8.5.1 and 8.5.4 and FOD interpretation

I'm reaching out to the community in the hopes that I can get some clarity on FOD requirements.

8.5.1 states:

The organization shall implement production and service provision under controlled conditions. Controlled conditions shall include, as applicable:

o. the provision for the prevention, detection, and removal of foreign objects;

While 8.5.4 adds:

The organization shall preserve the outputs during production and service provision, to the extent necessary to ensure conformity to requirements.

Preservation of outputs shall also include, when applicable in accordance with specifications and applicable statutory and regulatory requirements, provisions for:

b. prevention, detection, and removal of foreign objects;

In interpreting this, I'm seeing a lot of "as applicable", "to the extent necessary" and "in accordance with applicable requirements".

My organization does not have requirements from our Customers for FOD programs (such as Boeing Q186) nor do we have any applicable statutory and regulatory requirements. Nor do we suffer from product riddled with FOD issues or Customer feedback suggesting so. We currently do not work in the aerospace industry, primarily defense as it states in our scope.

As a result, we do not have a documented FOD program. We have been certified for a couple of years now so we've considered ourselves compliant. During a recent audit of a new facility, our auditor documented that we have no FOD requirements, but having no FOD program is a minor. I didn't push back because I felt the minor wasn't much of an issue and we could easily implement a simple system. So I submitted our RCA and corrective action plan and awaited the release of our certificate.

However, during technical review they upgraded the classification of the NC to a major.

As you all know, this adds significant time in containment and exposure via Level 2 access which may cause issues with some of our Customers.

I notified our CB that we were discussing it internally to determine if we have a diverging opinion as my interpretation of their stance is that it is a hard and fast requirement that every AS9100 certified company have a FOD program no matter what their requirements, customer feedback, scope or previous audit history says.

So my question to you is: Am I out to lunch here? Is a FOD program a hard and fast requirement?

Any insight into this topic would be a huge help. That's for sticking it out through my post!

 

Thanks for chiming in, Andy. Our scope covers:

"Project Management, design and development, manufacturing and support of automated, security and geotechnical products for civilian, military and government agencies."

 

Thanks again, Andy. We have some controls in place, like the ones that you've mentioned, but nothing documented. Their rationale for upgrading the finding to major was that since we don't have a documented program, we cannot demonstrate control. In other words, since we don't document how things should be correct, we cannot know when things go wrong.

 

Quick update: I definitely pushed back on this and requested the following clarification...

"8.5.1 defining controlled conditions “as applicable”, meaning “not universally mandatory”. Given that we have no customer requirement, statutory/regulatory requirements, no Customer feedback that FOD is impacting our products, no internal findings that FOD is a concern to our processes and no AS9100 requirement for a procedure, this still constitutes a significant failure to meet requirements? Am I understanding this view correctly?"

Below is the response from the CAB:

“the rule is if an AS9100 requirement can be applied, it shall be applied. That would be the case with "the provision for the prevention, detection, and removal of foreign objects” as it can be applied. It does not matter if there is "no customer requirement, statutory/regulatory requirements, no Customer feedback that FOD is impacting our products, no internal findings that FOD is a concern to our processes and no AS9100 requirement for a procedure."

Furthermore, “AS9100 sets the minimum expectation with customer, statutory, and regulatory requirements being over and above requirements, see posted clarification* on IAQG website below. There is likely a concern that this oversight was not picked up during an internal audit. If the organization was proposing a justified non-applicability to the FOD requirement...It is required that any non-applicability with a clause or “shall” statement be justified with documented information. I gather that no such documented information exists?”.

*see posted clarification on IAQG website below:

• Clarification: 9100 requirements form the minimum expectation for organizations. If customer, statutory, or regulatory requirements are less, then 9100 requirements at a minimum are required. Typically, customer, statutory, or regulatory requirements will provide more detailed requirements that do not conflict with 9100 requirements. (added 10/2023)"

I don't dispute the applicability of the standard over customer, statutory/regulatory requirements, however, I am having a bit of heartburn over the "as applicable" statement in the clause. It feels to me that they are setting a precedent that every portion of the standard applies to every QMS, no matter what. In addition, don't mind taking a hit with a minor, I just don't see the justification for a major classification.