Performance Review Institute Med Accred Program Introductory Training

© Performance Review Institute Med. Accred Program – Introductory Training Session 20 November 2014 © Performance Review Institute

The materials provided online by Performance Review Institute may be used by Med. Accred customers solely for their internal use, but PRI requests that attribution be given by placing “(c) Performance Review Institute” in the work. Please be aware that the use of PRI materials for external publication, distribution or sale is prohibited unless express written permission has been granted by PRI. If you have any questions contact Connie Conboy, Director – Strategy and Business Development, cconboy@p-r-i. org, +1 724 772 7153. 2 © Performance Review Institute

Agenda • Introduction to PRI and Nadcap • Med. Accred Overview – Program Requirements • The Med. Accred Audit Process • Med. Accred Audit Preparation Steps • During the Audit / Post Audit • Additional Information 3 © Performance Review Institute

Building on the Foundation of Aerospace Success Nadcap & PRI 4 © Performance Review Institute

PRI and Nadcap PRI is a global, not-for-profit affiliate of SAE International with offices in Americas, Europe, Asia. PRI administers the Nadcap special processes accreditation program on behalf of its Subscribing Members and industry, and is led by a Board of Directors with responsibility for strategic direction and financial stability. Nadcap was created by aerospace Original Equipment Manufacturers (OEMs or Primes) to provide supply chain oversight and ensure regulatory compliance. Nadcap uses audit management software that was created and maintained inhouse by PRI Informatics Solutions (e. Audit. Net). FAA recognizes Nadcap as an accepted Other Party Verification. FAA Order 8120. 12 A - Production Approval Holder Use of Other-Parties to Supplement Their Supplier Control Program: “The recognized or accredited other-party organization is normally a professional society, such as…the National Aerospace and Defense Contractors Accreditation Program. ” 5 © Performance Review Institute

6 The Nadcap Program Nadcap represents a global, industry managed program: • Supplier Audits (2013) • Subscribers (OEMs) 2 788 21 2, 704 31 Americas Europe 1, 491 Americas Asia § 75% of the top 100 Aerospace Manufacturers (by Annual Revenue) are either Nadcap OEM Subscribers or Suppliers* © Performance Review Institute Asia § 4, 983 Nadcap Supplier Audits Conducted in 2013 § Over 5, 000 projected in 2014 * Data taken from Flight International Top 100 Report (September 2012) www. flightglobal. com © 2013 Performance Review Institute Europe

Agenda • Introduction to PRI and Nadcap • Med. Accred Overview – Program Requirements • The Med. Accred Audit Process • Med. Accred Audit Preparation Steps • During the Audit / Post Audit • Additional Information 7 © Performance Review Institute

Med. Accred Overview Advancing Medical Device Quality Through Supply Chain Process Accreditation 8 © Performance Review Institute

What is Med. Accred? • Med. Accred is an industry managed approach to supplier quality oversight. • Provides a mechanism to identify the critical manufacturing processes used by the device industry and oversee the supply chain’s ability to meet these requirements through a surveillance and accreditation process. • Brings together technical experts from both Industry and Government to establish requirements for accreditation, conduct in-depth audits by subject matter experts and accredit Suppliers. • Results in a standardized approach to critical manufacturing process quality assurance and a reduction in redundant auditing throughout the industry. • Based on success of the aerospace program, Nadcap. Med. Accred is administered by the Performance Review Institute Inc. a not-for-profit trade association. 9 © Performance Review Institute

Current Medical Device Industry Challenges • Increased outsourcing and globalization of the supply chain throughout the medical device industry, thereby increasing the challenge of appropriate level of oversight • Increased number of recalls attributed to supplier quality issues • Purchasing controls: o is one of the top cited FDA-483 observations for medical device quality system violations o has been included as an element of several enforcement actions (warning letters, consent decrees) • Flow down of design requirements from OEMs to first-tier and sub-tier suppliers is a critical issue affecting Quality & Safety 10 © Performance Review Institute

What is the Scope of Med. Accred? • An industry-managed audit and accreditation program that assures compliance to critical manufacturing processes and reduces risk to patient safety • Med. Accred is an audit tool for Medical Device OEMs to use to ensure appropriate oversight of their supply base while maintaining ultimate responsibility for device quality and compliance • Med. Accred program provides in-depth, critical process, audits conducted by industry recognized and approved Subject Matter Experts to ensure conformance and compliance with accepted industry/technical standards • Scope of audit: o Critical, process-focused, technical audits based on robust core and OEM-specific checklists o Sampling of product audits to ensure process capability to meet requirements o Assesses effectiveness of suppliers’ Quality Management System (QMS) at the critical process level (e. g. PCBA, Heat Treating, Sterilization, Welding, etc. ) 11 © Performance Review Institute

