The production organisation approval (POA) holder, as suggested by GM1 21.A.139(d)(1), is responsible for determining and applying acceptance standards for
physical condition,
configuration status and
conformity of supplied products, parts or appliances,
BFE (Buyer Furnished Equipment)
whether to be used in production or delivered to customers as spare parts. This responsibility also includes BFE (Buyer Furnished Equipment) items.
To discharge this responsibility the quality system needs an organisational structure and procedures to adequately control suppliers. Elements of the quality system for the control of suppliers may be performed by other parties provided that the conditions of AMC1 21.A.139(d)(2)(ii) or AMC2 21.A.139(d)(2)(ii) are met.
Control can be based upon use of the following techniques (as appropriate to the system or product orientation necessary to ensure conformity):
qualification and auditing of the supplier’s quality system;
evaluation of the supplier's capability in performing all the manufacturing activities, inspections and tests necessary to establish the conformity of parts or appliances to the type design;
first article inspections, including destruction, if necessary, to verify that the article conforms to the applicable data for a new production line or a new supplier;
incoming inspections and tests of supplied parts or appliances that can be satisfactorily inspected on receipt;
identification of incoming documentation and data relevant to the showing of conformity to be included in the certification documents;
a vendor rating system which gives confidence in the performance and reliability of this supplier; and
any additional work, tests or inspection which may be needed for parts or appliances which are to be delivered as spare parts and which are not subjected to the checks normally provided by subsequent production or inspection stages.
The POA holder may rely on the results of inspections/tests performed by the supplier if it can establish that:
the personnel responsible for these tasks satisfy the competency standards of the POA quality system;
quality measurements are clearly identified; and
the records or reports showing evidence of conformity are available for review and audit.
The POA holder retains direct responsibility for inspections/tests that are performed either at its own facilities or at the supplier’s facilities.
The control of suppliers holding a POA for the parts or appliances to be supplied can be reduced to a level at which a satisfactory interface between the two quality systems can be demonstrated. Thus, for the purpose of showing conformity, a POA holder can rely upon documentation for parts or appliances, which is released in accordance with the supplier’s privileges that are defined in point 21.A.163.
A supplier who does not hold a POA is considered to be a subcontractor under the direct control of the POA quality system.
As indicated in GM2 21.A.139(d)(1) when defining the arrangements between the production organisation (PO) and its partners and subcontractors, both elements of the production management system should be taken into account, i.e. the safety management element and the quality system element.
The following guidance should therefore be considered applicable to both elements.
(a) When the PO subcontracts activities, the arrangements should consider the safety risk management process that is part of the PO’s safety management element (see point 21.A.139(c)(3)). When the subcontractor does not have a safety management element, the subcontractor should be integrated into the safety management element of the PO; when the subcontractor has implemented a safety management system (such as for design organisation approval (DOA) or production organisation approval (POA)), the two safety management systems, i.e. of the PO and of the subcontractor, should be harmonised.
(b) Depending on the complexity and criticality of those arrangements, the following elements within the arrangements should be addressed:
(1) coordination and interfaces between all the parties involved;
(2) applicable procedures;
(3) safety culture, including internal safety reporting schemes (see point 21.A.3A);
(4) communication between all the parties involved, including reporting, regular meetings, and feedback channels;
(5) allocation of tasks, of clear accountability, and of responsibilities; and
(6 the qualifications and competency of key personnel with reference to point 21.A.145.
(c) The safety risk management should focus on the need to exchange safety data and safety information that are deemed significant for the determination of relevant risks in terms of likelihood, severity, impact, and acceptability, such as, wherever appropriate, but not limited to the following:
at product level : failure, malfunction, defect, or other occurrences, non-conformity or outcome of the compliance monitoring function, quality escape, process failure, foreign object damage (FOD), deviation (e.g. calibration of tools), component failure analysis, in-service event, etc.;
at documentation level : key processes (e.g. airworthiness directives, production documentation, production processes); and
at organisational level : organisational changes, disruptive events, resources’ issues, human performance (HP) issues.
Regular communication should be ensured between all the parties involved, to discuss
work progress,
risk mitigation measures,
changes to the arrangements,
as well as any other significant issues
General
As indicated by AMC2 21.A.139(d)(2)(ii) Other Party (OP) supplier certification is a method whereby a supplier contracts an appropriately recognised or accredited OP for the purpose of obtaining a certification from that OP.
