weave Manufacturing 1600 Lind Ave SW Fort Worth, TX 76137 Dear Ms. Brown: The Federal Aviation Administration (FAA), in accordance with its responsibilities under Title 49 of the United States Code, Subtitle VII, part A, and applicable regulations, has selected Structural Components located in Seattle, Washington, for a supplier control audit. The audit is scheduled to be conducted on November 12, 2016, by an FAA representative from the Seattle CM section. This audit will determine that your supplier complies with purchase order and/or quality requirements, including any statistical sampling that may be used.

The FAA requests that you inform a representative at Structural Components of this audit.

Also, please inform the Seattle CM section at (425) 227-2170 of any security requirements so that we may obtain the appropriate clearance. In addition, please provide the name, title, address, and telephone number of an individual at Structural Components who will serve as the company point of contact for this audit.

If you have any questions concerning the scheduling or conducting of this audit, please contact the undersigned at the above telephone number.

Sincerely,

Julia Gotta

Julia Gotta Seattle CM Section cc: Fort Worth CM Section 4-9 8120.23B Part 3. Conducting Supplier Control Audits 4-16. Audit Criteria. The SCA will be conducted using the PAH’s quality flow-down requirements noted on the applicable purchase order or working agreement. Quality flow down requirements may include, but are not limited to, purchase orders, contracts, drawings, specifications, the control of raw and nonconforming materials, records, sampling plans, inspection systems, calibration systems, certificates of conformance, software, age controlled products, special processes, FAIs, subtier suppliers, design data, and all applicable regulatory requirements. The following are also considerations when conducting an SCA: a. To the greatest extent practicable, an SCA should be conducted when the supplier has an active purchase order or working agreement from the PAH. If circumstances arise and an active purchase order, working agreement or product or article is not available, an SCA may be rescheduled to facilitate the audit. If the audit cannot be rescheduled it may be accomplished using historical records that are traceable to the PAH’s quality flow down requirements noted on an applicable purchase order or working agreement.

Note: Appendix E to this order should not be used as a checklist during SCAs. However, for data collection and analysis purposes, the PI must select the most appropriate noncompliance codes when documenting noncompliances on FAA Form 8100-6.

b. If specific expertise is required during this audit, the PI should advise the CM section manager. The PI should prepare an audit checklist for each supplier to be audited based on the applicable purchase order, quality requirements from the PAH, or both.

4-17. Recording a Supplier Control Audit. Record an SCA on FAA Form 8120-14 (refer to Appendix C to this order). Complete one form for each SCA conducted. Each hand-off is considered a separate SCA. Document noncompliances on FAA Form 8100-6 (refer to Appendix D to this order). At the conclusion of the audit, determine if the noncompliances should be categorized as isolated or systemic.

a. If an SCA discovers a noncompliance that may involve other PAHs, the team leader and PI must consider the potential systemic impact of the noncompliance, and accordingly, identify those additional PAHs also affected. The PI will verify the affected PAHs and notify and apprise the appropriate PIs of the encountered condition.

b. A product audit will be conducted in accordance with Chapter 3, Section 4, Part 2 of this chapter and recorded on FAA Form 8100-1.

Section 4. Quality System Audits Part 1. Overview 4-18. What Is a QSA? A QSA is a comprehensive system audit program employing a product based system audit approach. It is a vital element within the FAA’s mission of continued operational safety. When PAHs are required to comply with 14 CFR Part 5 or are participating in the VSMS program, an SMS compliance audit is integrated with the QSA. The QSA— 4-10 8120.23B a. Ascertains whether PAHs meet the applicable requirements of 14 CFR and comply with procedures established to meet those requirements.

b. Evaluates the continued integrity of the approved data. However, the QSA does not reevaluate the approval of previously approved data.

c. Populates a database for analyzing audit results and reporting trends.

d. Provides continuous improvement for the FAA by continually monitoring stakeholder feedback, entered in the oversight information system, and considers proposed improvements by FAA internal and external customers.

Part 2. Selection and Scheduling of QSAs 4-19. QSA Intervals. Audit intervals for PAHs are identified in table 3-1 of this order.

4-20. Selection of Facilities to Be Audited. Procedures for selecting a PAH’s facilities to be audited are identified in paragraph 3-14 of this order.

4-21. Scheduling of QSAs. After all facilities have been selected for audit in accordance with Chapter 3 of this order, each division will be responsible for scheduling QSAs at the selected facilities. Use the following procedures: a. Estimate the onsite duration of each QSA according to the following information.

Consider the quality procedures and processes, the engineering procedures and processes, or both, required to be in place; the number of applicable quality system elements, when known (refer to Appendix E to this order); the size and physical layout of the facility to be audited (single or multiple locations); and product complexity. Allow enough time to ensure compliance to the applicable 14 CFR and FAA approved data will be fully audited. Use the following list as a guide for estimating, in terms of facility size only, the onsite duration of the QSA (excluding travel times): (1) Small facility with fewer than 100 total full time persons: 1 to 5 working days.

(2) Medium facility with 100 to fewer than 400 total full time persons: 3 to 5 working days.

(3) Large facility with 400 to fewer than 2,000 total full time persons: 5 to 10 working days.

(4) Very large facility with 2,000 or more total full time persons: 7 to 15 working days.

Note 1: When estimating the onsite duration, include only those persons who directly support the PAH activity.

Note 2: The onsite duration may be extended when conducting an SMS compliance audit in conjunction with a QSA.

4-11 8120.23B b. Assign all scheduled audits a distinct QSA number, consisting of the fiscal year, division or CM branch office code, and the audit order sequence. Do not reassign QSA numbers from canceled audits. Each scheduled audit must be uniquely identified.

c. Identify the lead audit office for each audit. That office is usually the one that performs certificate management responsibility at the facility to be audited. The lead audit office is responsible for— (1) Coordinating the notification letter (refer to paragraph 4-23 of this order), and (2) Notifying the selected team leader and team members (refer to paragraph 4-25 of this order).

Note: For an associate facility subject to certificate management under the hand-off procedure, the lead audit office is the CM section receiving the hand-off.

d. Prepare an audit schedule based on the facility selection criteria in paragraph 3-14 of this order and the duration of each audit.

(1) Prepare the schedule using the following guidelines: (a) QSA number.

(b) Scheduled start date of each audit.

(c) Duration of each audit.

(d) Facilities and types of approvals to be audited.

(e) Assigned risk level.

(f) Product lines or authorized functions at the facilities to be audited.

(g) Number and disciplines of auditors assigned to each audit.

(h) Additional auditors required beyond the division’s resources.

(i) Number and disciplines of auditors in training and team leaders in training.

(j) Total number of audits scheduled for the fiscal year.

(k) Applicable project numbers.

(2) All division QSA schedules will be entered into the oversight information system.

(3) The certification branch and CM section should schedule approval holders with multiple approvals, such as a PC and a PMA, so as to evaluate all approvals during one audit.

4-12 8120.23B (4) When an approval holder has multiple facilities that require significant resources and time to audit, the certification branch and CM section should consider scheduling the facilities individually.

e. Designate an assigned engineer (AE). CM section will coordinate with the certification branch to determine the need to assign an FAA engineer. The AE must coordinate any corrective action required regarding the FAA approved design or the design approval system.

4-22. Selection of QSA Auditors. The assigned certification branch and CM section select appointed QSA auditors to perform each scheduled audit. To broaden expertise, whenever possible, managers are encouraged to permit auditors to participate in QSAs scheduled within the jurisdiction of other divisions. Determine the number and types of auditors required for each audit according to the following criteria: a. Number of Auditors Required. Determine the total number of auditors required to ensure compliance to the applicable 14 CFR and FAA approved data.

(1) Estimate the number of auditors required according to the following minimum criteria: (a) PAH’s assigned risk level based on the level determination and the organizational risk assessment; (b) Number and complexity of applicable quality, engineering, flight test, and facility procedures and processes in place; (c) Number of applicable quality system elements, when known (refer to Appendix E to this order); (d) Number of PAH suppliers expected to receive an onsite visit as part of the PAH QSA supplier control system element, when known; (e) Size and physical layout of the facility to be audited (single or multiple locations); (f) Product or design approval system complexity; and (g) SMS, as applicable.

(2) Use the following as a guide for estimating the number of QSA auditors required.

Increase or decrease the number of estimated auditors shown below depending on your review of the criteria contained in paragraph 4-22a(1) of this order and your confidence that compliance to the applicable 14 CFR and FAA approved data will be fully audited: (a) Small facility with fewer than 100 full time persons: 1 to 3 auditors (including team leader).

4-13 8120.23B (b) Medium facility with 100 to fewer than 400 total full time persons: 1 to 5 auditors (including team leader).

(c) Large facility with 400 to fewer than 2,000 total full time persons: team leader plus 5 to 10 auditors.

(d) Very large facility with 2,000 or more total full time persons: team leader plus up to 10 auditors.

Note 1: When estimating the number of auditors required, include only those full time persons who are used to support the PAH facility activity.

Note 2: When necessary, the appropriate certification branch and CM section will assign additional auditors as needed.

(3) If it is determined that one auditor is required, select an appointed team leader to perform the audit; this auditor is referred to as the principal auditor. If two or more auditors are selected for an audit, they will constitute a QSA team. Select an appointed team leader and the required number of appointed team members.

b. Types of Auditors Required. Use the criteria identified in paragraph 4-22a(1) of this order and the following criteria to determine the types of auditors required. Select appointed QSA auditors who have appropriate knowledge of the noncompliance codes identified in Appendix E to this order applicable to the facility to be audited and, as appropriate, to the products authorized by the approval (for example, select a propulsion engineer when an engine manufacturer is to be audited, and select a flight test pilot when a flight test program is to be audited). When making this determination, consider the following: (1) It is not necessary to select both engineers and inspectors for a small facility that does not have both engineering and manufacturing capabilities.

(2) Select appointed QSA auditors, as appropriate, to maintain continued appointment in accordance with Appendix F to this order.

(3) Do not include any appointed auditors who were previously employed by the facility to be audited within 2 years of the scheduled audit.

(4) Determine whether auditors will be made available throughout the duration of the audit. Each auditor is expected to fully participate in the audit. Base any decision to limit participation on the established AIR priorities. Notify the team leader of any limited participation by auditors.

c. Selection of PI and AE as Team Leaders or Auditors. To the greatest extent practicable, the PI and the AE will not be selected as team leaders on QSAs of facilities for which they have certificate management or oversight responsibilities. Use the guidelines in table 4-1 to select the PI as an auditor, the AE as an auditor, or both: 4-14 8120.23B Table 4-1. Selecting a PI or AE as an Auditor Number of Persons PAH Facility Procedure Performing the Audit One to four persons Do not select the responsible certificate management PI as a team member. The AE may be selected as a team member.

Five persons or more The certificate management PI or the AE, or both, may be selected as team members.

d. Selection of Auditors in Training and Team Leaders in Training.

(1) Determine the number of appointed auditors required for the QSA before assigning auditors in training. Assign auditors in training only to audits for which a team is required. Do not assign auditors in training to a principal auditor. Auditors in training will supplement appointed auditors. Do not substitute auditors in training for appointed QSA auditors, or audit team leaders in training for appointed QSA team leaders.

(2) Do not assign more than two auditors in training and more than one team leader in training to any one audit. For QSAs occurring at large or very large facilities (as defined in paragraphs 4-22a(2)(c) and (d) of this order), up to four auditors-in-training may be assigned.

Try to assign each auditor in training or team leader in training to different team leaders during the participation phase of the training. A single team member should not be assigned to train multiple auditors-in-training.

(3) When proposing to use auditors-in-training or team-leaders-in-training from other divisions, coordinate with their appointing managers to establish their eligibility.

e. Additional Resource Requirements. Additional auditors beyond the division’s available resources may be required depending on the size of the facility; type and complexity of product, service, or design approval system; and overall audit objectives. Each division should identify the need for these additional resources before the release of the QSA master schedule for the next fiscal year and coordinate the auditors’ participation with the appropriate division office and oversight information system coordinators. Additional support may also be available from AIR-600, if requested.

f. Scheduled Changes. Each division must update schedule changes in the oversight information system. Audits added to the master schedule will be assigned a new QSA number in accordance with paragraph 4-21b of this order.

4-23. Notification of Facilities To Be Audited. The lead audit office identified in accordance with paragraph 4-21c of this order will notify facilities of a scheduled audit using the sample formats in Appendix G to this order. Coordinate with the responsible PI to ensure the letter does not arrive during scheduled shutdown periods or during any other extended periods when the letter may not be acted upon. For notifications of first time QSAs, inform the facility that QSA reference material is available on the FAA’s website. If the facility cannot access the website, provide the reference material to the facility. Notify facilities as follows: 4-15 8120.23B a. PAH. The lead audit office will perform these tasks: (1) Prepare the notification letter and send it to the facility to be audited no more than 30 days before the audit.

(2) Provide a copy of the notification letter to the designated audit team leader or principal auditors, the PI, and the AE.

b. Changes After Notification Letter Is Sent. If there are changes to the audit schedule or team composition after the notification letter has been sent, notify the facility, responsible PAH, requesting CM section, and the team leader or principal auditor.

4-24. Modifications to Scheduled Audits. Every effort will be made to maintain established audit schedules. However, modifications to the audit schedule should be considered under special circumstances. The assigned certification branch and CM section will jointly reschedule any affected audit in coordination with the PI, AE, and team leader or principal auditor, and update the schedule in the oversight information system. Special circumstances that may warrant modifications to the audit schedule include— a. Risk to auditors’ safety, b. Change in a facility’s production or delegation status from active to inactive, c. Involvement of the FAA in a labor management dispute at a facility, and d. Reduction in the effectiveness of the audit.

Part 3. QSA Roles and Responsibilities 4-25. Lead Audit Office. Perform, at a minimum, the following QSA preparations: a. Using the oversight information system, notify the selected audit team leader and team members, or the principal auditor, at least 60 days before each division QSA.

b. Ensure logistical support for an audit within the assigned area.

4-26. Assigned Certification Branch and CM Sections. Using the oversight information system, notify at least 60 days before the audit, all selected auditors within the division that have been selected to support QSAs in another division.

4-27. Audit Team Leader or Principal Auditor. Coordinate QSA preparation to enable the audit team to make the most of limited time in the facility. The team leader provides orientation and assigns quality system elements to team members. These actions, as appropriate, require coordination with the PI, the AE, and the facility to be audited. The team leader or principal auditor will perform the following, as appropriate: a. Upon receipt of a copy of the notification letter, contact the lead audit office to identify the responsible PI and AE and obtain from the PI and AE items such as the following: 4-16 8120.23B (1) Applicable FAA approved procedures, including engineering and quality manuals, procedures manuals, and handbooks, when practical. Obtain documentation in electronic format, if available, to simplify copying and distribution to team members. If applicable data is not available electronically, work with the PI or AE to identify relevant documents and to obtain printed copies of only those pages necessary to support the QSA.

(2) Current facility data available in the oversight information system.

(3) Known or suspected problem areas, including any areas the PI and AE would like special emphasis on during the QSA, such as requests to conduct a product audit. The team leader should also confer with the PI to identify and become familiar with the following quality system attributes as applicable: (a) Critical processes (including special processes) and critical suppliers; (b) Recent design changes; (c) Significant changes in suppliers, manufacturing personnel, procedures, or inspections; (d) Rework and scrap data; (e) MRB history; (f) Quality escapes; (g) Any additional relevant correspondence or data pertaining to issues discovered in the course of new product deliveries or acceptance; (h) Service difficulties; (i) Airworthiness Directives (AD); (j) Relevant issues identified in the Monitor Safety/Analyze Data (MSAD) database; and (k) SMS special emphasis items (e.g., feedback from activity reviews), as applicable.

Note: The team leader should contact the appropriate facility representative before the audit to arrange to have any information referenced in (a) through (k) above or other relevant quality data, procedures, or records available for the team at the in briefing as referenced in the facility notification letter and deemed necessary by the team leader.

(4) Findings and noncompliances from previous audits and other oversight activities, including previous FAA Forms 8100-6. The team leader or principal auditor should review these previous findings and noncompliances to determine if there are known or suspected problem areas that require more focused attention during the audit.

4-17 8120.23B (5) Recent self-disclosure items reported under FAA Order 2150.3.