Using Med. Accred for Critical Process Oversight OEMs: - Establish requirements and effective Flow-down - Ensure oversight SUPPLIERS: MEDACCRED: - Qualified Suppliers List (QSL) - Sub-tier suppliers 12 © Performance Review Institute - Maintain compliance to requirements - Provide audits to verify compliance to requirements - Issue accreditation

Industry Managed Audit Process/Points of Oversight Subject Matter Experts from key industry stakeholders, facilitated by PRI, develop comprehensive, detailed, consensus Audit Criteria (checklists). AUDIT CHECKLIST Audit Criteria continually improved by feedback from Task Group members (Industry). AUDITOR QUALIFICATION & SELECTION PROCESS EVALUTION/ IMPROVEMENT Issued after final decision by Task Group based on Staff Engineer recommendation. INDUSTRY EXPERTS MANAGE ALL KEY STEPS MAINTAINING INVOLVEMENT & REGULATORY COMPLIANCE ACCREDITATION Professional staff hired by PRI manage all Root Cause Corrective Action (RCCA) activities. 13 © Performance Review Institute CORRECTIVE ACTIONS AS REQUIRED AUDIT RESULTS AUDIT CONDUCTED The most technically educated and experienced personnel for the specific special processes trained as auditors, and continually provided additional training and oversight by Task Group (industry experts for each special process). Auditors simply perform the audit, freed from follow-on activities such as reviewing corrective actions, fixing problems, etc. Supplier audits are conducted by different auditors each year. Store every aspect of every audit – answers to checklist questions, discussions, all root cause and corrective action information, and supporting evidence – in a secure, globally accessible online database; and use the database to produce reports that provide comprehensive visibility into the most critical issues for each and all subscribing members.

Advantages for Medical Device Industry • Promotes continuous improvement and a culture of patient safety and product quality for all participants in the supply chain • Enhances compliance and quality management system effectiveness throughout the supply chain p • Aligns with FDA “Case for Quality” strategic initiative and promotes best practices by focusing on critical control points to assure product safety and effectiveness • Enhances opportunity for collaboration between suppliers and OEMs • Improves flow down of specifications to sub-tier suppliers • Promotes least burdensome approach by reducing redundant process audits by multiple customers • Provides real-time and consistent visibility of supply chain quality • Shared pool of experienced, trained, and approved Subject Matter Experts among OEMs to conduct robust process specific audits 14 © Performance Review Institute

Industry Working Together PRI Policy Statement - Antitrust It is the policy of the Performance Review Institute (PRI) to comply strictly with the letter and spirit of all applicable federal, state, and international trade regulations and antitrust laws. A PRI Staff executive working with the Management Council, Task Groups, and committees, and other necessary PRI Staff shall carry out the day-to-day operations of the Program. All Program administrative operations shall be free from control by anyone having a direct commercial interest in any products, processes, or services for which suppliers are to be accredited. Supplemental Activities Related to Antitrust • Antitrust addressed within PRI Code of Conduct • Antitrust statement included in each Industry Managed Program meeting 15 © Performance Review Institute

Med. Accred Program Structure Industry Managed Programs Policy/Executive Leaders Med. Accred Policy/Executive Leaders PRI Staff Tactical/Senior Quality Leaders & Managers PRI Board of Directors Med. Accred Operating Board Tactical/Supplier Quality Leaders & Managers Technical/Technical Experts (OEM and Suppliers) Task Groups Electronic Circuits – Printed Circuit Board Assemblies (PCBAs) Electronic Circuits – Cable and Harness Heat Treating Note: Groups in italics are yet to be formed. 16 © Performance Review Institute Sterilization Welding Additional Task Groups to be created according to industry and FDA input Med. Accred Management Council (MMC) MMC Committees Proof of Concept Audits External Communications and Strategy Program Documentation Oversight Ethics and Appeals Metrics Supplier Support Committee

Med. Accred Program Development Critical Processes (in development) Drivers Electronic Circuits – Printed Circuit Board Assemblies (PCBA) • • • Able to leverage existing audit criteria developed for aerospace Area in which issues with supply chain control have been identified Significant interest from large number of OEMs Electronic Circuits – Cable & Wire Harness • • • Able to leverage existing audit criteria developed for aerospace Area in which issues with supply chain control have been identified Significant interest from large number of OEMs Heat Treating • • Able to leverage existing audit criteria developed for aerospace Driven by orthopaedics manufacturers • Identified as applicable to majority of OEMs – crosses many sectors of the industry (diagnostics, orthopaedics etc. ) • • Able to leverage existing audit criteria developed for aerospace Driven by orthopaedics manufacturers Sterilization Welding Future Critical Process Areas of Interest with Industry and FDA Input and Trending (potential development) • Batteries • Coatings • Material Testing Laboratories • Packaging • Sterile • Sealing • Reagents • Casting/Forging • Electronics • Displays • Measurement/Inspection • Plastics • Composites • Injection Molding • Extrusion Molding • Software • Chemical Processing • Fluidics • Non-Destructive Testing • Power sources/supplies (batteries) • Optics • Raw Materials • Cleaning • Machining 17 © Performance Review Institute • Laser Etch

