Auditor independence must be maintained in accordance with 10CFR50 Appendix B Criteria XVIII and NQA-1 Requirement 18 (if applicable). Personnel may not audit areas they are responsible for. The same Lead Auditor may be used in consecutive internal audits as long as they don't audit anything they're responsible for. This can be accomplished through adding an auditor to the team that wasn't responsible for the previous internal audit. The auditor completes the Internal Audit section of the checklist, reviews the Lead Auditor's qualfications for the Training section of the checklist, and in some cases reviews audits/surveys performed by the Lead Auditor. If your typical audit team consists of only a Lead Auditor, independence can also be maintained through switching Lead Auditors each year.

The Nuclear Regulatory Commission (NRC) has endorsed documents such as NQA-1 and EPRI Document 3002002982 (rev 1 to EPRI NP-5652) through regulatory guides or other NRC documents. When the NRC endorses a document, they are essentially stating that they approve of that document as a method of meeting the requirements of 10CFR50 Appendix B and 10CFR21. Just because the NRC endorses something doesn’t mean you have to follow it as long as you can justify that your method meets the requirements of 10CFR50 Appendix B and 10CFR21 and any other requirements imposed by your manual or customers. And by the same note, just because the NRC hasn’t endorsed a document doesn’t mean you can’t use it as long as it meets those same requirements. One thing to be careful with, however, is when the NRC approves methods that differ from normal requirements. One example would be NRC approval of the use of accredited calibration and testing in lieu of commercial grade survey (click here). Through this safety evaluation, the NRC approves the use of an accreditation, along with some additional requirements, instead of having to perform a full supplier evaluation. Since this is a reduction in requirements, it must be fully complied with in order to use it.

It can be very difficult to find requirements for commercial grade dedication. Commercial grade dedication is called into existence by 10CFR21, both in the definitions and section 21.61(c) which states that “The dedicating entity…is responsible for…maintaining auditable records of the dedication process”. Based on the requirements in 10CFR21, if you are taking a commercial grade item, which is anything not created under a nuclear quality program (this applies to nuclear power plants), and determining that it is adequate for use as a basic component, also referred to as a safety-related item, then you must document the dedication process. As far as the dedication process goes, the requirements for it are somewhat loose. The definition for Dedication in 10CFR21 requires that critical characteristics are defined and that they are verified through inspections or tests, supplemented as needed by commercial grade surveys, product inspections, or witness at hold points at the manufacturer’s facility. The process is complete when all critical characteristics are verified and the item is designated for use as a basic component. Since these requirements don’t give much guidance, the NRC has endorsed EPRI Document 3002002982 through Reg Guide 1.164 as an adequate means of performing commercial grade dedication. If your quality program follows NQA-1, the section for Requirement 7 includes requirements for Commercial Grade Dedication which differ based on the edition followed.

Some companies I audit have an expectation of perfection during audits, sometimes upper management expects 3 or fewer findings or something similar. Luckily, I have audited many more companies that have the correct viewpoint of welcoming findings because they are opportunities for improvement of the quality program. Findings have a negative stigma associated with them, but should not be viewed as such. You could have 15 findings but still “pass” an audit because an audit is a measure of the effective implementation of the quality program. There is no pass/fail line because the lead auditor determines whether the quality program is effectively implemented. When reviewing audit findings near the end of an audit, I have to look at the severity of the findings, the areas they affect, and the overall feel that I get from the findings and the audited program. If there are quite a few severe findings (i.e. no document control, program not meeting 10CFR50 App B, no 10CFR21 procedure, etc.) then it is likely that the program is not effectively implemented. However, there could be a large number of minor findings (i.e. missing signatures, wrong revision numbers, tools out of calibration, etc.) and the program could be viewed as effectively implemented with the exception of those findings. Granted, if there are a large number of minor findings, it could be indicating underlying issues like a lack of attention to detail, but it all comes down to how the lead auditor views everything when it is all put together. Another thing to remember, is that if you are handling your own internal audits it can be just as bad to not have any findings. Whenever I see zero findings for a previous audit (which I see far too often), I always question whether the audit was effective. If your internal audits return zero findings and then a customer audits you and finds several, it can be a good indication that your audits are not effective and you may receive an additional finding for that. Remember to foster an attitude of continuous improvement!