(6) Agreements made between the assigned certification branch or CM section and the facility to be audited.

(7) Facility access information, including badges and security clearances.

(8) Lodging information.

(9) Any other items necessary to prepare for the audit.

b. Prepare an audit plan, which is in the oversight information system. Refer to Appendix B to this order.

c. Coordinate assignments, requirements, and arrangements with team members as far in advance of the audit as possible, but no later than 30 days before the audit. The audit plan may be amended as necessary. Notify team members immediately of changes in schedule, assignments, requirements, and arrangements. Provide copies of all relevant facility documents to team members, when feasible.

d. Notify the lead audit office immediately of changes in team numbers or composition.

e. Coordinate with the applicable PI or AE, as necessary.

4-28. Audit Team Member. Perform these tasks: a. Upon notification by the team leader, confirm availability for the QSA, quality system elements assigned, and travel arrangements.

Note: Notify the team leader immediately if you become unavailable for the QSA.

b. Before the audit, review all material provided by the team leader, PI, or AE appropriate to the assigned quality system elements. When possible, make a preliminary selection of the procedures you plan to audit.

Part 4. Conducting the QSA 4-29. Team Leader or Principal Auditor Coordination With Facility Representative. The team leader or principal auditor will coordinate with the designated representative of the facility to be audited to ensure administrative arrangements for items such as team access, escorts, meeting rooms, and safety and security requirements are complete. The team leader should take this opportunity to review the special emphasis areas described in paragraph 4-27a(3) of this order with the facility representative and arrange with the representative to have applicable information available to the FAA at the pre-audit team meeting.

4-30. Pre-Audit Team Meeting. Before starting the audit, the team leader and all team members will meet, usually at the facility to be audited. They review the following audit elements, as appropriate, for proper coordination and understanding: 4-18 8120.23B a. Approved quality system documents, including quality manuals and quality data submitted by PAHs to describe their quality systems; b. Approved design approval system documents, including any procedures manual or handbook; c. The corrective action history of the facility to be audited in the selected areas; d. Team functional assignments; e. Audit plan; f. Audit objectives; g. Working relationship of the facility to be audited with the FAA; h. Organizational structure of the facility to be audited; i. Agreements made between the certification branch or managing CM section and the facility to be audited; and j. SMS documents, including any procedures or other information that describe the SMS, if available.

4-31. Pre-Audit Conference. Soon after arrival at the facility to be audited, the audit team leader or principal auditor conducts a pre-audit conference with appropriate senior management, cognizant supervisory personnel, and other appropriate personnel of the facility who will be associated with the audit, including escorts. The team leader or principal auditor must perform the following tasks, as appropriate: a. Introduce team members.

b. Give a brief overview of QSA, highlighting the cooperative intention of the audit.

c. Provide the audit’s scope and objectives.

d. Review details of the audit agenda, including the nonconformance codes and procedures to be used.

e. Review administrative arrangements for the post-audit conference.

f. Encourage senior management to send feedback and send it within 30 days of the post- audit conference. Explain that this feedback is designed to obtain senior management assessment of the conduct of the QSA and is used by the FAA for continuous quality improvement of the certificate management program.

g. Allow time for a question and answer session.

4-19 8120.23B 4-32. Audit of Quality System Elements. The QSA team audits all of the applicable quality system elements and conducts at least one product audit at the PAH. Each quality system element addresses a specific activity or function that may affect the maintenance of FAA approved design or quality data. Each quality system element is listed in Appendix E to this order. The QSA team will perform the following tasks, as appropriate: a. Review FAA approved quality systems manuals or procedures manuals/handbooks to determine if current data ensure that regulatory requirements are met, if conforming products and articles are manufactured, and if design approval systems are maintained and controlled.

b. Review design system, design approval system, and quality system data to determine if current data are FAA approved.

c. Review other facility procedures (related to the production approval facility) that are not part of the facility’s FAA approved data to determine if the current procedures impact any of the quality system elements.

d. Review PAH supplier records by selecting a sample of PAH supplier audit reports.

(1) The reports may consist of onsite audits, mail-in surveys, third-party audits, or a combination of all three. The reports must be reviewed for compliance with the PAHs’ quality system requirements. This may include, but is not limited to, the following conditions: (a) Adherence to scheduled frequency of PAH audit(s) of their suppliers.

(b) Appropriate documentation of audits. This includes a signature by an appropriate authority, and attachment of required certifications and test documents.

(c) Determination of whether noncompliances provide evidence of root cause, corrective action, follow-up, and closure.

(d) If a history of similar noncompliances is evident, determination of whether the PAH is appropriately conducting root cause analysis and applying corrective action.

(2) FAA Form 8100-1 will be used to record the following information. The completed record will be entered in the oversight information system as part of the QSA report: (a) Total number of PAH supplier audit reports reviewed.

(b) Identification of suppliers reviewed.

(c) Total number of noncompliances documented for all supplier reports reviewed.

(3) The component page of the QSA Special Emphasis Items may be used to record any additional or supplemental information pertaining to the supplier audit record review that the auditor considers important. Include this information as a note under the heading, “Note to CM branch manager and Cognizant Principal Inspector”.

4-20 8120.23B Note: The results will be used to identify areas that may require more focused attention during audit of the supplier control system element and as input into the following year’s risk assessment of the PAH.

(4) Any noncompliance noted during the review of PAH supplier audit reports will be recorded under the supplier control quality system element. Noncompliances will also be documented in accordance with paragraph 4-33 of this order.

Note: Paragraph 4-32d of this order applies only to PAH facilities that use suppliers in the process of manufacturing FAA approved products. Review of supplier records should be started early in the audit process to allow for additional time in case issues are noted.

e. Audit Compliance to Facility Procedures and Quality Requirements. Prioritize audits according to any special concerns raised by the PI or AE. Use the quality system elements in Appendix E to this order to determine the depth of the audit in the subject area. Perform, as necessary, a combination of document reviews and product audits to determine if the quality system element meets applicable requirements.

f. Select at least one team member to conduct at least one product audit to determine compliance with current system procedures and quality requirements. Refer to Chapter 3, Section 4, Part 2 of this order for product audit.

g. On the basis of facility procedures or quality requirements, identify and document other quality system elements and statement of condition practices and principles not contained in Appendix E to this order that were required to document what was audited. Write or type additional criteria and statement of condition practices and principles and include the appropriate reference to the facility procedures or quality requirements and the auditor’s recommendation of the quality system element to which the criteria and statement of condition apply. Team members must present new criteria and statement of condition practices and principles to the team leader as soon as they are completed.

h. Detect and report noncompliances and areas that may require additional audit by the PI or AE.

i. If a QSA discloses a noncompliance that may involve other PAHs, the team leader and PI must consider the potential systemic impact of the noncompliance, and accordingly identify those additional PAHs also affected. The PI will follow up to verify the affected PAHs and notify and apprise the appropriate PIs of the encountered concern.

j. Audit compliance to SMS requirements, if applicable. Refer to FAA Order 8120.25 and QMS document AIR-002-600-005-F13 for the QSA/SMS audit DCT.

4-33. Recording Noncompliances. Auditors will record all noncompliances on FAA Form 8100-6, according to the guidelines in Appendix D to this order.

a. Record as a certification related noncompliance any condition that questions the certification basis.

4-21 8120.23B b. Address the noncompliance on the QSA Executive Summary (refer to paragraphs 4- 34b(2)(c) and 4-36b, and Appendix H to this order) and as a special emphasis item in the audit report (refer to paragraphs 4-34b(2)(d) and 4-36c and Appendix I to this order).

4-34. Audit Meetings.

a. Daily Meeting. The team leader or principal auditor holds the following daily meetings, as appropriate: (1) Meeting With Audit Team Members. The team leader will review and discuss the following with team members: (a) Status of the audit, (b) Problems encountered, (c) Plan for the next day’s audit, and (d) All FAA Form(s) 8100-6, prepared during the day to ensure correctness and adequacy.

(2) Meeting/Communication With PI and AE. The team leader or principal auditor ensures that the PI and AE, as applicable, are informed of all discussions concerning the status of the audit. This meeting should occur daily when the PI and AE are part of the audit team.

Otherwise, coordinate with the PI and AE to establish the method and frequency at which these discussions should occur.

(3) Meeting With the Audited Facility’s Designated Representative. The team leader or principal auditor holds a brief meeting daily with the audited facility’s designated representative to discuss the progress of the audit, including problems encountered, the status of actions requested by the team, schedule changes, and the coordination of further audit activities.

b. Final Critique Meeting/Audit Wrap Up. At the conclusion of the audit, the team leader holds a final critique meeting. The principal auditor allows time to finalize the details of the audit. The team leader and members or the principal auditor do the following, as appropriate: (1) Team Members or Principal Auditor.

(a) Complete all required FAA Form(s) 8100-6. Team members discuss FAA Form(s) 8100-6 with the team leader to determine if there are any possible violations of the applicable requirements of 14 CFR. During this meeting, the team will determine if the noncompliances should be categorized as isolated or systemic. The team leader must resolve any disagreement regarding noncompliances, including the determination of systemic or isolated.

The lead audit office, or requesting CM section, as applicable, must determine the level of corrective action required (refer to paragraph 4-39 of this order).

4-22 8120.23B (b) Ensure all true copies of objective evidence are included to support the appropriate FAA Form(s) 8100-6, and are clearly authenticated in accordance with FAA Order 2150.3.

(2) Team Leader or Principal Auditor.

(a) Resolve team disagreements on specific noncompliances.

(b) Discuss all noncompliances with the PI or AE, as applicable.

(c) Prepare one QSA Executive Summary in the oversight information system (refer to Appendix H to this order). For a facility with multiple approvals, prepare one original QSA executive summary.

(d) Identify and record specific problems or concerns that the QSA team believes require further action and that should be brought to the attention of the assigned certification branch or CM section, the PI, the AE, and the Flight Standards principal maintenance inspector (as appropriate). Prepare one original or electronic document (refer to Appendix I to this order) to record these special emphasis items. For a facility with multiple approvals, prepare one original document.

(e) Verify the signed original FAA Form(s) 8100-6 have been prepared for inclusion to be sent to the CM section and assigned certification branch. Each report must include all applicable FAA Form(s) 8100-6.

(f) Provide a copy of the completed draft FAA Form(s) 8100-6 to the PI or AE, as applicable, when they are present.

(g) Verify that the required number of true copies of objective evidence has been prepared for inclusion, as applicable, in the QSA report to be sent to the responsible CM section having oversight responsibilities.

(h) Provide all true copies of objective evidence to the PI or AE, when present.

When the PI or AE is not present, forward the copies in accordance with the applicable instructions in paragraph 4-38a of this order. If the objective evidence will be necessary as a reference during preparation of the audit report, make a separate copy and identify each page as “For Reference Only.” 4-35. Post-Audit Conference. The team leader or principal auditor must conduct a post-audit conference with appropriate senior management and cognizant supervisory personnel of the audited facility. The team leader or principal auditor must, as appropriate, do the following: a. Introduce FAA personnel not previously introduced at the pre-audit conference.

b. Give a brief presentation of the overall results of the audit, using each completed QSA Executive Summary as a reference: 4-23 8120.23B (1) Provide a completed and signed QSA Executive Summary to the audited facility’s designated representative.

(2) Summarize all noncompliances. Mention only noncompliances previously discussed with the PI and AE, as applicable, and facility personnel.

c. Explain the purpose and use of the oversight information system as it relates to QSA data.

d. Explain corrective action and follow-up procedures.

Note: Emphasize that the PI or AE may conduct additional investigations into noncompliances reported in the QSA report. The results of these investigations may be included with the letter requesting corrective action for the QSA noncompliances.

e. Remind senior management of and encourage them to send feedback within 30 days of the post audit conference.

f. Request final comments. Clarify any misunderstandings or disagreements before departure.

g. Adjourn the QSA.

Part 5. Post-QSA Activities 4-36. Preparing the QSA Report. The team leader or principal auditor must prepare the QSA report. When a facility has one or more production approvals, prepare one audit report. Format and compile the audit report in the oversight information system. The report will consist of the following: a. FAA Form 8100-3, Quality System Audit Report, b. QSA Executive Summary or printed copy of electronic equivalent (Appendix H to this order). Each electronic copy of the summary must be electronically signed. The printed copy presented to the PAH representative must be physically signed. All other information on electronic copies must be identical to the signed copy as presented to the PAH.

c. QSA Special Emphasis Items, d. FAA Form 8100-6, Noncompliance Record, e. FAA Form 8100-1, Conformity Inspection Record. The record must include documentation of product audits (including onsite QSA supplier audits if applicable), and supplier audit record reviews as applicable.

f. FAA Form 8120-14, Production Approval/Certificate Management Activity Report. This report is only used when onsite supplier audits take place.

Note 1: Ensure the QSA report identifies only noncompliances presented at the post- audit conference.

4-24 8120.23B Note 2: Do not include reproductions of true copies of objective evidence in an original audit report. Objective evidence must be a true copy signed and dated in accordance with FAA Order 2150.3.

4-37. Quality Review of the Report. The QSA report contains the data that forms the basis of corrective action requests (refer to paragraph 4-39 of this order) and the QSA national database.

To this end, the audit report must be accurate and complete. Division managers (or delegated individuals) must establish a review process within their divisions that ensures accuracy and completion of the QSA report before distribution.

4-38. Sending the QSA Report. Using the oversight information system, the team leader or principal auditor and the responsible assigned certification branch and CM section managers (or delegated individuals) will process the QSA report as follows: a. Team Leader or Principal Auditor.

(1) Make the audit report available to the responsible CM section manager or delegate within 15 working days of the post-audit conference. The manager or delegate must return the report to the team leader or principal auditor for correction and continued processing within 5 working days of receipt.

(2) Make the audit report available to the responsible CM branch manager within 5 working days of receipt of the CM section manager’s or delegate’s comments. Do not send copies of objective evidence to the CM branch manager. Mail or deliver all true copies of any objective evidence to the attention of the certificate management PI.

(3) Make the audit report available to the assigned certification branch manager. The copy for the assigned certification branch manager may be tailored according to the needs of that manager. Include copies of any objective evidence that the assigned certification branch manager may require to investigate identified special emphasis items. These copies must be mailed or delivered to the attention of the assigned certification branch manager.

(4) Make the audit report available to the immediate manager of any auditors in training assigned to the team.

b. CM Section Manager.

(1) Make the audit report available to the PI within 3 working days of receipt of the report from the QSA team leader.

(2) Include any additional audit documents that the team leader provides.

c. Responsible Assigned Certification Branch Manager.

(1) Make the QSA report available to the AE within three (3) working days of receipt of the report from the QSA team leader.

4-25 8120.23B (2) Send or deliver all copies of any objective evidence to the attention of the AE, as applicable; send the true copies of the objective evidence under separate cover.

Note: Assigned certification branch investigations of special emphasis items identified during the conduct of a QSA should be coordinated with the responsible CM section.

4-39. Requesting Corrective Action. The PI must request corrective action in accordance with paragraph 3-31 of this order.

4-26

8120.23B Chapter 5. Additional Oversight Responsibilities Section 1. Introduction 5-1. Purpose of This Chapter. Sections 2 through 6 of this chapter provide guidance for accomplishing additional certificate management responsibilities.

Section 2. Review of Changes to a PAH’s Quality System 5-2. General CM Section Responsibilities. The CM section must thoroughly review applicable changes to the quality system required for the applicable production approval that may affect the inspection, conformity, or airworthiness of the product or article. Any inadequacies in the quality system must be identified to the PAH for corrective action.

Note: The review of changes at an associate facility will remain with the office having certificate management responsibility for the original PAH. If the original PAH has delegated responsibility to approve changes to the associate facility, the CM section of the associate facility will review the changes.

5-3. Prioritization of Review. Review of a facility’s changes to its quality system should be prioritized according to its level determination and RBRT assessment. For example, the changes at a facility rated as Level 1 High will be reviewed before the changes for a facility rated as Level 1 Medium. Review of changes from facilities with the same rating will be prioritized by date of notification or receipt of applicable data.

5-4. Review of Changes. The CM section should review changes to the quality system to ensure— a. The quality system will continue to adequately provide for the consistent acceptance of only those products or articles which are in conformity with the approved design data and in a condition for safe operation.

b. The quality system will continue to meet the intent of the pertinent rules and can be realistically implemented.