Work to date: Proof of Concept Audit Methodology • Existing Nadcap checklists were used to audit similar critical processes at medical device suppliers to assess usability, identify similarities/differences between the Nadcap program and Med. Accred and to determine how critical process integrity is assessed in the device industry: o o o Welding (April 2013) Electronic Circuits - Printed Circuit Board Assemblies (September 2013) Heat Treating (October 2013) Electronic Circuits – Cable & Wire Harness (March 2014) Sterilization - pilot of new checklists planned during 2014 • Audits were conducted by Nadcap SME’s and “observed” by participating medical device OEM representatives and PRI staff • No supplier accreditation was sought, nor were observations or findings written or formally defined however deviations (gaps) in requirements from the Nadcap checklists were noted and left with the supplier 18 © Performance Review Institute

Proof of Concept: Summary of Results • In opinion of the device OEM, Nadcap checklist was determined to be substantially applicable to the needs of the medical device industry • Audits confirmed need to strengthen and standardize current supply chain oversight approach in the device industry (OEM) • Device OEM became aware of need and importance of specification flow-down • Supplier became aware of areas for improvement and the need for a better understanding of requirements • Auditor capabilities fit Medical Device industry requirements • Gaps in the Nadcap checklists that were specific to Medical Devices were identified and are currently being added to the medical device checklists by each Task Group 19 © Performance Review Institute

Levels of Participation • Individuals participate at two levels: o o 20 Task Group § Each company/agency (Supplier or Subscriber) participating in the Program may be represented on a Task Group by only one Voting Member. § Where audit criteria are developed and the accreditation process is maintained. The target participants at the Task Group level are quality and engineering technical personnel. Med. Accred Management Council (MMC) § Each Subscriber to the Program shall have one Subscriber Voting Member on the MMC. § Where policy and procedural decisions are made for the operation of the Program, Task Group coordination and development occurs, and oversight of the accreditation process is accomplished. © Performance Review Institute

Program Participants • Subscriber: A Manufacturer or Specification Developer of a finished medical device who subscribes to the Program information and accreditation services which is subject to a Subscriber Agreement and; is accountable for conformance to critical manufacturing process specifications and; receives a product or service from a Supplier. 21 o Subscribers shall be granted Subscriber Voting/Alternate Voting Membership on the Task Group to which they subscribe in addition to the MMC; o Subscriber shall have access to audit results of all Suppliers participating in the Program. This may include Sub-Tier Subscribers. © Performance Review Institute

Program Participants • Supplier: A company which performs/provides a critical manufacturing process and/or service and; is subject to a Supplier Agreement and; is currently/will have, one or more critical manufacturing processes accredited by Med. Accred. o 22 Suppliers may be granted Supplier Voting/Alternate Voting Membership in Task Groups. © Performance Review Institute

Program Participants • Sub-Tier Subscriber: A Contract Manufacturer of a finished medical device who meets the Program definition of a Supplier and; is accountable for conformance to critical manufacturing process specifications and; receives a critical manufacturing process and/or service from a Supplier. (Also identified as simply “Supplier” within the Program Documentation) o 23 Sub-Tier Subscribers may be granted Supplier Voting/Alternate Voting Membership in Task Groups. Sub-Tier Subscribers shall: § Be identified in the Program as a Supplier § Have the ability to request access to audit results of those Suppliers who they utilize © Performance Review Institute

Agenda • Introduction to PRI and Nadcap • Med. Accred Overview – Program Requirements • The Med. Accred Audit Process • Med. Accred Audit Preparation Steps • During the Audit / Post Audit • Additional Information 24 © Performance Review Institute

Med. Accred Audit Process 25 © Performance Review Institute

What is a Med. Accred Audit? • A thorough assessment for compliance to a Med. Accred checklist and Customer requirements o Conducted by an expert in the commodity o Auditors are chosen by the Task Group • Audit is not a Quality Systems (QS) Audit! o 26 o Technical audit focused on the specific commodity requirements o QS related aspects only specific to the commodity e. g. review of certification requirements for Welding personnel Audits are conducted at an annual frequency – or an extended frequency if Merit is achieved – to ensure ongoing compliance to requirements. © Performance Review Institute