Procedures and Work instructions should be as detailed as they need to be without being so detailed that it makes it difficult to get work done. 10CFR50 Appendix B requires that instructions “include appropriate quantitative qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished.” NQA-1 requires the same with the addition that “the activity shall be described to a level of detail commensurate with the complexity of the activity and the need to assure consistent and acceptable results. The need for and level of detail in, written procedures or instructions shall be determined based on the complexity of the task, the significance of the item or activity, work environment, and worker proficiency and capability (education, training, experience).” Neither of these standards offer much in the way of requirements for work instructions and essentially leave it up to the experience of the person writing the instruction to make them appropriately detailed based on the complexity of the task and the capability of their personnel. As a Lead Auditor, I ensure that work instructions detail at least the flow of the work through the shop and include reference to applicable drawings or specifications. Much more beyond that is really up to the instruction writer. Another thing to remember is that neither of these standards include requirements for performance of steps in a strict order. Normally, it is implied that work instructions should be followed step-by-step, however, if your manual or procedures include an allowance for performing steps out of order in a controlled manner, I don’t see an issue with that. It is important however, that hold points cannot be skipped when performing steps out of order and it is recommended that performing steps out of order require some sort of shop floor supervisor (or similar) permission. That will allow some leeway in the production process when it makes sense and will still meet requirements as long as all steps are completed prior to completing a hold point.

One of my most common findings during audits is when the auditee passes down 10CFR21 requirements to a commercial vendor. I’m going to paraphrase sections in 10CFR21 along with their paragraph references below to show why this is not permitted. §21.1 (a) Scope: The regulations in this part apply to (2) each individual, corporation, partnership, or other entity that supplies basic components for a facility or activity licensed under part 50 of this chapter (10CFR50 which includes Appendix B). §21.3 Definitions: A basic component is (1)(i) a structure, system, or component, or part thereof that affects its safety function necessary to assure safe operation and shutdown of the plant. (ii) Basic components are items designed and manufactured under a quality assurance program complying with 10CFR50 Appendix B, or commercial grade items which have successfully completed the dedication process. (4) In all cases, basic component includes safety-related design, analysis, inspection, testing, fabrication, replacement of parts, or consulting services that are associated with the component hardware, design certification, design approval, whether these services are performed by the component supplier or others. §21.2(d) Nothing in these regulations should be deemed to preclude either an individual, a manufacturer, or a supplier of a commercial grade item not subject to the regulations in this part from reporting to the NRC, a known or suspected defect or failure to comply. So 10CFR21 applies to suppliers of basic components, which includes services associated with basic components, and basic components can only be supplied by suppliers with a 10CFR50 Appendix B program. Commercial suppliers are able to report defects to the NRC, but they do not fall under the scope of 10CFR21. For commercial vendors, what you should do is require in procurement documents that they report nonconformances associated with the service or product they supply to you within 5 working days. You are then responsible for following the 10CFR21 evaluation and reporting process.

I have seen many 10CFR21 postings in my auditing travels, here are my opinions on the two allowed methods. Option 1: Post a copy of 10CFR21, Section 206 of the Energy Reorganization Act of 1974 (full text version here), and the procedure that you created to meet 10CFR21. Pros: Easy – not much work involved to make the posting, just print everything and pin it to a bulletin board. All information is available to anyone that wants to read it. Cons: Control – if you revise your procedure or if 10CFR21 gets updated, it is easy audit bait. Visibility – this will most likely result in at least 20 pages of text, so pinning it to a bulletin board will only show what’s on top. Low likelihood of anyone actually reading it. Option 2: Post Section 206 of the Energy Reorganization Act of 1974, a description of 10CFR21, and a description of your procedures, along with the name of the individual to whom reports may be made and states (locations, i.e. QA Manager's office) where they may be examined. In most cases, companies that use this method make an 11″x17″ poster that includes all of these items. Pros: Less control needed – since you are only stating where personnel can get copies of 10CFR21 and your procedure, you don’t need to include a revision level of those documents, you just need to make sure that the name of the individual to whom reports may be made is current. Highly visible – if everything is on one page, it is much more likely that someone will stop and read it. This doesn’t mean that someone will ask for a copy of 10CFR21, but it will give them the basic idea of the requirements (on top of the 10CFR21 training you have already given them). Cons: More work – it takes a little more effort to put the poster together than to just print out the documents and pin them. You have to make sure that the posting gives the correct information for where they can get copies of 10CFR21 and your procedure (you can refer personnel to the QA Manager’s office rather than an internet location) and for the person to whom reports may be made, once again easy audit bait if these are not correct. Obviously, I lean more toward Option 2 due to the ease of information transmittal and likelihood of it being up to date, but it is up to you on how to meet the requirement since the option is given. Either way, don’t forget to click “Subscribe to Page Updates” at the top of the 10CFR21 page. You will get email alerts letting you know when 10CFR21 is updated.