Note: The conditions identified in paragraphs 5 4a and 5-4b of this order may often be verified through data review alone. In some instances, however, onsite inspection or review may be required.

5-5. Post Review Actions. The CM section will— a. Identify if any inadequacies were found in the changed quality system and request corrective action from the PAH.

b. After any required corrective actions have been taken or if there were no corrective actions required, process the changes as follows: 5-1 8120.23B (1) For changes to a quality system at a PAH, forward a letter to the PAH approving the quality system changes, including applicable changes submitted to the FAA approved inspection and test procedures. Refer to the sample letter in figure 5-1 of this order.

(2) The PI will update the oversight information system to reflect the current quality system and include a copy of the FAA letter that acknowledges the approval of the applicable PAH quality system.

5-2 8120.23B Figure 5-1. Sample Letter of Approval for Quality System Changes 1601 Lind Avenue SW.

Renton, WA 98055-4056 August 10, 2015 Mr. Michael D. Dorsey, President ABC Aircraft Company 4954 Airport Drive Renton, Washington 12345 Notification of Quality System Change Status Dear Mr. Dorsey: We have completed our review and audit of the quality system changes documented in your Quality Management Manual. Your submitted data meets [specify applicable CFR.] The Federal Aviation Administration (FAA) approves the submitted data. The FAA reserves the right to require changes, additions, and clarifications that may become necessary as a result of subsequent inspections and/or audits.

This notification should remain on file as evidence of FAA review of your quality system document.

Document Name: Quality Management Manual.

Document Number: 101248 Revision Number: C Date: June 30, 2015 Sincerely,

Dewey Revu

Dewey Revu Principal Inspector 5-3 8120.23B Section 3. Reserved Section 4. Investigation of § 21.3, Failures, Malfunctions and Defects Reports 5-6. General Information. This section provides guidance for the review of failures, malfunctions, and defects that AIR may, at its discretion, investigate whether they could impact the design and production approval of products or articles.

a. Source . The FAA obtains and analyzes data, including in-service fleet data, data collection tools (DCT), and other data sources to help identify hazards, determine mitigations, and identify mandatory safety risk controls. There are various means by which the FAA obtains information regarding failures, malfunctions, and defects reports on products or articles with design or production approval; for example— (1) Manufacturer’s notification of failures, malfunctions, and defects (refer to § 21.3, § 183.63, and Advisory Circular (AC) 21-9, Manufacturers Reporting Failures, Malfunctions, or Defects); (2) SDRs (refer to §§ 91.1415, 121.703, 125.409, 135.415, and 145.221) (the FAA website for submission and review of SDRs is Service Difficulty Reporting System; (3) Mechanical Interruption Summary (MIS) Report (refer to §§ 91.1417, 121.705, and 135.417); (4) Extended Operations (ETOPS) Report (refer to §§ 21.4, 121.374, and 135.364) (5) Repair station reports of unairworthy conditions; (6) Accident and Incident Report (refer to 49 U.S.C., subtitle II, chapter 11, subchapter III, sections 1131 through 1136); (7) User complaints (general public, military, and foreign governments); (8) DCTs; and (9) Reports and information received from other FAA and government offices.

b. Assigned Certification Branch and CM Section Responsibilities. Upon receipt of a failures, malfunctions, and defects report, the CM section having certificate management responsibilities over the manufacturer of the identified product or article(s), will review the information and determine if design or production deficiencies are involved.

The assigned certification branch is responsible for overseeing the certificate holder’s corrective action to any design deficiencies in accordance with FAA Order 8110.107, Monitor Safety/Analyze Data (MSAD) .

c. CM Section Responsibility. The CM section will assign a high priority to failures, malfunctions, and defects reports, which must be completed as expeditiously as possible. The FAA will not reveal to the manufacturer the identity of a firm or private person who reports any failure, malfunction, or defect. The FAA must witness any tear down inspections or testing to be 5-4 8120.23B performed on defective products or articles when such products or articles are flagged (by FAA tags or forms) as requiring the presence of an FAA inspector during the tear down, inspection, or test, as applicable.

5-7. Investigation. If the assigned ASI conducts an investigation, it must be independent of that performed by the manufacturer, and the report will include the results of any investigation conducted by the manufacturer.

5-8. Corrective Action. The CM section will formally request the manufacturer to take corrective action when the investigation discloses unsatisfactory conditions in conformity, quality system, or workmanship. In such cases, particular emphasis must be placed on determining by examination or reexamination of all related quality system practices, data, records, etc., whether the discrepancy may also involve products, articles, and parts in service, in the manufacturing process, or spares, either in storage or shipped to users. The CM section may require coordination with the certification branch, if an AD or SAIB is recommended. Further, the CM section should work with the responsible assigned certification branch to ensure the manufacturer has implemented appropriate corrective action (e.g., service bulletin, design, or manufacturing process control change).

5-9. Processing an Investigation of a § 21.3 Report.

a. Investigation Report. The CM section will prepare an investigation report in the form of a memorandum or any other acceptable manner and will include, at a minimum, the following information— (1) Name and address of manufacturer, (2) Type and number of certificates or approvals held, (3) Make, model, and part number, as appropriate, to positively identify the defective product or article(s), (4) The applicable product and article identification information required by 14 CFR Part 45, (5) Inspector’s statement of findings, including an audit of any investigation conducted by the manufacturer, (6) Inspector’s conclusion as to the cause of the § 21.3 report, (7) All corrective actions requested by the CM section, taken by the manufacturer, or both, including a copy of the CM section letter to the manufacturer and the manufacturer’s reply, (8) Effect on products in service, (9) Identification of the system involved, and (10) Recommendations and required further actions.

5-5 8120.23B b. Interim Report. If the investigation is delayed for any reason, and if requested by the CM branch, the CM section will prepare an interim report outlining the progress of the investigation.

c. Investigative Findings. If the investigation indicates that a regulatory noncompliance exists, the investigating and reporting procedures in FAA Order 2150.3 will be followed.

d. Organization Designation Authorization (ODA) Reports. Upon notification by the FAA, ODA holders are required by § 183.63 to investigate and report to the organization management team (OMT) the results of their investigation and any action taken or proposed.

The OMT should initiate any actions deemed appropriate for the particular unsafe problem or condition involved as described in FAA Order 8100.15, Organization Designation Authorization Procedures .

5-10. Foreign Manufacturers. In some cases, foreign manufacturers are exempted from the reporting requirements of § 21.3. When there are failures, malfunctions, and defects reports involving products, or articles, either manufactured by a foreign manufacturer under a U.S. type- certificate issued under § 21.29, under an approval issued under § 21.621, or exported to the United States under § 21.502, the CM branch in the division where the failures, malfunctions, and defects occurred may initiate an investigation. This may include situations where there is a split between the State of Design (SOD) and the State of Manufacture (SOM), in such case applicability is determined by the approval and export basis. If the CM branch does conduct an investigation, a complete report will be provided to the Validation Certification Branch, AIR-730 and the CM branch of the division having assigned responsibility over the particular country where the product, article, or part manufacturer is located. Upon receipt and review of the report, the CM branch having assigned responsibility will bring the matter to the attention of the CAA for further investigation and corrective action as necessary. If critical articles, processes, or methods are involved, ADs or alert bulletin action should be considered. If the condition is serious and affects safety and if adequate corrective action is not immediately forthcoming from the foreign manufacturer or CAA, action pursuant to § 13.19 would also be necessary.

Coordinate such enforcement action through the Assistant Chief Counsel, Enforcement Division, AGC-300, AIR International Office, and the State Department.

Section 5. Unscheduled Audits and Investigations 5-11. General Unscheduled Audit Information. Chapter 4 of this order addresses ongoing certificate management audits. However, any one of these audits may be performed on a non scheduled basis at the discretion of the CM section whenever necessary to ensure continued operational safety. Other investigations may arise for purposes such as SUP or whistleblower allegations.

5-12. Unscheduled Audits. The CM section will determine the type of audit that will provide the best assessment of the applicable situation. An unscheduled audit will be planned, conducted, and reported in accordance with Chapter 3 of this order to the greatest extent practicable. Appropriate emphasis on planning the audit should be provided despite the reduced time that may be available between the decision to conduct the audit and the actual conduct of the audit. Notification of the unscheduled audit to the PAH or supplier should be provided in 5-6 8120.23B accordance with paragraphs 4-3 and 4-15 of this order. For a PAH or supplier facility located outside the United States, the responsible CAA also should be provided notification as soon as practicable. Situations that may warrant an unscheduled audit may include— a. Accidents and incidents; b. Deliberate violations; c. Repetitive notices of quality escapes, ADs, and SDRs; d. SUP, Hotline, or Whistleblower investigations; e. Excessive owner/operator complaints; f. PAH’s refusal/failure to take appropriate corrective action; g. PAH’s inability to control suppliers; h. Renewal of a PAH’s production activity after a prolonged period of inactivity; i. Relocation/addition of a production facility or supplier that produces articles listed on the CPL; j. Oversight Requests from CAAs. A U.S. manufacturer that has entered into a supplier, subcontractor, or other similar relationship with a foreign manufacturing entity (for example, a manufacturer of aircraft, aircraft engines, or propellers; a repair station; or an air carrier) may produce, identify and deliver civil aeronautical products, articles, and parts to that entity. The purchase order or similar contract/procurement agreement from the foreign manufacturer to the supplier manufacturer should provide any evidence of the sales relationship to the FAA as needed. These products or articles are to be produced in support of a design approval issued by a CAA, to include modifications made to a type design by repair stations or air carriers (for example, amended TC, supplemental type certificate (STC), or CAA approved modification).

The regulatory responsibility for control or oversight of a U.S. manufacturer acting strictly as a supplier to a foreign manufacturing entity resides with the CAA having oversight of that design approval, production approval, or both. The FAA assumes no regulatory responsibilities for these programs and will provide assistance only in oversight of the U.S. supplier through a special written arrangement with the CAA under the provisions of the bilateral agreement: (1) A CAA’s request should include clear, concise, and specific instructions to the FAA that includes the following: company name, address, phone number, and point of contact; details concerning the extent of oversight to be conducted on behalf of the CAA; and documentation to be submitted to the CAA. The responsible CM branch will ensure the request is complete before assigning it to a CM section.

(2) The responsible CM section will review all completed documentation being submitted to the CAA to ensure the requirement of the CAA’s request have been met. After completing its review and making any applicable corrections, the responsible CM section will prepare a cover letter to accompany the documentation and forward it to AIR International 5-7 8120.23B Office for review and comment. After making any applicable corrections to the cover letter, the completed documentation and cover letter will be forwarded to the CM branch for signature.

The CM branch manager will forward all documentation to the requesting CAA.

(3) When the CAA conducts its own oversight activities at a U.S. manufacturer, the FAA may be invited to observe or participate. The responsible CM section should consider accepting the CAA invitation only when there is no impact on scheduled ongoing certificate management activities or other special certificate management activities with higher priority.

k. A PC holder’s inability to be systematically compliant with the quality system elements in § 21.137, its FAA-approved procedures, or both; and l. Any other situation deemed necessary in the interest of safety.\ 5-13. Special Audit Items (SAI). An SAI is an item, process, or area that senior management has determined requires specific focus during audits. The CM branch manager or senior division management has the authority to declare an SAI based on a perceived need. The scope of the SAI, such as what is to be audited, when it is to be audited, and how results are documented, will be included in the SAI instructions sent to the ASI in writing.

Note: An SAI is different from a special emphasis item, in that the SAI is an audit directed by senior management for a specific issue during an audit, whereas a special emphasis item is a concern, determined by a QSA result, that may require further attention.

Section 6. Providing Guidance to a PAH 5-14. Guidance. The PI should provide guidance to a PAH as necessary for the manufacturing of products and articles produced under the approved quality system. The guidance provided by the PI may include, but is not limited to, the following: a. Quality system changes; b. Facility changes; c. Technical assistance; d. Updating supplier lists; e. Service difficulty and corrective action review; f. Support of QSAs; g. Regulatory requirements, changes to guidance materials, or industry best practices, and; h. Understanding of applicable regulations.

5-8

8120.23B Chapter 6. The Oversight Information System 6-1. Purpose of This Chapter. Audit data resulting from PAH certificate management activities and SMS compliance audits, when applicable, is documented in the oversight information system. Upon extraction from the oversight information system, this data can be sorted and filtered using software with statistical capabilities. The software will be used to detect shifts in performance and statistically significant trends within the manufacturing industry, by division, by production approval type, or by other categories as supported by the data available.

Data in the oversight information system may also be used to study various aspects of the performance of QSAs on an as required basis.

6-2. Initial Activation of a New PAH in the Oversight Information System. The information related to the PAH that is initially entered into the oversight information system is divided into two parts: a. Quality System Information. In the oversight information system, the entity that applies for a production approval is called a “Quality System.” The Quality System contains the name and main address of the entity as well as the name of the accountable manager, as required per 14 CFR 21.135, 21.305, and 21.605.

b. Project Information. In the oversight information system, the additional information needed by the FAA to effectively manage the production approval from the time of application until its cancellation is called a “Project.” The Project contains information such as the type of production approval, the current status of the production approval, the facility location, personnel assigned to manage the production approval (both at the facility and the FAA), as well as information about the products or articles that the facility manufactures.

6-3. Forms. The oversight information system contains all certificate management forms, including FAA Form 8100-1, FAA Form 8100-3, FAA Form 8100-6, and FAA Form 8120-14.

6-4. Database Management. The oversight information system, as appropriate, will do the following: a. Analyze noncompliance data with respect to the quality system elements.

b. Highlight noncompliance trends with respect to the quality system elements.

c. Highlight trends emerging in the performance of QSAs.

d. Provide selected data and reports.

Note: All recipients of audit data in the oversight information system will use the information internally only and will not release results outside of AIR (refer to paragraph 7-7 of this order).

6-5. Periodic Review of Risk Assessment Tools. AIR-800 will review and analyze the risk assessment tools periodically to determine if changes are needed. This review is necessary to 6-1 8120.23B continually improve the risk assessment process and to keep up with changes in the industry.

AIR-800 will coordinate the implementation of any changes to the risk assessment tools, including developing and disseminating revised program guidance, and updating the oversight information system and associated training materials.

6-6. Use of the Database. Divisions may use the oversight information system to— a. Obtain reports on noncompliances, frequently used 14 CFR references, and PAH compliance.

b. Detect shifts in performance and statistically significant trends for different segments of the industry.

c. Assist in scheduling.

d. Track PAH approved supplier lists.

e. Document supplier indicators.

6-2

8120.23B Chapter 7. Administrative Information 7-1. Distribution. This order is distributed to division levels of the Flight Standards Service, to the branch levels of AIR, to the branch levels in the regional Flight Standards division and Aircraft Certification divisions, to all FSDOs, to all CM sections, to the Aircraft Certification and Airworthiness branches at the FAA Academy, and to the Flight Standards Service Regulatory Support Division.

7-2. Delegation of Authority AIR-600 is responsible for issuing, revising, or canceling the material in this order.

7-3. Authority to Change This Order. The issuance, revision, or cancellation of the material in this order is the responsibility of AIR-600.

7-4. Definitions. See appendix L for a list of definitions.

7-5. Related Publications. This order references several publications; you can find them on the FAA employee website, on the FAA public website, or the DRS. Unless stated otherwise, please refer to the latest version.

7-6. Deviations. Adherence to the procedures in this order is necessary for uniform administration of this directive material. Any deviations from this guidance material by an FAA employee must be coordinated and approved by AIR-600. If a deviation becomes necessary, the FAA employee involved should ensure the deviations are substantiated, documented, and concurred with by the appropriate supervisor. The deviation must be submitted to AIR-600 for review and approval. The limits of federal protection for FAA employees are defined by 28 U.S.C. § 2679.

7-7. Forms. This order identifies several forms used for the audit, approval, and certificate management of production activities. Some of the forms are provided by AIR-600 in electronic format.

7-8. Suggestions for Improvements. Please forward all comments on deficiencies, clarifications, or improvements regarding the contents of this order to the AIR Directives Management Officer at 9-avs-air-directives-management-officer @faa.gov.Your suggestions are welcome. FAA Form 1320-19, Directive Feedback Information , is located in appendix M of this order for your convenience.