General Focus Audit Calibration: Does the supplier define the process employed for the calibration of inspection, measuring and test equipment type, unique identification, location, frequency of checks, check method, acceptance criteria and the action to be taken when results are unsatisfactory? NDT Heat Treating Chemical Processing Technical Focus Audit Calibration: Are the FPI dryer ovens calibrated every three months at multiple points across the usable range? NDT 27 Are furnaces used for heat treating Aluminum parts surveyed at the required tolerance and temperature range? Heat Treating Is measuring and test equipment used to control or monitor the control of a process (within parameters) maintained in a calibration system compliant with ISO 10012 -1? (I. e. temperature gages, conductivity meters, voltmeters, rectifiers) Chemical Processing

Checklists Core Checklist Slash Sheet Checklist Supplemental Checklist 28 Supplemental Checklist

Audit Management System - e. Audit. Net • All audits are electronically recorded in an in-house, web based system called e. Audit. Net • All information for every audit conducted is held within in the system and accessible 24/7 • Access to audit data is restricted depending on participant status in the program • The Med. Accred program will operate using the same software which will be validated to Medical Device Industry standards using FDA Guidance. 29 © Performance Review Institute

Med. Accred Audit Process – Med. Accreditation 1 Suppliers PRI Audit Scheduled Request Audit 7 30 4 3 2 Auditor Assigned 6 a Accreditation Task Group Approval PRI Technical Staff Review Audit Completed 9 8 6 5 © Performance Review Institute

NCR Classifications Major Nonconformance: • The absence of, or systemic breakdown of, the Process Control and/or Quality Management system or; • Any non-conformance where the effect impacts or has the potential to impact the integrity of the product. Minor Nonconformance: • Any single system failure or lapse in conformance with the applicable standard or audit criteria where the effect does not impact or have the potential to impact the integrity of the product. 31 © Performance Review Institute

Standard Supplier Accreditation Term • Supplier term of accreditation begins in conjunction with the audit date, not the issue date of the certificate • Accreditation terms are tied to the Med. Accred quarterly cycles • Standard accreditation term is 12 months Audit Month Dec-Jan-Feb 32 Accreditation Expiration Mar-Apr-May 30 April of following year (subsequent calendar year for audits begun in Dec) 31 July of following year Jun-Jul-Aug 31 October of following year Sep-Oct-Nov 31 January of year following subsequent calendar year © Performance Review Institute

Supplier Merit • The Supplier Merit Program awards extended frequency between audits to Suppliers based on length of participation as an Accredited Supplier, number and severity of recorded non-conformances, and Supplier cycle time • A supplier undergoes a minimum of three audits (one initial and two reaccreditation audits) before 18 month accreditation may be considered • Each Task Group shall reach consensus on supplier’s eligibility for participation in the Supplier Merit program • Supplier merit is visible on the Med. Accred QML 33 © Performance Review Institute

Supplier Merit Table – Extended Accreditation Term 18 -Month Criteria Number of audits 2 nd Reaccreditation Audit No Non-Sustaining Corrective Action Current and 1 previous audit No Verification Corrective Action (VCA) Audits Current and 1 previous audit No Product Escapes or Type P/C Supplier Advisories* Current and 1 previous audit Cumulative Supplier Delinquency No more than 14 Days Number of Findings No more than 50% of Major NCRs and 60% of total NCRs per failure threshold Other Any justifiable reason identified by Task Group Type P = Potential Impact, Type C = Confirmed Product Impact 34 © Performance Review Institute

Supplier Advisory • The purpose of the Med. Accred Supplier Advisory is to notify Med. Accred Subscribers of issues with conformance of products, services, or quality systems of Med. Accred Suppliers • Three types of Supplier Advisories exist o Type P – Potential for Product Impact o Type C – Confirmed Product Impact o Type F – Failed Audit • Med. Accred accreditation may be suspended or withdrawn as a result • Supplier Advisories are located and controlled in e. Audit. Net 35 © Performance Review Institute

Audit Failure Policy • An audit may be failed for any number of reasons including but not limited to; o severity of Nonconformances (NCRs), o number of NCRs, o any violation of Supplier agreement, o failure to pay prescribed fees, etc. • Failure is when Task Group has stopped the audit review because the supplier did not meet Program requirements. 36 © Performance Review Institute

Audit Failure Policy • Modes of Failure: o A - Supplier stops audit o B - Excessive number of findings as defined by each Task Group o C - Severity of findings o D - Too many review cycles to complete o E - Nonresponsiveness by Supplier • Criteria are not automatic failure points. 37 © Performance Review Institute

Audit Failure Policy Nadcap Criteria Examples – Modes B 38 © Performance Review Institute