Certification indicates that the supplier has satisfactorily demonstrated that it meets the applicable standard on a continuing basis. OP certification results in placing the supplier on the OP list of certified organisations, or in the supplier receiving a certificate identifying the requirements that have been met. Periodic follow-up evaluations are conducted by the OP to verify continued compliance with the requirements of the applicable standard.
The production organisation is required by point 21.A.139(d) to demonstrate that it has established and maintains a quality system that enables the organisation to ensure that each item produced conforms to the applicable design data and is in a condition for safe operation. To discharge this responsibility, the quality system should have, among other requirements, procedures to adequately carry out the assessment and surveillance of suppliers.
The assessment and surveillance of suppliers by an OP should be deemed to satisfy the requirements of point 21.A.139(b)(1)(ii) when the conditions of this AMC are satisfied. The assessment and surveillance of suppliers by OP as part of supplier certification does not exempt the production organisation approval (POA) holder from its obligations under point 21.A.165. The supplier assessment and surveillance, corrective action and follow-up activity conducted at any of its supplier’s facilities may be performed by OP.
The purpose of using an OP cannot be to replace the assessment, audit and control of the POA holder. It is to allow an element (i.e. the assessment of the quality system) to be delegated to another organisation under controlled conditions.
The use of suppliers that are certified by OP in accordance with this AMC should be part of a production organisation quality system.
(a) The POA holder should include the use of supplier certification for the supplier assessment and surveillance in the POA holder’s quality system to demonstrate compliance with the applicable requirements of Part 21.
(b) The procedures that are required for use of supplier certification for the supplier assessment and surveillance should be consistent the with other procedures of the POA holders’ quality system.
(c) The procedures of the POA holder that uses supplier certification for the supplier assessment and surveillance should include the following:
(1) A listing of the OPs that have certified or will certify suppliers and will conduct supplier assessment and surveillance or the scheme under which the accreditation of the OP is controlled. This listing should be maintained by the POA holder and made available to the competent authority upon request.
(2) A listing of the certified suppliers that are under surveillance by the OP and that are used by the POA holder. This listing should be maintained by the POA holder and made available to the competent authority upon request.
(3) The method used by the POA holder to evaluate and monitor the certification process of any OP certification body or OP certification scheme used. This applies not only to new suppliers, but also to any decision by the POA holder to rely on OP certification of current suppliers. The method should include the following as a minimum:
(i) verification that certification standards and checklists are acceptable and applied to the applicable scope;
(ii) verification that the OP is appropriately qualified and has sufficient knowledge, experience and training to perform its allocated tasks;
(iii) verification that the frequency with which the OP carries out surveillance of the suppliers is commensurate with the complexity of the product and with the surveillance frequency established by the POA holder’s suppliers control programme;
(iv) verification that the surveillance of the suppliers is including on-site surveillance activities that are conducted by the OP;
(v) verification that the surveillance report will be made available to the competent authority upon request;
(vi) verification that the OP continues to be recognised or accredited; and
(vii) verification that the OP has access to the applicable proprietary data to the level of detail necessary to survey the suppliers’ functions.
Where the POA holder uses an OP accredited by a signatory to the European cooperation for Accreditation (EA) Multilateral Agreement and works in accordance with an aviation standard (e.g. EN 9104 series of requirements) that describes the requirements for the OP certification, items (ii), (iv), and (v) should be deemed to be complied with.
(4) A definition that states to what extend the OP will conduct supplier surveillance on behalf of the POA holder. If the OP partly replaces surveillance by the POA holder, the POA holder should identify the functions that will continue to be surveyed by the POA holder.
(5) the procedures that ensure that the POA is aware of the loss of an existing certification.
(6) the procedures that ensure that the POA holder is aware of any non-conformity and has access to detailed information on any non-conformity.
(7) the procedures to evaluate the consequences of non-conformity and take appropriate actions.
(d) The POA should make arrangements that allow the competent authority to make investigations in accordance with point 21.A.9 to include OP activities.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
NOTE - As explained by GM1 21.A.139(d)(2)(ii) for the purposes of AMC1 21.A.139(d)(2)(ii) and AMC2 21.A.139(d)(2)(ii), vendors and subcontractors are referred to as ‘suppliers’, whether they hold production organisation approvals (POAs) or not;
NOTE - Audit and control are hereinafter referred to as ‘surveillance’.