7-9. Records Management. Refer to FAA Order 0000.1, FAA Standard Subject Classification System ; FAA Order 1350.14, Records Management ; or your office Records Management Officer (RMO)/Directives Management Officer (DMO) for guidance regarding retention or disposition of records.

7-1 8120.23B Appendix A Appendix A. Category Parts List A-1. Purpose . This appendix describes the Category Parts List (CPL), which may be used by the CM section when conducting a risk assessment of a PAH.

A-2. Category Parts List. The CPL contains: a. A list of systems, assemblies, and part(s) that have been assigned a category rating of 1 or 2. To receive a category rating of 1, a system, assembly, or part must be one whose failure could prevent continued safe flight and landing, and resulting consequences could reduce safety margins, degrade performance, or cause loss of capability to conduct certain flight operations. To receive a category rating of 2, a system, assembly, or part must be one whose failure would not prevent continued safe flight and landing, but whose resulting consequences may reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions or subsequent failures.

Note: For the purposes of the oversight information system only, a category rating of 3 is assigned to a system, assembly, or part whose failure would have no effect on continued safe flight and landing of the aircraft and low-risk UAs.

b. Special processes that may be considered critical to the manufacturing of a part or assembly listed on the CPL (e.g., heat treating, cadmium plating, additive manufacturing, welding). A special process is considered critical if: (1) It could degrade the performance of the assembly or part, or the consequences of a failure may reduce the capability of the aircraft.

(2) It adds value to a part on the CPL that cannot be validated by nondestructive testing techniques, such as visual inspection or measurement by complex means.

Note: The category and criticality for a part remains unaffected by the manufacturing or fabrication method, including special processes. For example, a category 2 part requiring a special manufacturing process to meet specifications will retain its category 2 rating.

A-3. Structure of the CPL. The CPL is grouped by regulatory basis (i.e., 14 CFR parts 23, 25, 27, 29, and 33). The regulatory basis is further delineated by the Joint Aircraft System/Component (JASC)/Air Transport Association (ATA) codes, which have been assigned a rating of either a category (CAT) 1 or 2 or N/A.

A-4. Review of the CPL. AIR-600 will review the CPL annually. This review will be documented on a revision/review tracking log that is attached to the CPL. The CPL, with the attached revision/review tracking log, will be posted on the FAA Employees’ website.

A-5. CPL Revision Process. A request to add, remove, or change the category rating of a system, assembly, or part to the CPL may be generated from any source (e.g., PI or assigned certification branch office). The following procedure is used to revise the CPL: A-1 8120.23B Appendix A request to change the category rating for a specific Part 23 aircraft may be warranted if the category rating of 1 is not appropriate.

a. The requester should prepare a Part Categorization memorandum and include the following, at a minimum (refer to sample memo in figure A-1): (1) Identify and fully describe the applicable system, assembly or part.

(2) Identify the applicable 14 CFR part (i.e., Part 23, 25, 27, 29, or 33).

(3) Describe the reason for adding, removing, or changing the category rating of the system, assembly, or part.

(4) Provide all applicable supporting data. This may include service difficulty information, ADs, or any other data to support the request.

(5) Identify where on the CPL a new system, assembly, or part should be added.

Omit this data for a change or removal request.

(6) When requesting a change to the category rating of an existing system, assembly, or part, include its current category rating. Omit this data for an add request.

b. The CM section manager reviews the memo to verify that it contains the minimum required information and coordinates with the requester, if necessary. The CM section will then send the Part Categorization memo to its respective CM branch manager.

c. The CM branch manager retains a copy of the request and forwards the memo to AIR-600.

d. AIR-600 will investigate and coordinate the data described in the memo with the appropriate Technical Policy Office. AIR-600 will then complete the “Coordination” section of the Part Categorization memo as follows: (1) Indicate whether the action taken is to “Accept” or “Deny” the request.

(2) If the action is to accept either a request to add a system, assembly, or part or to change an existing category rating, assigns the appropriate category to the system, assembly, or part.

(3) If the action is to accept a request to remove an assembly or part from the CPL, indicate the concurrence.

(4) If the action is to deny the request, indicates the reason it was denied.

e. On completion of the actions in paragraph 5d of this appendix, AIR-600 will sign the completed memo and forward it to the requesting CM branch manager.

A-2 8120.23B Appendix A f. AIR-600 updates the CPL, documents the new revision date in the CPL revision/review tracking log, and disseminates the revised CPL to all CM branch managers.

g. AIR-600 will post the updated CPL on the FAA Employees’ website.

A-3 8120.23B Appendix A Figure A-1. Sample Part Categorization Memo for Requesting a Change to the CPL A-4 8120.23B Appendix B Appendix B. Audit Plan B-1. Purpose. Audit planning is a structured process to ensure a comprehensive assessment of PAHs and suppliers. This appendix provides audit criteria that should be considered when preparing a required audit plan for PI audits and SCAs. The Team Leader should consider audit criteria when preparing an audit plan for QSAs. The audit plan is documented in the oversight information system.

B-2. Determination of Risk Within a Facility/Facility Plan. For PI audits, when applicable, the audit plan will include audit criteria resulting from a determination of risk within a facility and the facility plan in accordance with paragraphs 3-18 and 3-19 of this order.

B-3. Audit Plan for PI Audits and QSAs. As applicable, the audit plan for PI audits and QSAs includes the following items: a. Dates of the audit.

b. Names of the auditor(s), team leader, team members, or all (when more than one auditor is selected).

c. Name and address of the facility to be audited, types of approval(s), current product line, number of employees associated directly with the production approval activity, a description of the manufacturing facilities layout, a description of the assigned responsibilities, and delegated authorities.

d. List of top-level FAA-approved procedures (e.g., the quality manual index of procedures, the procedures manual, the PMA approval letter, and TCDSs).

e. FAA/facility agreements in effect (e.g., agreement on frequency of submittal of minor design changes).

f. Noncompliances found during previous audit(s).

g. Changes to the PAH manufacturing or quality processes (e.g., first production run of a new article and FAI, changes to suppliers or new suppliers, production process changes, tooling changes, and changes resulting from corrective actions).

h. Special emphasis items recommended by the PI and AE.

i. Self-disclosure items under FAA Order 2150.3.

j. Quality system elements, to include product audits and assignments (when more than one auditor is selected).

k. Major inspection, manufacturing processes, and rebuild/alter procedures including a list of processes not previously audited.

B-1 8120.23B Appendix B l. Unusual features of the product, manufacturing and inspection methods, or design approval system.

m. SMS special emphasis items (e.g., feedback from activity reviews).

n. Feedback on § 21.3 reports (e.g., in-service failures, malfunctions, and defects).

B-4. Audit Plan for SCAs. The audit plan should ensure adequate preparation for assessing supplier compliance with PAH flow-down requirements and applicable regulatory provisions.

The plan should be developed in coordination with available PAH-provided information and focused on specific articles, processes, and supplier activities subject to FAA oversight. The plan for SCAs includes, as applicable, the following items.

a. Dates and duration of the audit.

b. Names of the auditor(s).

c. Name and address of the facility to be audited.

d. Description of the articles or components supplied.

e. List of flow-down requirements, to include any exceptions. Refer to paragraph 4-16 of this order.

f. Any applicable PAH procedures used to manage and oversee suppliers, including supplier approval, ongoing surveillance, and corrective action processes.

g. Any information provided from SCA hand-off memos (i.e., any identified risk areas or specific audit focus provided by the PAH or CM section).

h. Verification of regulatory flow-down requirements related to quality escape notification procedures, record retention, and right of entry. Refer to §§ 21.137(c)(2), 21.137(k), 21.140; 21.310(a), and 21.610.

i. FAI requirements, as applicable.

j. List of critical parts or special processes performed by the supplier.

k. History of known issues or prior nonconformances relevant to the oversight of the supplier.

l. Known quality escape events within the last 24 months.

m. Any other relevant information useful in the conduct of the audit.

B-2 8120.23B Appendix C Appendix C. Preparation Instructions for FAA Form 8120-14, Production Approval/Certificate Management Activity Report C-1. Purpose. This appendix provides instructions for completing FAA Form 8120-14. This form is used to document all activity, except QSAs, at PAHs and their suppliers. When combined with the respective FAA Form(s) 8100-6 and, if applicable, FAA Form 8100-1, a complete report of the activity conducted is available for subsequent planning.

C-2. Specific Guidance. Figures C-1 and C-2 show FAA Form 8120-14 with numbered blocks. Prepare the form by inserting in: a. Block 1. The PAH name as recorded on the production approval.

b. Block 2. The project number(s) applicable to the production approval.

c. Block 3. The name and address of the point of manufacturing facility as recorded on the production approval, or for a supplier, as listed in the FAA’s facility database.

d. Block 4. A check mark in the appropriate box(es) to indicate the type of production approval.

e. Block 5. The starting date and the ending date of the activity that was conducted.

f. Block 6. A check mark in the appropriate box to indicate the type of activity that was conducted.

g. Block 7. The title, revision number, and date of the current quality manual that the PAH has submitted to the FAA and that the FAA has approved.

h. Block 8. The date that the applicable quality manual submitted by a PAH was approved by the FAA.

i. Block 9. An “X” in the column next to the system element audited when the result of the activity is satisfactory. Do not use this block for SCAs.

j. Block 10. The respective FAA Form 8100-6 noncompliance numbers for the system element audited, when the result of the activity is unsatisfactory.

k. Block 11. The nomenclature and part number(s) of the product, article, or part(s) audited.

l. Block 12. An “X” in the column next to the product or article(s) audited when the result of the activity is satisfactory.

m. Block 13. The respective FAA Form 8100-6 noncompliance numbers for the product or article(s) audited, when the result of the activity is unsatisfactory.

C-1 8120.23B Appendix C n. Block 14. The specific purchase order or quality flow down requirement audited, such as, but not limited to, the following: purchase order number, quality management system purchase number, quality assurance procedure, engineering drawing number, general notes, or work instruction number.

o. Block 15. An “X” in the column next to the specific purchase order or quality flow down requirement audited when the result of the activity is satisfactory.

p. Block 16. The respective FAA Form 8100-6 noncompliance numbers for the specific purchase order or quality requirements audited, when the result of the activity is unsatisfactory.

q. Block 17. T he names, titles, and office symbols of all FAA personnel who participated in the activity.

r. Block 18. The typed or printed name and signature of the person conducting the audit. In most cases, this will be the PI responsible for the PAH.

Note 1: The oversight information system does not allow the user to provide a traditional signature to FAA Form 8120-14. However, when the user is logged in using a specific login and password, the user can populate block 18 with their name to demonstrate completion of FAA Form 8120-14.

Note 2: When FAA Form 8120-14 is used to document a PI audit or preliminary certificate management (PCM) audit with multiple team members, the signature in block 18 must be that of the team leader. This form, with the above signature, can then be used to support the continued appointment as a QSA team leader in accordance with paragraph 4 of Appendix F to this order.

s. Block 19. The office symbol of the person completing this form.

t. Block 20. The date this form is completed.

C-2 8120.23B Appendix C Figure C-1. Sample FAA Form 8120-14 (Front) C-3 8120.23B Appendix C Figure C-2. Sample FAA Form 8120-14 (Back) C-4 8120.23B Appendix D Appendix D. Preparation Instructions for FAA Form 8100-6, Noncompliance Record D-1. Purpose. This appendix provides instructions for completing FAA Form 8100-6 for all audit activities.

D-2. Specific Guidance. Figure D-1 shows FAA Form 8100-6 with numbered blocks. The form will be prepared as a stand alone document. Write the noncompliance against the responsible PAH. Prepare the form by inserting in: a. Block 1. When the activity is a QSA, enter the QSA Number/Audit Number. For all other activity, enter an appropriate Audit/Report Number, as applicable.

b. Block 2. Enter the project number(s) applicable to the production approval(s) activity.

c. Block 3. Number the noncompliance sequentially beginning with the number “1.” d. Block 4. Insert a checkmark in the appropriate box to indicate the type of audit that was conducted.

e. Block 5. Under “System Element Audited,” enter the name of the quality system element in Appendix E to this order to which the noncompliance is relevant. Under “Noncompliance Code,” enter the audit noncompliance code number from Appendix E to this order. The systems elements and noncompliance codes are available in the oversight information system. Under “Process Code,” when the type of noncompliance identified in block 10 is a “Product Nonconformity,” enter the process that deviated to cause the noncompliance. The process codes are available in the oversight information system, as well as in Table 1 of the latest revision of SAE Aerospace Standard AS9131. Do not insert more than one number.

Note: More than one noncompliance may be recorded for an audit criteria number.

When an audit criteria contains several statements of condition, it is possible to find noncompliances to some or all of those conditions. When multiple statements of conditions under one criterion are affected, complete an FAA Form 8100-6 for each condition. When recording noncompliances for a common condition, complete only one FAA Form 8100-6.

f. Block 6. The controlling document is defined as the FAA-approved data or purchase order/quality requirements from a PAH. Enter the complete reference number, or, at a minimum, the document title and effective date (e.g., ABC Company Quality Manual dated March 5, 2005; XYZ QOI 326 dated June 23, 2007; or BCD Drawing No. 98253332 dated May 20, 2009). Insert a check in the “Yes” or “No” block, as appropriate, to indicate whether the controlling document is FAA-approved.

g. Purchase orders and quality requirements flowed down to a supplier by a PAH are generally not considered to be FAA approved data. In some cases, quality requirements for use at a supplier facility are specifically approved by the FAA D-1 8120.23B Appendix D before use. Determine the approval status of any referenced PAH supplier quality requirement before checking the “Yes” or “No” block.

h. Block 7. Enter the applicable 14 CFR part, section, or subsection that establishes the responsibility of the PAH (for example, § 21.316 or § 21.146(b)). If the observed condition is not directly traceable to one of these requirements, then leave the block blank. Insert the applicable 14 CFR reference for each approval type affected.

i. When a facility holds multiple production approvals, and a noncompliance is found that applies to more than one of those approvals, use the highest level quality requirement. For the purposes of this order, the quality levels, from highest to lowest, are PC, TSOA, and PMA.

j. Block 8. Insert a check mark in the appropriate box to indicate the scope of the noncompliance: a. Systemic: A noncompliance to 14 CFR, FAA approved data that is pervasive, repeated, or represents a breakdown in the quality system. A repeated noncompliance can be, but is not limited to, multiple noncompliances discovered during a single audit, or a recurring noncompliance discovered during multiple or successive audits.

b. Isolated: A noncompliance to 14 CFR, FAA approved data that is nonsystemic in nature (i.e., is not pervasive or repeated, and does not represent a breakdown in the quality system).

k. Block 9. Insert a checkmark in the appropriate box to indicate whether the origin of the noncompliance can be traced back to the PAH or the PAH’s supplier.

l. Block 10. Insert a checkmark in the appropriate box to indicate whether the noncompliance was the result of a nonconformity in a product or a noncompliance in a procedure. If the noncompliance is the result of a product nonconformity, then enter a process code in block 5 and complete blocks 13 and 14.

m. Block 11. Insert a checkmark in the “Yes” or “No” block, as appropriate, to indicate whether a noncompliance has an immediate safety impact and requires immediate corrective action.

n. Block 12. Insert a checkmark in the “Yes” or “No” block, as appropriate, to indicate whether it is a noncompliance to 14 CFR that is discovered in FAA-approved data.

o. Block 13. Enter the applicable JASC system code when the type of noncompliance identified in block 10 is a “Product Nonconformity.” The system codes are available in the oversight information system, as well as in the latest version of the Federal Aviation Administration Joint Aircraft System/Component Code Table and Definitions document.

D-2 8120.23B Appendix D p. Block 14. Enter the applicable JASC component code when the type of noncompliance identified in block 10 is a “Product Nonconformity.” The component codes are available in the oversight information system, as well as in the latest version of the Federal Aviation Administration Joint Aircraft System/Component Code Table and Definitions document.

q. Block 15. Enter the condition required by the controlling document, applicable supporting documents, or the applicable 14 CFR part or section. Use the same wording as the controlling document, the applicable supporting document, or the applicable 14 CFR part or section, whenever possible. List all documents that demonstrate the link back to the controlling document or 14 CFR.

r. Block 16. Enter a detailed explanation of the encountered condition.

(1) Explain why the encountered condition differs from the required condition.