Audit Failure Policy If an audit meets criteria: • PRI Staff notifies the Commodity Task Group via Audit Failure Ballot in e. Audit. Net. Task Group will review and determine if the audit review process should be stopped and the audit failed. This is documented as a vote by the Task Group. If an audit is failed: • Company must wait a minimum of 90 days from the date of failure in e. Audit. Net before another audit will be conducted • Company must demonstrate corrective actions to the auditor on site at the time of the new audit 39 © Performance Review Institute

Appeals Process • Should the Supplier not agree with a decision made by the Task Group, there is an Appeals process that is available. Suppliers have the ability to appeal to the Task Group and then to the Med. Accred Management Council. 40 © Performance Review Institute

Information available on-line www. e. Audit. Net. com • Resources/Documents/Public Documents o Change of address/Contact sheet (t-frm-11) o e. Audit. Net Supplier Guide & Pre & Post-Audit Tutorials o Audit Handbooks o Miscellaneous Task Group reference and training documents such as Task Group Meeting / Symposium presentations, Rolling Action Item List (RAIL), Pyrometry Reference Guide, etc • Checklists http: //www. pri-network. org/other-programs/medaccred/ • Med. Accred Meeting Schedule • Value Proposition and Executive Brief • Minutes from past events Check both sites often – updates made frequently 41 © Performance Review Institute

Agenda • Introduction to PRI and Nadcap • Med. Accred Overview – Program Requirements • The Med. Accred Audit Process • Med. Accred Audit Preparation Steps • During the Audit / Post Audit • Additional Information 42 © Performance Review Institute

Med. Accred Audit Preparation Steps 43 © Performance Review Institute

Relationship Between Audit Documents Industry Standards & OEM Requirements AC 8 XXX AUDIT CRITERIA + Job Audits Obtain and download the audit checklist and audit handbook PRIOR to your audit! 44 © Performance Review Institute AUDIT HANDBOOK (if available) Clarify Instructions and Subscriber (OEM) process specification requirements

Job Audit • A job audit is a step by step review of the critical process on actual hardware, evaluating how the customer requirements are met, using the Med. Accred checklists. o Each critical process family will have a certain number of job audits to be witnessed. o Each Task Group has their own requirements, be sure to review the audit checklist for specific details • Schedule the Med. Accred audit when able to perform as many of the job audits as possible with in-process work o Work with the scheduling department (internal and PRI) o Can affect scope of the accreditation o Paper audits may be used but only when absolutely necessary and as agreed by the Task Group NOTE: If clarification is needed, contact the Staff Engineer 45 © Performance Review Institute

Examples of Common Nadcap Findings • Job Audits o Customer flow-down o Lack of shop discipline – inform your personnel! o Lack of documentation/Objective evidence o Data transfers • Processes requiring approvals not approved (i. e. , NDT Techniques or other frozen process) • Specification compliance (i. e. , frozen process doesn’t meet specification or AMS 2750 compliance) • Parts cleaning not in accordance with requirements • Testing, including periodic 46 © Performance Review Institute

Examples of Common Nadcap Findings • HT (Heat Treating) (Data available on e. Audit. Net – Public Documents / Heat Treating / Data folder) o System Accuracy Tests (SAT’s) performed on temperature control and recording devices o Calibration records demonstrating conformance to AMS 2750 o Calibration frequency and accuracies of equipment and thermocouples o Non-Sustaining (Repeat) findings *Common findings refers to Non Conformance Reports (NCR’s) 47 © Performance Review Institute

Examples of Common Nadcap Findings • WLD (Welding) (Data available on e. Audit. Net -Public Documents / Weld / Supplier info) o Has the supplier demonstrated compliance to the welding schedule? o Does the welding schedule address all customer requirements? o Is the welder/operator qualification complete and up to date for the work being performed? o Does the supplier have a documented welder qualification procedure? o Are pre-weld preparations defined and in accordance with customer requirements *Common findings refers to Non Conformance Reports (NCR’s) 48 © Performance Review Institute

Best Practices for Med. Accred Success • Strengthen your internal audit program – Use the Med. Accred checklists! Include Job Audits every time. Understand the interpretation and expectations • Download the checklist and perform a thorough and complete self-audit 49 o Record, by question, where in the system the requirement is documented o Record, by question, where the objective evidence of compliance is in the system o If you cannot write down where in the system the documentation is located and what you will show the auditor – the checklist answer is No! o Perform a full set of job audits © Performance Review Institute

Best Practices for Med. Accred Success • Confirm all personnel understand the role they play in making the audit successful • For reaccreditation audits - Review all NCR’s (Majors / Minors) from the previous audit to ensure corrections taken are sustaining • Use the tools available on www. e. Audit. Net. com 50 o Tutorials where available o Audit Handbooks where available o Checklists © Performance Review Institute