NOTE - Implementing or significantly changing procedures to use an OP for supplier assessment and surveillance is a significant change to the quality system, and it requires approval in accordance with point 21.A.147.
Other Party (OP) assessor (EN 9104-002:2016)
a full-time employee (not a contractor or retired staff member) from either an IAQG member company or from an National Aerospace Industry Association (NAIA) member company [i.e., Aviation, Space, or Defence Original Equipment Manufacturer (OEM) or direct supplier to an OEM] that is actively participating in the ICOP oversight process, who has been qualified and approved in accordance with 9104 standard, and conducts shared oversight assessment or supplementary IAQG member company oversight activity in accordance with this standard.
Industry Controlled Other Party (ICOP) (EN 9104-002:2016)
the AQMS standard certification scheme, under IAQG and industry management, for the assessment and certification of organization quality management systems by other parties, in accordance with the requirements defined in the EN 9104-series standards
General
As per AMC1 21.A.139(d)(2)(ii)(b)(1)(ii) the production organisation is required by point 21.A.139(d) to demonstrate that it has established and maintains a quality system that enables the organisation to ensure that each item produced conforms to the applicable design data and is in a condition for safe operation. To discharge this responsibility, the quality system should have, among other requirements, procedures to adequately carry out the assessment and surveillance of suppliers.
The use of other parties (OPs), such as a consulting firm or quality assurance company, for supplier assessment and surveillance does not exempt the production organisation approval (POA) holder from its obligations under point 21.A.165. The supplier assessment and surveillance, corrective action and follow-up activity conducted at any of its supplier’s facilities may be performed by OPs.
The purpose of using an OP cannot be to replace the assessment, audit and control of the POA holder. It is to allow an element (i.e. the assessment of the quality system) to be delegated to another organisation under controlled conditions.
The use of OPs to perform supplier assessments and surveillance should be part of the production organisation quality system and fulfil the conditions of AMC1 21.A.139(d)(2)(ii)(b)(1)(ii).
This AMC is applicable to a method whereby a POA holder has a documented arrangement with an OP for the purpose of assessin’ and/or surveying a ‘OA’s supplier.
(a) The POA holder should include the use of OPs for supplier assessment and surveillance in the POA holders’ quality system to demonstrate compliance with the applicable requirements of Part 21.
(b) The procedures that are required for using OPs for supplier assessment and surveillance should be consistent with other procedures of the POA holders’ quality systeI(c) The procedures of the POA holder that uses OPs to perform supplier assessment and surveillance should include the following:
(1) Identification of the OP that will conduct the supplier assessment and surveillance.
(2) A listing of suppliers under surveillance by the OP. This listing should be maintained by the POA holder and made available to the competent authority upon request.
(3) The method used by the POA holder to evaluate and monitor the OP. The method should include the following as a minimum:
(i) verification that standards and checklists used by the OP are acceptable for the applicable scope;
(ii) verification that the OP is appropriately qualified and has sufficient knowledge, experience, and training to perform it's allocated tasks;
(iii) verification that the frequency with which the OP carry out surveillance of the suppliers is commensurate with the complexity of the product and with the surveillance frequency established by the POA holder’s suppliers control programme;
(iv) verification that the assessment and surveillance of the suppliers is including on-site surveillance activities that are conducted by the OP; and
(v) verification that the OP has access to the applicable proprietary data to the level of detail necessary to survey suppliers functions.
Where the POA holder uses an OP accredited by a signatory to the European cooperation for Accreditation (EA) Multilateral Agreement and works in accordance with an aviation standard (e.g. EN 9104 series of requirements) that describes requirements for the assessment and surveillance by the other party, items (ii) and (iv) shall be deemed to be complied with.
(4) A definition that states to what extend the OP will conduct surveillance of the suppliers on behalf of the POA holder. If the OP partly replaces surveillance by the POA holder, the POA holder should identify the functions that will continue to be surveyed by the POA holder.
(5) The procedures used by the OP to notify the POA holder of any non-conformity that is discovered at the supplier's facility, and of the corrective action and follow-up.
(d) The POA should make arrangements that allow the competent authority to make investigations in accordance with point 21.A.9 to include OP activities.
STEIA AVIATION supports POA INDIPENDENT COMPLIANCE MONITORING MANAGER for their Training and Management