(2) Identify where the encountered condition was found.

(3) Identify the total number of items checked and the total number of items found to be in noncompliance.

(4) List the items found to be in noncompliance, using identification numbers or other specific identifiers whenever possible.

(5) Record any evidence that the facility provided during the audit to show that corrective action was taken or initiated.

(6) When the encountered condition finds FAA approved data to be in noncompliance with an applicable 14 CFR part or section, include a note that further investigation by the assigned certification branch or CM section may be required.

(7) List all objective evidence obtained that describes the encountered condition.

s. Block 17. Enter the name of the team member who discovered the noncompliance.

t. Block 18. Enter the routing symbol of the person listed in block 17.

u. Block 19. Enter the typed or printed name and signature of the person recording the noncompliance. If the form is completed within the oversight information system, the signature is not required.

v. Block 20. Enter the routing office symbol of the person listed in block 19.

w. Block 21. Enter the date the form is completed.

D-3 8120.23B Appendix D Figure D-1. Sample FAA Form 8100-6 D-4 8120.23B Appendix E Appendix E. Standardized Noncompliance Codes for PAHs This appendix provides noncompliance codes, their associated CFR references, and quality system elements to be used when documenting noncompliances to the PAH’s FAA approved data on FAA Form 8100-6.

Note: An “N/A” in the associated CFR references column indicates not applicable.

Table E-1. Quality System Elements Section Appendix E Quality System Element No. Page No.

(a) Design data control E-2 (b) Document control E-3 (c) Supplier control E-3 (d) Manufacturing process control E-5 (e) Inspection and testing E-6 (f) Inspection, measuring, and test equipment control E-7 (g) Inspection and test status E-8 (h) Nonconforming product and article control E-8 (i) Corrective and preventative actions E-9 (j) Handling and storage E-10 (k) Control of quality records E-10 (l) Internal audits E-10 (m) In-service feedback E-11 (n) Quality escapes E-11 (o) Issuing authorized release documents E-12 (p) Other E-12 (q) Safety Management System E-15 E-1 8120.23B Appendix E Table E-2. Noncompliance Codes Note: The tables below list the compliance codes for each type of Quality System Element.

Section (a) Design Data Control Code Description of Noncompliance PC PMA TSOA The audited facility did not have written procedures for controlling design data and subsequent changes 001 § 21.137(a) § 21.307 § 21.607 to ensure that only current, correct, and approved data are used.

The audited facility did not follow procedures for 002 controlling design data or subsequent changes to ensure § 21.146(b) § 21.316(b) § 21.616 that only current, correct, and approved data are used.

The approval holder did not approve minor design 003 § 21.95 § 21.319 § 21.619 changes under a method acceptable to the FAA.

The approval holder did not submit major design § 21.97 004 § 21.319 N/A § 21.99 changes to the FAA for approval.

The approval holder did not submit appropriate design 005 changes for approval to correct unsafe conditions under § 21.99(a)(1) N/A N/A an AD.

The approval holder did not make available to a user § 21.99(a)(2) N/A N/A 006 descriptive data and information on FAA-approved design changes resulting from ADs.

The approval holder did not keep an ICA current 007 with design changes or make it available to § 21.50 N/A N/A appropriate persons, as applicable.

The approval holder did not provide the FAA all 008 required information to support changes or updates of a § 21.50 N/A N/A commercial parts list in the ICA.

The audited facility did not follow approved procedures to coordinate and obtain approval from authorized 009 § 21.146(b) § 21.316(b) § 21.616(b) personnel, including engineering, for a service bulletin or maintenance manual.

The audited facility did not follow approved procedures to include a manufacturing, quality, or service/support § 21.146(b) § 21.316(b) § 21.616(b) organization in the review of design and technical data changes.

Electronically stored or transmitted technical design or § 21.146(b) § 21.316(b) § 21.616(b) 011 quality data were not adequately controlled or distributed to a supplier.

E-2 8120.23B Appendix E Section (b) Document Control Code PC PMA TSOA Description of Noncompliance The audited facility did not have written procedures for controlling quality system documents and subsequent 012 § 21.137(b) § 21. 307 § 21.607 changes to ensure that only current, correct, and approved data are used.

The audited facility did not follow procedures for controlling quality system documents or subsequent § 21.146(b) § 21.316(b) § 21.616(b) changes to ensure that only current, correct, and approved data are used.

The audited facility did not properly establish, maintain, or 014 § 21.137(b) § 21.307 § 21.607 control a test procedure or subsequent change.

Section (c) Supplier Control Code Description of Noncompliance PC PMA TSOA The audited facility did not have approved written 015 procedures to ensure that each supplier-furnished product, § 21.137(c)(1) § 21.307 § 21.607 article, or service conforms to the PAH’s requirements.

The audited facility did not follow approved written 016 procedures to ensure that each supplier-furnished product, § 21.146(b) § 21.316(b) § 21.616(b) article, or service conforms to the PAH’s requirements.

The audited facility did not conduct a receiving inspection § 21.146(b) § 21.316(b) § 21.616(b) 017 of a supplied article or service to verify conformity to the PAH’s requirements.

The audited facility did not verify that specification 018 requirements were met for a purchased product or material § 21.146(b) § 21.316(b) § 21.616(b) with a shelf-life.

The audited facility did not follow approved procedures to 019 flow-down applicable technical and quality requirements to § 21.146(b) § 21.316(b) § 21.616(b) a domestic or international supplier.

The audited facility did not follow procedures for design 020 § 21.146(b) § 21.316(b) § 21.616(b) data control with its supplier, including changes.

The PAH did not have written procedures to require suppliers of any level to report quality escapes to their next § 21.137(c)(2) § 21.307 § 21.607 level, and/or did not have written procedures to require first-level suppliers to report quality escapes to the PAH.

The PAH did not follow the approved supplier-reporting § 21.146(b) § 21.316(b) § 21.616 022 process and/or procedures which require a supplier to report quality escapes to the next level or PAH.

A supplier did not follow PAH procedures to report a 023 § 21.146(b) § 21.316(b) § 21.616(b) quality escape to the PAH.

E-3 8120.23B Appendix E Section (c) Supplier Control Code PC PMA TSOA Description of Noncompliance The PAH did not follow approved procedures to take 024 corrective action in response to a report of a quality escape § 21.146(b) § 21.316(b) § 21.616(b) from a supplier.

The audited facility did not follow approved procedures for 025 § 21.146(b) § 21.316(b) § 21.616(b) using only approved suppliers.

The audited facility did not follow approved procedures in 026 conducting a required supplier evaluation or in taking § 21.146(b) § 21.316(b) § 21.616(b) necessary corrective actions related to that evaluation.

The PAH did not approve a supplier's quality manual as 027 § 21.146(b) § 21.316(b) § 21.616(b) required by approved procedures.

The PAH uses other parties to perform supplier § 21.135(a) § 21.305(a) § 21.605(a) 028 surveillance or assessments on its behalf but does not have procedures for using these other parties.

The PAH uses other parties to perform supplier 029 surveillance or assessments on its behalf but does not § 21.146(b) § 21.316(b) § 21.616(b) follow procedures for using these other parties.

The audited facility did not follow approved procedures for requiring suppliers to notify the audited facility in writing § 21.146(b) § 21.316(b) § 21.616(b) 030 of significant facility or organizational changes such as changes in company name, company location, or senior quality management.

The PAH did not control a supplier with direct shipment 031 authority to ensure that only conforming parts were § 21.146(b) § 21.316(b) § 21.616(b) released.

The audited facility did not follow approved procedures to 032 require approved suppliers to have a supplier control § 21.146(b) § 21.316(b) § 21.616(b) program in place for their suppliers.

The quality organization of the audited facility did not § 21.146(b) § 21.316(b) § 21.616(b) 033 follow approved procedures in reviewing a purchase document before issuance.

The audited facility did not follow approved procedures to require suppliers to have a program to ensure the proper § 21.146(b) § 21.316(b) § 21.616(b) operation of manufacturing software or inspection/test equipment.

The PAH did not follow approved procedures for notifying § 21.146(b) § 21.316(b) § 21.616(b) 035 the FAA of a new supplier in another country or receipt of a first article produced by that supplier.

The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) 036 preparing an interface quality document for consortium manufacturing activities.

E-4 8120.23B Appendix E Section (d) Manufaturing Process Control Code PC PMA TSOA Description of Noncompliance 037 Reserved.

The audited facility did not have written procedures for 038 § 21.137(d) § 21.307 § 21.607 controlling manufacturing processes.

The audited facility did not follow an approved 039 § 21.146(b) § 21.316(b) § 21.616 manufacturing process, procedure, or instruction.

The audited facility did not generate or maintain a record to § 21.146(b) § 21.316(b) § 21.616 040 reflect compliance with an approved procedure, process, or instruction.

The audited facility did not follow approved procedures to 041 use an environmental control in a manufacturing or § 21.146(b) § 21.316(b) § 21.616(b) assembly area.

The audited facility did not identify or control an § 21.146(b) § 21.316(b) § 21.616(b) age-sensitive product, article, or material.

The audited facility did not segregate a material or article 043 § 21.146(b) § 21.316(b) § 21.616(b) awaiting acceptance.

The audited facility did not identify a traceable component 044 § 21.146(b) § 21.316(b) § 21.616(b) in assembly records.

The audited facility did not provide or maintain traceability 045 § 21.146(b) § 21.316(b) § 21.616(b) of a completed article to raw materials.

The audited facility did not provide traceability or § 21.146(b) § 21.316(b) § 21.616(b) 046 accountability for the completion of all manufacturing and inspection operations for a split lot.

The audited facility did not provide controls for an article 047 § 21.146(b) § 21.316(b) § 21.616(b) introduced into production before full acceptance.

The audited facility did not follow approved procedures for 048 segregating or identifying products or articles in a storage § 21.146(b) § 21.316(b) § 21.616(b) or manufacturing area.

The audited facility did not control a product or article from 049 § 21. 146(b) § 21.316(b) § 21.616(b) an associate facility.

The audited facility did not follow approved procedures for 050 using a properly qualified/approved special process § 21.146(b) § 21.316(b) § 21.616(b) operator.

The audited facility did not follow approved procedures in establishing a statistical sampling plan for acceptance of 051 § 21.146(b) § 21.316(b) § 21.616(b) product characteristics at receiving inspection or during manufacture.

The audited facility did not follow approved procedures by 052 excluding engineering and manufacturing organizations § 21.146(b) § 21.316(b) § 21.616(b) from the statistical quality control (SQC) program.

E-5 8120.23B Appendix E Section (d) Manufaturing Process Control Code PC PMA TSOA Description of Noncompliance The audited facility did not follow approved procedures in 053 establishing a statistical process control (SPC) method for § 21.146(b) § 21.316(b) § 21.616(b) acceptance of specific product characteristics.

The audited facility did not follow approved procedures in § 21.146(b) § 21.316(b) § 21.616(b) 054 using or maintaining appropriate SPC control limits or subgroup selection.

The audited facility did not follow approved procedures in 055 establishing a satisfactory PRE-control method for the § 21.146(b) § 21.316(b) § 21.616(b) acceptance of specific product characteristics.

The audited facility did not follow approved procedures for 056 § 21.146(b) § 21.316(b) § 21.616(b) training personnel in statistical techniques.

The audited facility did not follow approved procedures to 057 retest a product or article that had been adjusted or § 21.146(b) § 21.316(b) § 21.616(b) reworked after test acceptance.

Section (e) Inspection and Testing Code Description of Noncompliance PC PMA TSOA An audited facility did not have a written procedure for 058 inspection or test to ensure a product or article conforms to § 21.137(e) § 21.307 § 21.607 its approved design.

An audited facility did not follow a procedure for 059 inspection and test to ensure a product or article conforms § 21.146(b) § 21.316(b) § 21.616(b) to its approved design.

The audited facility used an inspection method which did 060 not ensure a product or article conforms to FAA-approved § 21.146(b) § 21.316(b) § 21.616(b) design data.

The audited facility did not follow approved procedures § 21.146(b) § 21.316(b) § 21.616(b) 061 to ensure proper control of inspection marking devices/stamps.

The audited facility did not follow approved procedures 062 to issue inspection marking devices/stamps to authorized § 21.146(b) § 21.316(b) § 21.616(b) persons only.

The audited facility does not have approved procedures 063 to ensure records are generated and maintained for § 21.137(e)(2) N/A N/A completed tests of aircraft, engines, or propellers.

Applicable procedures or process specifications were not § 21.146(b) § 21.316(b) § 21.616(b) readily available to or used by inspection personnel.

NDI processes, including changes, were not properly 065 documented, controlled, or reviewed for conformance with § 21.146(b) § 21.316(b) § 21.616(b) FAA-approved design data.

E-6 8120.23B Appendix E Section (e) Inspection and Testing Code PC PMA TSOA Description of Noncompliance Critical NDI process parameters were not identified § 21.146(b) § 21.316(b) § 21.616(b) or controlled.

Flight test procedures or changes were not submitted to and § 21.146(b) N/A N/A approved by the FAA.

The audited facility did not follow approved procedures in 068 qualifying a test pilot or in using a flight test pilot without § 21.146(b) N/A N/A proper qualifications.

The audited facility did not follow approved procedures in 069 ensuring an NDI operator was performing within the limits § 21.146(b) § 21.316(b) § 21.616(b) of their authorization/certification.

The audited facility uses NDI to make conformity § 21.146(b) § 21.316(b) § 21.616(b) 070 determinations, but its procedures do not address NDI acceptance and rejection criteria.

The audited facility did not follow approved procedures for 071 § 21.146(b) § 21.316(b) § 21.616(b) identifying an NDI test piece or known defect sample.

The audited facility did not follow approved procedures 072 to check NDI tanks or solutions for compliance § 21.146(b) § 21.316(b) § 21.616(b) with specifications.

Section (f) Inspection and Test Status Code Description of Noncompliance PC PMA TSOA The audited facility did not have a procedure for inspection, measuring, and test equipment control to ensure 073 calibration and control of all inspection, measuring, and test § 21.137(f) § 21.307 § 21.607 equipment used in determining conformity of a product or article to its approved design.

The audited facility did not follow a procedure for inspection, measuring, and test equipment control to ensure 074 calibration and control of all inspection, measuring, and test § 21.146(b) § 21.316(b) § 21.616(b) equipment used in determining conformity of a product or article to its approved design.

Equipment required for special processing is not available 075 § 21.146(b) § 21.316(b) § 21.616(b) or calibrated as necessary.

A tool, gauge, or equipment was not initially approved, 076 § 21.146(b) § 21.316(b) § 21.616(b) periodically inspected, or calibrated.

A calibration standard did not have adequate accuracy or § 21.146(b) § 21.316(b) § 21.616(b) was not traceable to a standard acceptable to the FAA.

A tool, gauge, or equipment was not protected, maintained, 078 or used in an acceptable environment to ensure product § 21.146(b) § 21.316(b) § 21.616(b) conformity.

E-7 8120.23B Appendix E Section (f) Inspection and Test Status Code PC PMA TSOA Description of Noncompliance The audited facility did not properly control § 21.146(b) § 21.316(b) § 21.616(b) NDI equipment.

Section (g) Inspection and Test Status Code Description of Noncompliance PC PMA TSOA The audited facility did not have a procedure for 080 documenting the inspection and test status of products and § 21.137(g) § 21.307 § 21.607 articles supplied or manufactured to the approved design.

The audited facility did not follow a procedure for 081 documenting the inspection or test status of a product or § 21.146(b) § 21.316(b) § 21.616(b) article manufactured to the approved design.

The flight check-off form was not properly completed for § 21.146(b) N/A N/A an aircraft flight test.

Section (h) Nonconforming Product and Article Control Code Description of Noncompliance PC PMA TSOA The audited facility did not have a procedure for the identification, documentation, evaluation, segregation, and § 21.137(h) § 21.307 § 21.607 disposition by authorized individuals of nonconforming products and articles.

The audited facility did not follow a procedure for the identification, documentation, evaluation, segregation, and 084 § 21.146(b) § 21.316(b) § 21.616(b) disposition by authorized individuals of nonconforming products and articles.

The audited facility did not have a procedure to ensure § 21.137(h) § 21.316(b) § 21.616(b) discarded articles are rendered unusable.