PRI Staff Engineer • The PRI Task Group Staff Engineer has commodity specific knowledge and expertise 51 o Review audit report packages. Make recommendations for accreditation to the commodity Task Group o Qualified auditors – Understand the process o Work intimately with the commodity Task Groups – Understand requirements, interpretations and expectations o When necessary, use their expertise before and after your audit © Performance Review Institute

Staff Engineer Advice • It is the companies’ responsibility to ensure all requirements are met o Do not shift responsibility to others for non compliances or assume everything is acceptable because it was believed to be acceptable in the past o Understand the interpretation of the requirements and/or Task Group expectation. Contact the Staff Engineer if uncertain • Ensure compliance throughout all of the company documents • Auditor will check for complete compliance 52 © Performance Review Institute

More Staff Engineer Advice • Conflict between the checklist - comply with the customer requirement or pick the most stringent? If uncertain, contact customer or PRI • Multiple customer requirements will require a more robust system • The specification is the requirement. Procedures must meet all requirements in the specification, with supporting evidence as required by the checklists 53 © Performance Review Institute

Scope Verification • At the beginning of the opening / introduction meeting (in-briefing), the auditor will log onto e. Audit. Net. com and request the supplier representative review the scope of the audits to ensure accuracy and make any changes accordingly prior to the audit commencing • The auditor does not determine the scope, that is the responsibility of the company. If uncertain, verify with your customer © Performance Review Institute 54

Daily Briefings • At the end of every audit day, the auditor should conduct a daily briefing to summarize the progress and review any non conformance reports (NCR) generated during the day o Inform key company personnel (if required) o Promotes open communication between the company and auditor o Allows the company time to obtain further clarification or objective evidence that may invalidate the NCR o 55 Purpose is not to excessively debate or argue about an issue with the auditor. Problems occur, contact appropriate Staff Engineer o Review any outstanding items that needed to be addressed to answer a checklist questions o Discuss the next days agenda to ensure personnel are available o Minimize time necessary at the final out-briefing © Performance Review Institute

Exit Meeting • An out-briefing or exit interview with Supplier Management personnel shall be conducted to: 56 o Review non-conformances o Obtain commitments for corrective actions o Explain the other aspects of the Med. Accred process o Schedule top management to attend o Make certain the company understands any NCR’s written – ask questions if you do not understand - this is your chance to ensure the finding will be written clearly © Performance Review Institute

Exit Meeting • Review the accreditation process requirements and expectations before the auditor leaves o Highlight key Med. Accred procedures to review o NCR Corrective Action outline, response time frames o e. Audit. Net process o Supplier Feedback • Open communication between the Supplier and Auditor is important. Again, if problems occur, contact the appropriate Staff Engineer 57 © Performance Review Institute

After the Auditor Leaves • Feedback is invaluable to the process – Med. Accred is a cooperative program o When a company submits their NCR responses (within 21 calendar days) they are prompted to complete the Supplier Feedback online questionnaire o o 58 When there are O NCRs, the company is required to complete the Supplier Feedback within three business days Complaints must be submitted in writing and will be addressed independently of the audit review process © Performance Review Institute

NCR Response Submittals • Initial responses are due within 21 calendar days from the date of the electronic audit submittal by the auditor • For completeness of the audit report, additional information or clarifications may be requested by the Staff Engineer 60 © Performance Review Institute

Corrective Action Response Requirements Reply to your NCR in the Supplier Discussion for each NCR in the format below and addressing each item in the ‘Your Reply’ section of the e. Audit. Net Supplier response forum for each NCR 61 o Immediate Corrective Action Taken (Containment Actions) o Root Cause of Nonconformance o Impact of all Identified Causes and the Root Cause o Action Taken to Prevent Recurrence o Objective Evidence is required on ALL findings o Effectivity Date © Performance Review Institute

NCR Review • NCR responses are closed when the company meets the expectation of the commodity Task Group o The Task Group expects a complete and thorough assessment of the NCR by the supplier • Provide objective evidence o Procedure changes, control check log sheets, calibration certificates, immediate and long term training, etc • Immediate corrective action is not the action taken to prevent recurrence • Failure to close NCR’s delays accreditation, adding cycle rounds and days 62 © Performance Review Institute

If Your Response is Not Accepted • You have 7 calendar days to respond to the Staff Engineer request for additional information • If the Staff Engineer details a specific request: o Review and comply with the entire request. Your response will not be accepted until all items are addressed o Only address what is being asked from the Staff Engineer. Do not resend the whole RCCA response • In the event of a generic rejection, i. e. , “Readdress Root Cause” o Review the Requirements for Submittal of Corrective Action Responses and make certain you are complying with these requirements • Call the Staff Engineer for clarification 63 © Performance Review Institute

Response Due Dates • Response extensions are not given, however the company is allowed a limited number of cumulative late days that can be used through the life of the audit report package. Late days typically used: • o Allow a more thorough response to be provided o Key personnel on vacation or sick o Awaiting equipment installation, calibrations, etc o Training of personnel After 30 late days, audits are processed per the Audit Failure Process o 64 18 month accreditation cannot be achieved if more than 14 late days are accumulated © Performance Review Institute

Between Audit & Accreditation Yes 1. Supplier Submits Corrective Action Responses 2. Staff Review of Supplier Corrective Action Responses Additional Information Requested No Yes Additional Information Requested No 4. Accreditation 65 © Performance Review Institute 3. Task Group Review of Audit Package

Response Requirements Help available: www. e. Audit. Net. com - A link to Response Requirements is attached to the NCR The link is located right above the Supplier Response box Also: www. pri-network. org/nadcap - Supplier Info – Post Audit Assistance Also: www. e. Qua. Learn. com to register for RCCA training 66 © Performance Review Institute

Example – The Non Conformance The procedure for the Qualification and Certification of NDT Personnel (QA-OP 01, Rev J) does not meet NAS 410 -3 for the following: A. Incorrect classroom training hours for PT level 2 B. Does not require the level 2 candidate to document the NDT results during the practical examination C. Allows administration of Practical exams by Level 2’s D. Does not require the designation of a “Responsible” Level 3 E. Does not provide the method for the approval of person(s) administering eye exams F. Etc…… 67 © Performance Review Institute

Immediate Corrective Action Define Immediate Corrective Action Taken: What action was taken following the issue being discovered during the audit? o Did you stop the problem from continuing? o Did you contain the problem found? o Did you notify Customers of suspect parts/hardware? o Did you notify / train personnel on immediate action? These actions address the immediate or direct cause of the NCR only 68 © Performance Review Institute

Immediate Corrective Action (Cont’d) Define Immediate Corrective Action Taken: Example of an Unacceptable Immediate Corrective Action: o The procedure was modified Example of an Acceptable Immediate Corrective Action: 69 o Procedure was reviewed in it’s entirety against the requirements of NAS 410 -3 and approved by our responsible Level 3. Procedure attached, note – specific changes made are identified on our procedure change sheet o Personnel trained / made aware of change o See attached training / acknowledgement sheet © Performance Review Institute

Root Cause Define Root Cause of the Nonconformance: Investigate all causes contributing to the nonconformance using fish bone diagrams, 5 -why analysis or similar tools. The root cause will be the last logical cause in the chain Think you got it? Try one more! Only the identified Root Cause should be included in the response (Do not write a thesis). Supplemental information to support the cause analysis may be included as objective evidence if necessary 70 © Performance Review Institute

Root Cause (Cont’d) Define Root Cause of the Nonconformance: Example of an Unacceptable Root Cause: We have been audited by many customers in the past. This has never been a problem and our requirements have been found to be acceptable Example of an Acceptable Root Cause: Inadequate review of our procedure against the customer/industry standards due to a lack of formal procedural review process and ineffective pre audit using the Nadcap checklist 71 © Performance Review Institute

Impact of Identified Causes Define the Impact of all Identified Causes and the Root Cause: What impact did the nonconformance actually have? o 72 Consider: o Were any other parts / processes affected? o Were any affected parts shipped to the customer? o Was the customer contacted? © Performance Review Institute

Impact of Identified Causes (Cont’d) Define the Impact: Impact to Hardware: Example of an Unacceptable Impact Statement: No Impact Example of an Acceptable Impact Statement: No Impact. This discrepancy was procedural only. All NDT records were reviewed and found to be compliant with NAS 410 -3 73 © Performance Review Institute

Actions Taken to Prevent Recurrence Define the Actions Taken to Prevent Recurrence: What are the steps taken to prevent this problem from occurring again? 74 o What is the long term action to prevent recurrence? o Can only be addressed when the true root cause is known o Do not rush, consider the effectiveness, feasibility, suitability to the company, and the company's budget o Remember, non-sustaining Corrective Actions (CA) become MAJOR findings. By not addressing CA’s adequately there is a potential for a non-sustaining finding on the next audit. This will affect your Supplier Merit © Performance Review Institute

Actions Taken to Prevent Recurrence (Cont’d) Define the Action Taken to Prevent Recurrence: Example of an Unacceptable Action Taken: • The procedure was revised Example of an Acceptable Action Taken: • Review teams have been created to address the review of special processes, including NDT. The teams will be comprised of two individuals (for NDT, one of the team members will be the responsible Level 3) and will perform a back to back review of the internal specification against the customer / industry standard for compliance. The reviewers will complete a document review sheet, the procedure will be changed and identified on the review sheet and then forwarded to the relevant personnel for final approval. This process is documented in procedure ABC 123 rev 3, please see attached procedure and change sheet • As part of the continuous improvement process Nadcap checklists have been incorporated into the internal audit system. As a minimum an annual audit shall be performed. Procedure ABC 213 rev 5 modified to reflect, please see attached procedure and change sheet • Training of personnel completed, see attached training record 75 © Performance Review Institute