The audited facility did not follow a procedure to ensure 086 § 21.146(b) § 21.316(b) § 21.616(b) discarded articles are rendered unusable.

An unauthorized person dispositioned a nonconforming 087 § 21.146(b) § 21.316(b) § 21.616(b) product or article.

A nonconforming product or article was not properly 088 identified, documented, evaluated, segregated, § 21.146(b) § 21.316(b) § 21.616(b) or dispositioned.

§ 21.146(b) § 21.316(b) § 21.616(b) 089 A nonconforming product or article was placed in storage.

A disposition determination for a nonconforming product or article resulted in a major design change 090 § 21.146(b) § 21.316(b) § 21.616(b) that was not approved by the FAA through its design approval process.

E-8 8120.23B Appendix E Section (h) Nonconforming Product and Article Control Code PC PMA TSOA Description of Noncompliance Upper management did not follow approved procedures for 091 reviewing and analyzing nonconforming material data to § 21.146(b) § 21.316(b) § 21.616(b) detect adverse trends.

Engineering did not follow approved procedures for reviewing nonconforming material to determine if a 092 § 21.146(b) § 21.316(b) § 21.616(b) nonconformance constituted a major or minor change to approved design.

Section (i) Corrective and Preventative Actions Code Description of Noncompliance PC PMA TSOA The audited facility does not have written procedures for implementing corrective and preventative actions to 093 § 21.137(i) § 21.307 § 21.607 eliminate the causes of an actual or potential nonconformity or noncompliance.

The audited facility did not follow procedures for implementing corrective and preventative actions to 094 § 21.146(b) § 21.316(b) § 21.616(b) eliminate the causes of an actual or potential nonconformity or noncompliance.

The audited facility does not monitor corrective actions for 095 § 21.146(b) § 21.316(b) § 21.616(b) response, implementation, and effectiveness.

The audited facility did not take corrective action after 096 § 21.146(b) § 21.316(b) § 21.616(b) finding an out-of-control NDI process.

The audited facility did not evaluate the need for corrective 097 action after accepting a product or article with a § 21.146(b) § 21.316(b) § 21.616(b) significantly out-of-tolerance gauge.

The audited facility did not take corrective action to correct 098 a manufacturing/special process which was found to be out § 21.146(b) § 21.316(b) § 21.616(b) of control.

Section (j) Handling and Storage Code Description of Noncompliance PC PMA TSOA The audited facility did not have a procedure to prevent 099 damage and deterioration of each product and article during § 21.137(j) § 21.307 § 21.607 handling, storage, preservation, and packaging.

The audited facility did not follow a procedure to prevent 100 the damage or deterioration of a product or article during § 21.146(b) § 21.316(b) § 21.616(b) handling, storage, preservation, or packaging.

The audited facility did not control removal or issuance of 101 § 21.146(b) § 21.316(b) § 21.616(b) a product or article from storage.

E-9 8120.23B Appendix E Section (j) Handling and Storage Code PC PMA TSOA Description of Noncompliance The audited facility did not adequately identify or control a 102 cleaner, solvent, degreaser, etc., to prevent potential § 21.146(b) § 21.316(b) § 21.616(b) product damage from misapplication.

Section (k) Control of Qualtiy Records Code PC PMA TSOA Description of Noncompliance The audited facility did not have a written procedure 103 for identifying, storing, protecting, and retrieving § 21.137(k) § 21.307 § 21.607 quality records.

The audited facility did not have a written procedure for the retention of quality records for at least 5 years for 104 § 21.137(k) § 21.307 § 21.607 products/articles manufactured under its approval and 10 years for critical components pursuant to § 45.15(c).

The audited facility did not follow a procedure for 105 identifying, storing, protecting, retaining, or retrieving § 21.146(b) § 21.316(b) § 21.616(b) quality records.

Section (I) Internal Audits Code Description of Noncompliance PC PMA TSOA The audited facility did not have written procedures for 106 planning, conducting, and documenting internal audits to § 21.137(l) § 21.307 § 21.607 ensure compliance with the approved quality system.

The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) planning, conducting, or documenting internal audits.

The audited facility did not have written procedures to report results of an internal audit to the manager 108 § 21.137(l) § 21.307 § 21.607 responsible for implementing corrective and preventative actions.

The audited facility did not follow a procedure to report § 21.146(b) § 21.316(b) § 21.616(b) 109 results of an internal audit to the manager responsible for implementing corrective and preventative actions.

Section (m) In-Service Feedback Code Description of Noncompliance PC PMA TSOA The audited facility does not have an approved procedure § 21.137(m) § 21.307 § 21.607 110 for receiving and processing feedback on in-service failures, malfunctions, and defects.

E-10 8120.23B Appendix E Section (m) In-Service Feedback Code PC PMA TSOA Description of Noncompliance The audited facility did not follow approved procedures for 111 receiving and processing feedback on in-service failures, § 21.146(b) § 21.316(b) § 21.616(b) malfunctions, and defects.

The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) 112 informing a user of its product/article with service information, including field purges.

Section (n) Quality Escapes Code Description of Noncompliance PC PMA TSOA The audited facility does not have an approved procedure § 21.137(n) § 21.307 § 21.607 113 for identifying, analyzing, and initiating appropriate corrective action for quality escapes.

The audited facility is not following approved procedures § 21.146(b) § 21.316(b) § 21.616(b) 114 for identifying, analyzing, and initiating appropriate corrective action for quality escapes.

Approved procedures do not provide a method to notify users and recall products, when necessary, when § 21.146(b) § 21.316(b) § 21.616(b) nonconformances are suspected or known to exist in products in service.

A nonconforming product or article was released from the 116 § 21.146(c) § 21.316(c) § 21.616(c) quality system.

A required design change was not incorporated into a § 21.146(b) § 21.316(b) § 21.616(b) 117 product or article before its release for installation/shipment.

Section (o) Issuing Authorized Release Documents Code PC PMA TSOA Description of Noncompliance The PAH has issued authorized release documents that § 21.137(o) § 21.307 § 21.607 were not in accordance with approved written procedures.

The PAH is issuing authorized release documents outside § 21.146(b) § 21.316(b) § 21.616(b) of the scope of its approved procedures.

Section (p) Other Code Description of Noncompliance PC PMA TSOA The PAH did not report a failure, malfunction, or defect 120 § 21.3 § 21.3 § 21.3 pursuant to § 21.3.

E-11 8120.23B Appendix E Section (p) Other Code PC PMA TSOA Description of Noncompliance The PAH did not comply with the § 21.3(f) requirements related to investigation of and corrective action for 121 § 21.3(f) § 21.3(f) § 21.3(f) products or articles deemed unsafe due to a manufacturing or design data defect.

The PAH has not provided the FAA a document describing 122 how its organization will ensure compliance pursuant to § 21.135 § 21.305 § 21.605 subpart G, K, or O as applicable.

The PAH did not amend the organization document 123 required pursuant to § 21.135 to reflect changes in the § 21.146(a) § 21.316(a) § 21.616(a) organization or provide these amendments to the FAA.

The PAH has not provided the FAA with a quality manual 124 § 21.138 § 21.308 § 21.608 which describes its quality system.

The quality manual was not prepared in the English 125 language or is not retrievable in a form acceptable § 21.138 § 21.308 § 21.608 to the FAA.

The quality manual has not been maintained to reflect 126 § 21.146(b) § 21.316(b) § 21.616(b) changes in the quality system.

The PAH did not obtain FAA approval before § 21.139(b) § 21.309(b) § 21.609(b) 127 making a change to the location of one of its manufacturing facilities.

The PAH did not immediately notify the FAA in writing of a change to the manufacturing facility that affects the 128 § 21.139(c) § 21.309(c) § 21.609(c) inspection, conformity, or airworthiness of its product or article.

The audited facility is not operating within the limitations § 21.146(b) §21.316(c) § 21.616(c) of its production approval.

A Software Configuration Management Plan did not meet § 21.146(b) § 21.316(b) § 21.616(b) approved requirements.

A Configuration Index Document did not meet § 21.146(b) § 21.316(b) § 21.616(b) approved requirements.

The audited facility did not follow approved procedures for 132 § 21.146(b) § 21.316(b) § 21.616(b) software problem reporting and tracking.

The audited facility did not follow approved procedures for 133 § 21.146(b) § 21.316(b) § 21.616(b) recalling/purging obsolete software.

The audited facility did not follow approved procedures for 134 § 21.146(b) § 21.316(b) § 21.616(b) software security.

A Software Development Environment did not meet 135 § 21.146(b) § 21.316(b) § 21.616(b) approved requirements.

The audited facility did not follow approved procedures for 136 § 21.146(b) § 21.316(b) § 21.616(b) software identification.

E-12 8120.23B Appendix E Section (p) Other Code PC PMA TSOA Description of Noncompliance The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) programmed media handling/storage.

The audited facility did not meet approved requirements for § 21.146(b) § 21.316(b) § 21.616(b) establishing build and load instructions.

139 n/a n/a n/a n/a The audited facility did not follow approved procedures for 140 § 21.146(b) § 21.316(b) § 21.616(b) documenting and approving changes.

The audited facility did not follow approved procedures for 141 § 21.146(b) § 21.316(b) § 21.616(b) software problem reporting.

The audited facility did not meet approved requirements for 142 § 21.146(b) § 21.316(b) § 21.616(b) software security.

The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) verifying software before use.

The audited facility did not follow approved procedures for § 21.146(b) § 21.316(b) § 21.616(b) build and load instructions.

A completed product or article did not have proper § 21.146(d) § 21.316(d) § 21.616(d) § 45.11 § 45.15 § 45.15 identification markings.

An aircraft was not properly identified with nationality and § 21.146(d) 146 N/A N/A § 45.21 registration marks before airworthiness certification.

The PAH did not identify a portion of a product or article that left the manufacturer's facility as FAA-approved with § 21.146(e) 147 the manufacturer’s part number and name, trademark, § 21.316(e) § 21.616(e) § 21.137 symbol, or other FAA-approved manufacturer’s identification.

The PAH did not have access to design data necessary to 148 determine conformity for each product or article produced § 21.146(f) § 21.316(f) § 21.616(f) under its production approval.

The production approval/authorization is not available § 21.146(g) § 21.316(g) § 21.616(g) at the facility.

The evaluated facility did not make information regarding 150 all delegation of authority to suppliers available to the § 21.146(h) § 21.316(h) § 21.616(h) FAA.

The PAH did not follow approved procedures in notifying § 21.146(b) § 21.316(b) § 21.616(b) the FAA of suppliers with direct shipment authority.

The PAH did not notify the FAA of a change to its quality 152 system that affected the inspection, conformity, or § 21.150 § 21.320 § 21.620 airworthiness of its product or article.

A completed aircraft was not registered before § 47.3 153 N/A N/A § 21.173 airworthiness certification.

The applicable airworthiness certificate or special flight Part 21 N/A N/A Subparts H, I permit was not obtained for an aircraft.

E-13 8120.23B Appendix E Section (p) Other Code PC PMA TSOA Description of Noncompliance A flight manual, supplement, or current weight and balance § 21.5 N/A N/A information was not furnished with an aircraft.

An unauthorized person issued an airworthiness approval § 21.329 § 21.331 § 21.331 § 21.331 (FAA Form 8130-4 or 8130-3).

An export airworthiness approval was issued, but the necessary documents and instructions have not been 157 § 21.335(a) § 21.335(a) § 21.335(a) forwarded to the aviation authority of the importing country as specified in AC 21-2.

A registration or airworthiness certificate was not cancelled § 21.335 N/A N/A 158 for an aircraft whose title has passed to an importing country.

The audited facility did not follow approved procedures for 159 obtaining an export airworthiness approval for a § 21.146(b) § 21.316(b) § 21.616(b) product/article that left the PAH's quality system.

The PAH does not have procedures that establish and identify a single point of contact or accountable manager 160 § 21.135 § 21.305 § 21.605 for maintaining the organization’s FAA-approved production operations.

The PAH did not follow procedures that empower or 161 authorize the point of contact to exercise their established § 21.146(b) § 21.316(b) § 21.616(b) authority pursuant to part 21.

The PAH was manufacturing and installing an interface 162 component that was not identified on the production § 21.146(b) § 21.316(b) § 21.616(b) limitation record (PLR).

Section (q) Safety Management System Code Description of Noncompliance PC PMA TSOA The PAH has not maintained the organizational system 163 § 5.17 N/A N/A description.

The PAH accountable executive has not regularly § 5.21(d), 164 reviewed the safety policy to ensure it remains relevant § 5.25(b)(4 N/A N/A and appropriate. ) The PAH accountable executive has not regularly § 165 reviewed the safety performance and directed actions to 5.25(b)(5) N/A N/A address substandard safety performance.

The PAH has not performed safety risk management 166 § 5.51(a) N/A N/A when implementing new systems.

The PAH has not performed safety risk management 167 § 5.51(b) N/A N/A when revising existing systems.

The PAH has not performed safety risk management 168 § 5.51(c) N/A N/A when developing operational procedures.

E-14 8120.23B Appendix E Section (q) Safety Management System Code Description of Noncompliance PC PMA TSOA The PAH has not performed safety risk management § 5.51(d) 169 when hazards or ineffective risk controls were identified N/A N/A through safety assurance.

The PAH has not followed its processes when applying § 5.53, 170 N/A N/A safety risk management. § 5.55 The PAH has not maintained its safety risk management § 5.53, 171 N/A N/A processes. § 5.55 The PAH has not maintained records of hazard § 5.57, 172 notifications that have been provided over the past 24 N/A N/A § 5.97(d) months.

The PAH has not followed its processes to acquire data to 173 N/A N/A monitor the safety performance of the organization. § 5.71(a) The PAH has not followed its processes to analyze the 174 data acquired under § 5.71(a) to monitor the safety § 5.71(b) N/A N/A performance of the organization.

The PAH has not submitted a summary of confidential employee reports received under § 5.71(a)(7) to the Administrator every six months.

175 § 5.71(c) N/A N/A Note: § 5.71(c) only applies to PC holders that also hold the TC for the same product.

The PAH has not maintained its safety assurance 176 § 5.71 N/A N/A processes.

The PAH has not conducted assessments of its safety § 177 performance against its safety objectives to ensure N/A N/A 5.73(a)(1) compliance with safety risk controls.

The PAH has not conducted assessments of its safety § 178 performance against its safety objectives to evaluate the 5.73(a)(2) N/A N/A performance of the SMS.

The PAH has not conducted assessments of its safety performance against its safety objectives to evaluate the § 179 N/A N/A effectiveness of safety risk controls and identify 5.73(a)(3) ineffective controls.

The PAH has not conducted assessments of its safety § performance against its safety objectives to identify 180 5.73(a)(4) N/A N/A changes in the operational environment that may introduce new hazards.

The PAH has not conducted assessments of its safety § 5.73(a)(5 181 performance against its safety objectives to identify new N/A N/A ) hazards.

The PAH has not performed safety risk management when 182 § 5.73(b) N/A N/A ineffective controls or new hazards were identified.

The PAH has not followed its processes to correct safety 183 performance deficiencies identified in the assessments § 5.75 N/A N/A conducted under § 5.73.

E-15 8120.23B Appendix E Section (q) Safety Management System Code Description of Noncompliance PC PMA TSOA The PAH has not provided training to individuals identified in § 5.23 to attain and maintain the 184 § 5.91 N/A N/A competencies necessary to perform their duties relevant to the operation and performance of the SMS.

The PAH has not communicated safety information that 185 ensures employees are aware of SMS policies, processes, § 5.93(a) N/A N/A and tools.

The PAH has not communicated safety information that 186 conveys hazard information relevant to employee’s § 5.93(b) N/A N/A responsibilities.

The PAH has not communicated safety information that 187 § 5.93(c) N/A N/A explains why safety actions have been taken.

The PAH has not communicated safety information that 188 § 5.93(d) N/A N/A explains why safety procedures are introduced or changed.