Objective Evidence Define and Attach Objective Evidence: What information can be provided to demonstrate the RCCA process applied to the NCR? o Objective evidence is required for Major & Minor NCR’s except minor NCR’s accepted (not closed) onsite by the auditor o Note: It is expected that the supplier clearly define the root cause corrective action taken. If a procedure is changed, clearly specify what the change was • Don’t forget to identify the specific actions taken to resolve the nonconformance(s), (e. g. , exact text of procedure change, text of stamp to be ordered, etc. ) o Objective evidence should be attached electronically in www. e. Audit. Net. com or submitted by U-fax o A U-fax directory is located in the Public Documents section of www. e. Audit. Net. com o Contact the Staff Engineer with any questions • If you change or create a procedure, implement a new system or method, perform training, propose audits, develop new checklists - SHOW THIS. It may prevent another review cycle 76 © Performance Review Institute

Objective Evidence (Cont’d) Define and Attach Objective Evidence: NCR Example: The procedure for the Qualification and Certification of NDT personnel does not meet NAS 410 -3 Objective Evidence: Example of Unacceptable Objective Evidence: See attached revised procedure Example of Acceptable Objective Evidence: See attached revised procedure (QA-OP-01, Rev K) for the training and approval of NDT Personnel. Note: Includes approval by the responsible Level 3. See attached procedure (QA-01 Rev B) addressing the addition of the specification review teams. See attached completed document review sheet for QA-OP-01 against NAS 410 -3. See attached training log sheet for affected personnel 77 © Performance Review Institute

Key Points to Consider • Supply all the necessary objective evidence, e. g. copy of revised procedure, procedure approval, copy of revised process control log, evidence of training, etc • Respond directly in e. Audit. Net o Word documents / NCR templates / other attachments containing the RCCA response is not acceptable. Provide the response directly in e. Audit. Net. Attachments are for objective evidence only • Address every aspect of the Root Cause Corrective Action (RCCA): o Immediate corrective action taken o Root cause o Impact to hardware o Action taken to prevent recurrence o Objective evidence • Provide information within the defined time frame 78 © Performance Review Institute

How to Avoid Repetitive NCR’s! • Involve all personnel that will have the responsibility to fix, implement and monitor the corrective actions • Issue notifications throughout all company departments when policies/procedures are changed as a result of corrective action responses • Ensure that more than one person within the company is totally familiar with past and present Med. Accred audits and NCR’s • Create a process to ensure Corrective Actions for all NCR’s - major or minor - have been implemented and are monitored, as part of the internal audit process. • Do not attempt quick fixes - even for minor non conformances. If quick fixes are accomplished there should be a process within the company on how these are accomplished and what the limitations are 79 © Performance Review Institute

Agenda • Introduction to PRI and Nadcap • Med. Accred Overview – Program Requirements • The Med. Accred Audit Process • Med. Accred Audit Preparation Steps • During the Audit / Post Audit • Additional Information 80 © Performance Review Institute

Pre-Assessment Audit • Companies can schedule a pre-assessment audit using a Med. Accred auditor BEFORE the actual Med. Accred audit • All the data from the audit will be left with the company • The only findings which will be sent to Subscribers are findings which may have significant potential for impact to hardware • Contact PRI Scheduling for more details 81 © Performance Review Institute

Med. Accred Information • Details on upcoming Med. Accred meetings, and access to supporting information on the program (including this presentation), can be found on the Med. Accred website: • http: //www. p-r-i. org/other-programs/medaccred/ 82 © Performance Review Institute

Thank You Questions and Feedback Joseph Pinto Executive Vice President & Chief Operating Officer, PRI jpinto@p-r-i. org +1 724 772 7175 Mark Aubele Sr. Program Manager – AQS/ETG/MI/NDT/STN, PRI maubele@p-r-i. org +1 724 772 8654 Justin Mc. Cabe Research & Development Specialist, PRI jmccabe@p-r-i. org +1 724 772 8693 Upcoming Med. Accred meetings: • MMC Face to Face: o December 3, 2014 (all day) on-site at PRI HQ in Warrendale, PA o http: //events. constantcontact. com/register/event? llr=t 4 cxmocab&oeidk=a 07 e 9 t 8 o 1 db 1 d 8639 fb • February 18, 2015 (all day) – Memphis, TN • MMC Teleconference Calls: • Monthly 83 © Performance Review Institute