The PAH has not maintained their Safety Management § 5.5(b) & System in accordance with established procedures. § 5.11(f) 189 & N/A N/A § 5.13(b) (6) The PAH has not implemented a Safety Management 190 § 5.1 N/A N/A System E-16 8120.23B Appendix F Appendix F. QSA Auditor Appointment and Training F-1. General. The appointing officials designated in paragraph 2 of this appendix will select QSA auditor candidates who have attained a specified level of experience or a combination of experience and education, as engineers, flight test pilots, or aviation safety inspectors (ASI), and who have demonstrated technical knowledge and skills. A candidate will receive QSA training and serve as an auditor in training during QSAs under the direct supervision of an appointed QSA team leader before appointment as a QSA team member. Before appointment, a candidate for auditor team leader will have participated in QSAs as an appointed team member and will perform as a team leader in training under the direct supervision of an appointed QSA team leader.

F-2. Appointing Officials. The following division managers or their delegated office focal(s) are authorized to select QSA auditor candidates and to appoint qualified candidates as QSA team members or team leaders within their respective organizations: a. Assigned certification branch managers, b. CM branch and CM section managers, and c. Division managers.

F-3. Criteria for Candidate Selection. The appointing official will select engineering, flight test, or ASI candidates on the basis of the following criteria (refer to figure F-1 of this appendix): a. Candidates have attained at least one of the following specified levels of experience or a combination of experience and education in their specific disciplines: (1) At least 8 years of technical experience in aerospace manufacturing or design, or in the audit thereof; (2) A technical or trade school certificate with 6 years of technical experience in aerospace manufacturing or design, or in the audit thereof; (3) An associate’s degree in engineering or science disciplines, with 5 years of technical experience in aerospace manufacturing or design, or in the audit thereof; or (4) A bachelor’s degree or higher in engineering or science disciplines, with 3 years of technical experience in aerospace manufacturing or design, or in the audit thereof.

F-1 8120.23B Appendix F b. Candidates have demonstrated— (1) Technical knowledge in aerospace manufacturing or design and understanding of FAA goals and objectives, and (2) Effective oral, written, communication, and interpersonal skills.

Figure F-1. Criteria for Candidate Selection and Team Member Appointment F-2 8120.23B Appendix F F-4. Criteria for Appointment. Appointment is the formal process of certifying a QSA candidate as a QSA team member or team leader on the basis of successful completion of all requirements (refer to figures F-1 and F-2 of this appendix).

a. Team Member. Candidates must meet the following minimum requirements before appointment as a team member (refer to figure F-1 of this appendix): (1) Satisfactory completion of the QSA training course and associated written examination. The course will provide training in the policy established in this order, including the techniques for applying the standardized noncompliance codes contained in Appendix E to this order and in coordinating team member involvement.

Note: The AIR Enterprise Business Operations Division (AIR-900) will ensure classes are scheduled in accordance with AIR priorities as identified in the annual call for training.

(2) Participation of the candidate, and demonstration of the knowledge and skills acquired during QSA team training, in at least two QSAs as an auditor-in-training.

Note: The candidate’s appointing official must schedule the candidate’s participation as an auditor-in-training to be completed in as short a timeframe as possible to maximize the candidate’s use and retention of acquired knowledge and experience.

(3) The team member candidate’s appointing official is responsible for performing the following in considering the qualifications of the candidate as a team member: a. Consider the candidate’s previous experience and education.

b. Consider the product complexity, facility size, and complexity of quality system elements audited in QSAs in which the candidate participated.

(refer to Appendix E to this order for information on quality system elements).

c. Discuss with team leaders audits in which the candidate participated to determine the candidate’s QSA readiness.

d. Review QSA reports for audits in which the candidate participated.

e. Review, when necessary, stakeholder feedback for audits in which the candidate participated.

f. Interview the candidate.

g. Discuss with the candidate any weaknesses or deficiencies in their audit readiness identified during the participation phase. Both parties will work to reduce or eliminate these weaknesses or deficiencies through additional training, additional QSAs, Air Transportation Oversight System/Air Carrier Evaluation Program audits, or other similar activities that will increase the candidate’s audit readiness.

(4) On the basis of satisfactory results of the audit of the candidate as listed in paragraph 4.3(a) of this appendix, the candidate’s appointing official will appoint the candidate as a team member and add the individual to the oversight information system.

F-3 8120.23B Appendix F b. Team Leader. Candidates must meet the following minimum requirements before appointment as a team leader (refer to figure F-2 of this appendix): (1) Current appointment as a QSA team member.

(2) Ability to mentor and instruct team members.

(3) Participation in at least three audits as an appointed QSA team member. The candidate’s appointing official may request reduction of the requirement by providing documented justification to the appointing official’s manager. The responsibility for requesting any reduction of the requirement rests solely with the candidate’s appointing official.

(4) Participation as a team leader-in-training, and demonstration of knowledge and skills acquired during QSA team training in at least three QSAs under the direct supervision of an appointed QSA team leader. The candidate’s appointing official may request reduction of the requirement by providing documented justification to the appointing official’s manager. The responsibility for requesting any reduction of the requirement rests solely with the candidate’s appointing official.

Note: The candidate’s appointing official must schedule the candidate’s participation as a team leader-in-training to be completed in as short a timeframe as possible to maximize the candidate’s use and retention of acquired knowledge and experience.

(5) The candidate’s appointing official is responsible for performing the following activities in considering the qualifications of the candidate as a team leader: a) Consider the candidate’s previous experience and education.

b) Consider the product complexity, facility size, and complexity of quality system elements audited in QSAs in which the candidate participated (refer to Appendix E to this order for information on quality system elements).

c) Discuss with team leaders the audits in which the candidate participated to determine the candidate’s team leadership abilities.

d) Review QSA reports for audits in which the candidate participated.

e) Review, when necessary, stakeholder feedback for audits in which the candidate participated.

f) Interview the candidate.

g) Discuss with the candidate any weaknesses or deficiencies in their team leadership abilities identified during the participation phase. Both parties will work to reduce or eliminate these weaknesses or deficiencies through additional training, additional QSAs, Air Transportation Oversight System/Air Carrier Evaluation Program audits, or other similar activities that will increase the candidate’s leadership abilities.

F-4 8120.23B Appendix F (6) On the basis of satisfactory results of the audit of the candidate as listed in paragraph 4b(5) of this appendix, the candidate’s appointing official will appoint the candidate as a team leader and update the oversight information system.

c. Appointing Official Responsibilities. The candidate’s appointing official will document and track the completion of the requirements in paragraphs 4a and 4b of this appendix for all QSA candidates. Upon successful completion of the requirements, the appointing official will appoint the candidate as a QSA team leader or team member and will formally notify the candidate of their appointment through issuance of a formal acknowledgement letter generated in the oversight information system. The letter will include the individual’s discipline and office identification.

Note: Provide notification of appointment before the auditor’s first scheduled QSA as a team member or team leader.

F-5 8120.23B Appendix F Figure F-2. Criteria for Team Leader Appointment F-6 8120.23B Appendix F F-5. Review of Appointment. The cognizant appointing official reviews the participation in QSAs by each auditor under their appointment authority, notifies auditors in writing of decisions not to continue their appointment, and determines the currency and continued validity of appointments as follows: a. QSA Team Members. Review QSA team members’ participation annually. Ensure team members have accomplished the following requirements, as a minimum: (1) Participated as a QSA team member or QSA team leader, or QSA Principal Auditor, or conducted a Preliminary Certificate Management (PCM) audit, PI audit, or SCA at an interval of once or more every 2 fiscal years. For PCM audits, refer to FAA Order 8120.22, Production Approval Procedures.

(2) Demonstrated knowledge and skill in QSAs, as determined from sources such as the QSA report, team leaders, cognizant managers, and satisfactory corrective action for any shortcomings in knowledge or skills noted and discussed with the team member during the interim period.

b. QSA Team Leaders. Review QSA team leaders’ participation annually. Ensure team leaders have accomplished the following requirements, at a minimum: (1) Participated as a QSA team leader or QSA Principal Auditor, or conducted a PCM audit, PI audit, or SCA at an interval of once or more every 2 fiscal years. For PCM audits, refer to FAA Order 8120.22.

(2) Demonstrated knowledge and skill in QSAs, as determined from sources such as the QSA report, cognizant managers, and satisfactory corrective action for any shortcomings in knowledge or skills noted and discussed with the team leader during the interim period F-6. Reinstatement of Auditors Failing to Meet Appointment Review Criteria. Under their appointment authority, appointing officials may reinstate auditors who have not met the appointment review criteria listed in paragraph 4 of this appendix. Use the following criteria to determine eligibility for reinstatement: a. Team members and leaders who have not met participation requirements may be reinstated after acceptable participation as an auditor in training or as a team leader in training, as applicable, in two QSAs.

b. Team members who have not demonstrated QSA knowledge or skills may be considered for reinstatement by repeating the formal QSA team member appointment program listed in paragraph 4a of this appendix.

c. Team leaders who have not demonstrated QSA knowledge or skills may be reinstated as a team member after acceptable participation as an auditor in training in two QSAs. Consideration for reinstatement as a team leader must then follow the formal QSA team leader appointment program listed in paragraph 4b of this appendix.

F-7 8120.23B Appendix G Appendix G. Preparation of the QSA Notification Letter to a PAH G-1. Purpose. This appendix provides instructions and sample paragraphs for preparing a notification letter to a PAH for a scheduled audit.

G-2. Information to Include in the Notification Letter. Figure G-1 provides sample paragraphs with the minimum information to include in a notification letter to a PAH.

Additional paragraphs may be added as necessary to provide specific division information.

a. First Paragraph. The first paragraph is introductory and serves to establish the regulatory basis for the audit and to identify the facility and type of approval being audited. This paragraph applies to all approval types.

b. Second Paragraph. The second paragraph identifies the dates of the audit and provides a general outline of the functions to be audited.

c. Third Paragraph. The third paragraph identifies the approximate number of auditors who will be participating in the audit and the team leader or principal auditor, as applicable.

d. Fourth Paragraph. The fourth paragraph requests appropriate senior management attendance at pre-audit and post-audit conferences, as well as attendance by cognizant technical and supervisory personnel. It also requests assignment of knowledgeable escorts. This paragraph also requests that the facility make available at the opening briefing any information the team leader deems relevant for review by the team (refer to paragraphs 4-27a(1) and (3) of this order).

e. Fifth Paragraph. The fifth paragraph requests senior management feedback on the conduct of the QSA to be sent to the cognizant CM branch electronically.

f. Final Paragraph. The final paragraph is a closing paragraph indicating to whom specific questions concerning the audit should be addressed. It directs those questions relative to scheduling be addressed to the lead audit office or requesting CM section and that questions relative to the conduct of the audit be addressed to the team leader or principal auditor.

G-1 8120.23B Appendix G Figure G-1. Sample Paragraphs for the Notification Letter The Federal Aviation Administration (FAA), in accordance with its responsibilities under the recodified Federal Aviation Act of 1958 (as amended) and applicable requirements of Title 14 of the Code of Federal Regulations, has selected (name of PAH), located in (city, state), for the conduct of an audit. Your certification as a (type of approval holder) has been approved by the FAA contingent upon the Administrator’s right to audit and inspect your organization, facilities, product, and records. This includes your entire network of suppliers and approval extensions, as appropriate.

The audit of your facility is scheduled to be conducted from (start date) to (end date) under the FAA’s Quality System Audit (QSA) program. This audit will be broad-based in nature and will encompass elements such as design control, manufacturing processes and controls, and supplier control. Procedures and records will be examined in addition to a “hands-on” witnessing of relevant system processes.

(The FAA audit team will consist of approximately (total number) members.) The (FAA team leader designated/principal auditor) for this audit is (Mr./Ms.) (name) who may be reached at (telephone number). (His/Her) address is (office address).

Attendance by a representative of senior management responsible for the facility to be audited, as well as cognizant technical and supervisory personnel, is requested during the pre-audit and post-audit conferences. We further suggest that escorts who are knowledgeable of the various areas to be visited be provided to ensure the audit is conducted smoothly and with minimal disruption to your staff. Please have available at the time of the facility in-briefing any specific information, data, or records pertaining to your FAA-approved quality system that was previously requested by the team leader.

One of the primary features of the QSA is continuous quality improvement. As part of this process, it is important for us to know what your senior management thought about the conduct of the QSA. We therefore encourage senior management to send feedback within 30 days of the post-audit conference.

Please be advised that FAA QSA reference material is available on the FAA website.

If you have any questions concerning the scheduling of this audit, please feel free to contact me. If you have any questions concerning the conduct of the audit, please contact the (team leader/principal auditor) (Mr./Ms.) (name of team leader/principal auditor), at the above address and telephone number.

G-2 8120.23B Appendix H Appendix H. Preparation Instructions for FAA Quality System Audit Executive Summary H-1. Purpose. This appendix provides instructions for preparing the FAA QSA Executive Summary. This summary provides the status of each quality system element audited and a narrative of noncompliances. The completed summary will be the only record of noncompliances that the team leader provides at the post-audit conference to the audited facility.

H-2. Specific Guidance. Figures H-1 and H-2 show sample executive summaries with numbered blocks. Prepare the summary as follows: a. Block 1. Insert the QSA number/report number.

b. Block 2. Insert the project number(s) assigned to the production approval activity being audited.

c. Block 3. Insert the name of the facility audited.

d. Block 4. Insert the date(s) of the audit.

e. Block 5. Insert brief statements outlining the noncompliances for each of the applicable quality system elements. Format the summary as follows: (1) State the total number of noncompliances identified for the entire audit, even if there were none.

(2) Discuss only those quality system elements that have noncompliances recorded.

Do not list quality system elements that have no noncompliances recorded.

a) State the number of noncompliances identified for each system element discussed.

b) Summarize the noncompliances for each quality system element discussed.

f. Block 6. For paper versions of this form, have the team leader sign in this block. This block may be signed by a team leader-in-training but must also be countersigned by the team leader. When an electronic version of the executive summary is used, ensure all required names are listed.

g. Block 7. Insert the date of the post-audit conference.

H-1 8120.23B Appendix H Figure H-1. Sample Executive Summary for Facilities with Noncompliances FEDERAL AVIATION ADMINISTRATION QUALITY SYSTEM AUDIT (QSA) EXECUTIVE SUMMARY (1) (2) QSA NO./REPORT NO.: 98NE278/1-1 PROJECT NO.: PE9999NE (3) FACILITY: Cape Cod Aircraft Engine Co.

(4) DATE OF AUDIT: August 6–15, 2011 (5) SYSTEM ELEMENT NONCOMPLIANCES During this audit, the team documented 10 noncompliances.

Design Control System Element: Four noncompliances were recorded for this system element.

One noncompliance was recorded for a breakdown in the approved procedure for determining major or minor design changes. A second noncompliance was recorded for a breakdown in the approved procedure for processing minor design changes. Two additional noncompliances were recorded for a breakdown in the approved procedures for submitting major design changes and process specification changes to the FAA.

Software Quality Assurance System Element: One noncompliance was recorded for this system element. It was recorded for an isolated incident of obsolete software media not being properly controlled.

Manufacturing Processes System Element: Four noncompliances were recorded for this system element. A noncompliance was recorded for a breakdown in the job order manufacturing sequence for the main housing, part Nos. 123–666 and 123–667. Another noncompliance was recorded for an isolated incident of changes to work instructions not being properly controlled. One noncompliance was recorded for an isolated incident of a change to a special process not being properly controlled.

One noncompliance was recorded for a breakdown in the approved procedures for handling parts sensitive to electrostatic discharge.

Supplier Control System Element: One noncompliance was recorded for this system element. It was recorded for a breakdown in the approved procedure to make information available to the FAA regarding all delegation of authority to suppliers to make major inspection of any products/parts thereof.

(6) (7) J.J. Gem August 15, 2011 FOR OFFICIAL USE ONLY Public availability to be determined under 5 U.S.C. 552 H-2 8120.23B Appendix H Figure H-2. Sample Executive Summary for Facilities With No Noncompliances FEDERAL AVIATION ADMINISTRATION QUALITY SYSTEM AUDIT (QSA) EXECUTIVE SUMMARY (1) (2) QSA NO./REPORT NO.: 01SW334/1-1 PROJECT NO.: PP0000SW (3) FACILITY: Excellent Metal Components Inc.

(4) DATE OF AUDIT: April 1, 2011 (5) SYSTEM ELEMENT NONCOMPLIANCES During this audit, the team documented no noncompliances.

(6) (7) J.M. Tired April 1, 2011 FOR OFFICIAL USE ONLY Public availability to be determined under 5 U.S.C. 552 H-3 8120.23B Appendix I Appendix I. Preparation Instructions for Quality System Audit Special Emphasis Items I-1. Purpose. This appendix provides instructions for preparing QSA special emphasis items.

These items are intended to bring to the attention of the assigned certification branch and CM section and the flight standards district office (FSDO) principal maintenance inspector (as appropriate) specific problems or concerns the QSA team believes require further action.

I-2. Specific Guidance. Figure I-1 shows a sample special emphasis items form with numbered blocks. Prepare the special emphasis items by inserting in the following: a. Block 1. The QSA number/report number.

b. Block 2. The project number(s) assigned to the production approval activity being audited.

c. Block 3. A brief statement summarizing the problem or concern, identifying the relevant quality system element and referencing the relevant noncompliances.

Provide a recommendation for further action required, as appropriate.

I-1 8120.23B Appendix I Figure I-1. Sample Quality System Audit Special Emphasis Items for PAHs QUALITY SYSTEM AUDIT SPECIAL EMPHASIS ITEMS (1) (2) QSA NO. /REPORT NO.: 98SW314/1-2 PROJECT NO.: PT9999SW (3) NOTE TO CM BRANCH MANAGER AND COGNIZANT PRINCIPAL INSPECTOR At the request of the principal inspector, the team put special emphasis on the supplier control system element.

Though only two noncompliances were recorded, a large number of isolated incidents were recorded among the other system element criteria. See the attached FAA Forms 8100-6, isolated noncompliances Nos. 6 to 19. The team cannot say with confidence that a systemic problem exists with supplier control; however, when all of the discrepancies are taken as a whole, we believe there is a strong probability that a systemic problem may exist.

We recommend that a special audit be conducted on the supplier control system element to fully determine whether a systemic problem exists.

NOTE TO CERTIFICATION BRANCH MANAGER AND AE A noncompliance was recorded in the design data control system element for a suspected problem with the FAA-approved data. See the attached FAA Form 8100-6, noncompliance No. 20. There is a systemic problem with FAA-approved drawings that call out incorrect or nonexistent process specifications. We recommend that this problem be investigated further.

FOR OFFICIAL USE ONLY Public availability to be determined under 5 U.S.C. 552 I-2 8120.23B Appendix J Appendix J. Preparation Instructions for FAA Form 8100-3, Quality System Audit Report, Cover Pages J-1. Purpose. This appendix provides instructions for preparing FAA Form 8100-3.

J-2. Preparing the Front of the Form. Figure J-1 shows the front of FAA Form 8100-3 with numbered blocks. Prepare the form by inserting the following: a. Block 1. The QSA number.

b. Block 2. The report number. This number will consist of the report order sequence and the total number of separate original reports issued under the QSA number in block 1. For example, QSA Report No. 1-2 would indicate that this is the first report in a series of two separate original reports issued for a specific audit. This example could indicate in one instance that an audit was conducted at a PAH that has multiple quality systems being audited at the same time, thereby requiring issuance of two separate original reports. When only one report is required, identify it as No. 1-1.

c. Block 3. The name, address, city, state (or country), and ZIP/postal code of the facility audited.

d. Block 4. A checkmark in the applicable box(es) to indicate the type(s) of design or production approval the facility has; ensure the box labeled (Extension(s)) is also checked if applicable.

e. Block 5. The date of the pre-audit conference.

f. Block 6. The date of the post-audit conference.

g. Block 7. The name of the office responsible for the certificate management of the audited facility.

h. Block 8. The name of the assigned CM section responsible for the audit activity.

Leave blank if the CM section in Block 7 performs the audit activity.

i. Block 9. The team leader’s or principal auditor’s signature. This block may be signed by a team leader in training but also must be countersigned by the team leader.

When an electronic version of the form is used, ensure all required names are typed in.

j. Block 10. The date of signature.

k. Block 11. The location of the objective evidence. Indicate if the objective evidence is attached to the report or if the objective evidence has been retained by the PI or AE.

J-1 8120.23B Appendix J Figure J-1. Sample FAA Form 8100-3 (Front) J-2 8120.23B Appendix J J-3. Preparing the Back of the Form. Figure J-2 shows the back of FAA Form 8100-3 with numbered blocks. Prepare the form by inserting the following: a. Block 12. The name of each team member, including any national resource specialist, manager used, and any auditors/team leaders in training who participated.

List the team members first. Do not enter the team leader’s name.

b. Block 13. The office to which each individual listed in block 12 is officially assigned.

c. Block 14. The discipline of each individual listed in block 12. Identify whether the individual is an ASI, engineer, or flight test pilot.

d. Block 15. The specialty of each individual listed in block 12, as applicable. Identify engineers by systems and equipment, propulsion, airframe, or flight test specialty.

e. Block 16. An “A” to identify auditors in training or a “T” to identify team leaders in training. Leave this block blank for team members.

J-3 8120.23B Appendix J Figure J-2. Sample FAA Form 8100-3 (Back) J-4 8120.23B Appendix K Appendix K. Acronyms 14 CFR Title 14 of the Code of Federal Regulations AC Advisory Circular AD Airworthiness Directive AE Assigned Engineer AIR Aircraft Certification Service AIR-500 Integrated Certificate Management Division AIR-600 Policy and Standards Division AIR-800 System Oversight Division AIR-900 Enterprise Business Operations Division ASI Aviation Safety Inspector ASE Aviation Safety Engineer CAA Civil Aviation Authority CM Certificate Management CPL Category Parts List DAR Designated Airworthiness Representative DCT Data Collection Tool DER Designated Engineering Representative FAA Federal Aviation Administration FAI First Article Inspection FSDO Flight Standards District Office MOU Memorandum of Understanding MSAD Monitor Safety Analyze Data NAS National Airspace System NDI Nondestructive Inspection NTE Not to Exceed ODA Organization Designation Authorization OIS Oversight Information System OMT Organization Management Team PAH Production Approval Holder PC Production Certificate PCM Preliminary Certificate Management PI Principal Inspector PLR Production Limitation Record PMA Parts Manufacturer Approval QSA Quality System Audit RBRT Risk-Based Resource Targeting SAI Special Audit Item SAIB Special Airworthiness Information Bulletin SDR Service Difficulty Report SMS Safety Management System SPC Statistical Process Control SQC Statistical Quality Control STC Supplemental Type Certificate SUP Suspected Unapproved Part TC Type Certificate K-1 8120.23B Appendix K TSO Technical Standard Order TSOA Technical Standard Order Authorization UA Unmanned Aircraft VSMS Voluntary Safety Management System K-2 8120.23B Appendix L Appendix L. Definitions The definitions in this appendix are for the purpose of this order only.

L-1. Approved. Unless used with reference to another person, means approved by the FAA or any person to whom the FAA has delegated its authority in the matter concerned, or approved under the provisions of a bilateral agreement between the United States and a foreign country or jurisdiction.

L-2. Article. A material, part, component, process, or appliance.

L-3. Assigned Engineer (AE). An FAA engineer to whom the assigned certification branch manager has assigned responsibility for a QSA at a particular design approval facility.

L-4. Associate Facility. A facility that has been approved as an extension to an original PAH.

The facility is owned and operated by the same corporate management as the original PAH that controls the design and quality of the product, article, or part(s), except for companies participating in joint production and/or coproduction business agreements. The associate facility must be listed as a manufacturing facility on the PC or the letter of authorization for other production approvals, for example, a PMA or TSOA.

L-5. Audit. A systematic and documented process for obtaining records, statements of fact or other information, and evaluating it objectively to determine the extent to which policies, procedures or requirements are met.

L-6. Auditor. An individual the FAA appoints to perform audits.

L-7. Certificate. A document (that is, a certificate or approval) issued by the FAA that recognizes an applicant’s or PAH’s established quality system and allows for the production of products, articles, or parts in accordance with an FAA approved design.

L-8. Certificate Management. The methods by which the FAA ensures a PAH remains in compliance with those pertinent regulations that govern the manufacturing of its particular products, articles, or parts.

L-9. CM Section. The FAA office having responsibility for conducting certificate management activities of a PAH and its manufacturing facilities.

L-10. Commercial Part. An article that is listed on an FAA-approved Commercial Parts List included in a design approval holder’s Instructions for Continued Airworthiness required by 14 CFR 21.50. In accordance with 14 CFR 21.50(c), a design approval holder may designate an article as a commercial part if the FAA finds the part– a. Is not specifically designed or produced for applications on aircraft; and b. Is produced only under the commercial part manufacturer’s specification and marked only with the commercial part manufacturer’s markings.

L-1 8120.23B Appendix L L-11. Corrective Action. Action to eliminate or mitigate the cause or reduce the effects of a detected nonconformity, noncompliance, or other undesirable situation.

L-12. Days. A reference to calendar days, unless otherwise specified.

L-13. Distributor. Any person engaged in the sale or transfer of products, articles, and parts for installation in type-certificated aircraft, aircraft engines, or propellers, and that conducts no manufacturing activities.

L-14. Effectiveness. Process where the organization’s corrective action produces the desired result.

L-15. FAA Approved Data. Data specifically approved by the FAA or FAA delegated representatives, including any document referenced therein. This data may include design drawings, manuals, procedures, and specifications.

L-16. Facility. A physical location where a PAH or its associate facility performs all or part of the quality system element functions relevant to the approval authority granted by the FAA.

L-17. First Article Inspection. An activity verifying that an article conforms to the approved data, and any additional contract requirements. A first article inspection should be conducted for a new production line, changes to the manufacturing or quality processes, or a new supplier.

L-18. Foreign Manufacturer. A person other than an FAA PAH who causes a product, article, or part(s) to be produced outside the United States.

L-19. Internal Procedure. A PAH’s procedures that are not included as part of the FAA approved data.

L-20. Isolated. A noncompliance to 14 CFR, FAA approved data that is nonsystemic in nature (i.e., is not pervasive or repeated, and does not represent a breakdown in the quality system).

L-21. Lead Audit Office. A division office or branch assigned to coordinate a QSA.

L-22. Licensing Agreement. A commercial agreement between a TC or an STC holder and a PAH (or applicant) formalizing the rights and duties of both partners to use the design data for the purpose of manufacturing the product, article, or part.

L-23. Major Inspection. Inspections/tests identified by the design and production approval holder that are required to determine whether critical/key characteristics conform to the design and quality requirements and are in a condition for safe operation.

L-24. Manufacturer. A person as defined by 14 CFR Part 1, Definitions and Abbreviations, who causes a product, article, or part(s) to be produced. A manufacturer may be a PAH or a supplier to a PAH.

L-2 8120.23B Appendix L L-25. Noncompliance. Conduct (any condition or discrepancy) that is contrary to a statute, regulation, order issued under a statute or regulation, or FAA-approved process/procedure for which compliance is required and corrective action is needed.

L-26. Objective Evidence. All the means by which any alleged fact tends to be established or disproved. These means must be factual, convincing, relevant, valid, reliable, and complete.

Examples of objective evidence include interview statements, photographs, charts, maps, diagrams, documents, and records. Documents and records include items such as work travelers, inspection documents, FAA approved drawings, PMA, TSO approval letters, airworthiness approval tags (FAA Form 8130-3, Airworthiness Approval Tag), and calibration logs.

L-27. Ongoing Certificate Management Responsibilities. The performance of certificate management requirements, based on a risk assessment, that may be accomplished on a continuing basis.

L-28. Oversight. A function performed by the FAA (or other regulator i.e., a CAA of another country) that ensures that an aviation organization or designee complies with and uses safety related standards, requirements, regulations, and associated procedures.

L-29. Point of Manufacturing Methodology. The concept of conducting a focused, product- based, data-driven audit of a critical article or process at any location where manufacturing is being performed (e.g., PAH, associate facility, supplier, subtier supplier).

L-30. Principal Auditor. An FAA appointed team leader who acts as the sole auditor for the performance of a QSA at a specific facility.

L-31. Principal Inspector (PI). A manufacturing inspector who has been assigned certificate management responsibility of a particular PAH.

L-32. Procedure. A specific way to perform an activity or function that is documented and usually contains the purposes and scope of the activity or function: what is to be done and by whom; when, where, and how the activity or function is to be done; the materials, equipment, and documents to be used; and how the activity or function is to be controlled and recorded.

L-33. Process. A set of interrelated or interacting activities that transforms inputs into outputs.

L-34. Produce. To manufacture, or cause to be manufactured, a product, article, or part(s).

L-35. Product. An aircraft, aircraft engine, or propeller.

L-36. Product-Based System Audit. An audit of a PAH’s quality systems by examining compliance to regulations and approved procedures using particular products when practical. It is a planned and recorded activity that relies on using selected products and articles, (to the maximum extent practical), for determining whether the product or article conforms to approved data, as well as whether the PAH complies with the quality system requirements, including procedures and special processes established to meet those requirements.

L-3 8120.23B Appendix L L-37. Production Approval. A document issued by the FAA to a person that allows the production of a product, article, or part in accordance with its approved design and approved quality system, and can take the form of a PC, a PMA, or a TSOA.

L-38. Production Approval Holder (PAH). The holder of a PC, PMA, or TSOA, who controls the design and quality of a product, article, or part(s). A person who has been issued a production approval by the FAA.

L-39. Quality Escape. A product or article that has been released from a quality system and does not conform to the applicable design data and/or quality system requirements.

L-40. Quality System. A documented organizational structure containing responsibilities, procedures, processes, and resources that implement a management function to determine and enforce quality principles.

L-41. Quality System Data. Data that provide a description of the quality system required by 14 CFR Part 21 for a PAH. These data would encompass the methods, procedures, processes, inspections, tests, specifications, charts, lists, forms, etc., which the PAH employs to produce products, articles, or parts.

L-42. Quality System Element. A specific activity or function that may affect the maintenance of FAA approved design or quality data, such as design data control, manufacturing controls, and supplier control. Such activities are subject to audit of the adequacy and implementation of approved procedures.

L-43. Requesting CM Section. An office that requests associate facility certificate management from another office having assigned responsibility of the area in which the facility is located.

L-44. Risk-Based Resource Targeting (RBRT). A structured process designed to support AIR management in determining risk, assigning resources based on that risk, and prioritizing multiple projects.

L-45. Root Cause. The underlying cause of a systemic or recurring noncompliance, usually identified through structured analysis.

L-46. Safety Management System. The formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.

L-47. Special Audit Item (SAI). An item, process, or area that senior management has determined requires specific focus during audits.

L-48. Standard Part. A part manufactured in complete compliance with an established government or industry-accepted specification that contains design, manufacturing, and uniform identification requirements. The specification must include all information necessary to produce and conform the part and must be published so that any person/organization may manufacture the part.

L-4 8120.23B Appendix L Note: Examples of specifications include, but are not limited to, National Aerospace Standards (NAS), Air Force-Navy Aeronautical Standard (AN), Society of Automotive Engineers (SAE), SAE Aerospace Standard (AS), and Military Standard (MS).

L-49. Supplier. Any person, as defined by 14 CFR 1.1, at any tier in the supply chain, who provides a product, article, or service that is used or consumed in the design or manufacture of, or installed on, a product or article.

L-50. System. An integrated set of constituent elements that are combined in an operational or support environment to accomplish a defined objective. These elements include people, hardware, software, firmware, information, procedures, facilities, services, and other support facets.

L-51. Systemic. A noncompliance to 14 CFR, FAA approved data that is pervasive, repeated, or represents a breakdown in the quality system. A repeated noncompliance can be, but is not limited to, multiple noncompliances discovered during a single audit, or a recurring noncompliance discovered during multiple or successive audits.

L-52. Warranty Return . When a customer returns or notifies the PAH that they received a product or article that does not meet its intended function.

L-5 8120.23B Appendix M Appendix M. Directive Feedback Information Please submit any written comments or recommendations for improving this directive or suggest new items or subjects to be added to it. Also, if you find an error, please tell us about it.

Subject: Order 8120.23B To: Directive Management Officer, (Please mark all appropriate line items) ☐ An error (procedural or typographical) has been noted in paragraph on page .

be changed as follows: ☐ Recommend paragraph on page (attached separate sheet if necessary) ☐ In a future change to this order, please include coverage on the following subject: (briefly describe what you want added): ☐ Other comments: ☐ I would like to discuss the above. Please contact me.

Submitted by: Date: Routing Symbol: Telephone Number: FAA Form 1320-19 (11/23) Supersedes Previous Edition M-1