Quality Audit Finding and Response Record (QAFRR)

The Quality Audit Finding and Response Record is used to record a nonconformance with one or more quality standard(s) found during a quality audit. It provides for the audited organizational unit to submit a suitable remedy in order to return to and document conformance with the quality standard(s).

a. Use this DID for findings resulting from quality audits carried out by contractors or governmental entities external to the audited organizational unit as well as internal quality audits. The term audit shall be used herein to encompass any inspection, review, evaluation, assessment, analysis, or similar activity involving an examination relative to a fixed standard. Any reference to an auditor shall be understood include an inspector, reviewer, evaluator, assessor, analyst, or examiner. All references to standards shall be understood to mean specific, identified, codified, published quality standards. Associated measures of value or worth are also included within the scope of quality, such as, but not limited to, reliability, effectiveness, utility, surety, feasibility, practicability, maintainability, producibility, or sustainability.

b. In the scope of this DID, a finding is an identified nonconformance or noncompliance with a requirement in a relevant standard. The term finding is used synonymously with the terms discrepancy, defect, and deficiency (with or without the word quality as a modifier). A finding may consolidate multiple like instances of nonconformance or noncompliance that represent a pattern, trend, or widespread phenomenon, particularly if they are suspected to stem from a single root cause.

c. In the scope of this DID, a response includes one or more actions taken to contain the spread of the defect, determine the significance or effect of the defect, mitigate the impact of the defect, root cause analysis, correct the instant defect (manifested in a corrective action plan), and prevent the defect from recurring (manifested in a preventive action plan). A response typically includes verification (checking to see that the action plans were completed) and validation (checking to see that the problem was really fixed).

d. This DID applies to findings resulting from on-site or off-site audits that support one or more quality standards with requirements related to monitoring, surveillance, accreditation, or certification. Such findings directly support certification to one or more relevant quality standard(s). The term certification shall be understood to include accreditation and validation as well as any equivalent or similar terms used by relevant standard(s).

e. In the scope of this DID, a quality audit finding and response record is incomplete until reconciliation occurs. The auditing entity that issued the finding must reconcile the response with the finding, which means it must evaluate and accept the response to determine that compliance has been achieved (conformance with the standard). Sometimes this will require verification or validation on the part of the auditing entity. Other times, a simple review will suffice. Once reconciliation occurs, the auditing entity closes the finding. Documentation of closure is a critical element in maintaining certification to a quality standard. If the auditing entity (also called a certification body or registrar) does not accept the response and does not close the finding, certification may be in jeopardy. Although closure ends the process, mandating closure of findings in this DID would render certification meaningless and would violate the standard for which certification was being sought. For this reason, closure is not an element of the DID.

f. This DID is applicable when a Government organizational unit enters into a contract, interagency agreement, or other formal relationship where the unit is audited to one or more standard(s). All references to a contract herein shall be understood to refer to any agreement made in writing between the audited unit and the auditing entity.

g. This DID also applies to internal audits or self-audits, especially if the audit is performed by a private business on itself as part of an overall quality management system or plan.

h. This DID can be achieved only when auditors possess those certifications, accreditations, or other credentials required pursuant to the relevant standard. Likewise, the employing firm or agency must also have the certification, accreditation, or other credentials requisite for the audit.

i. Some examples of entities producing third-party standards to which this DID could apply are as follows: International Organization for Standardization (ISO), American Society for Quality (ASQ), American National Standards Institute (ANSI), International Electrotechnical Commission (IEC), and the Society of Automotive Engineers (SAE). This DID can also apply when the standard is created, maintained, or owned by an external Government agency (e.g., the Food and Drug Administration, Environmental Protection Agency, or Occupational Safety and Health Administration). Audits in support of a third-party standard typically will not be carried out by the third-party organization creating or promulgating the relevant quality standard.

j. Some examples of third-party quality standards to which this DID could apply are as follows: ISO9001 (Quality Management Systems - Requirements), ISO/IEC17025 (General Requirements for the Competence of Testing and Calibration Laboratories), ANSI/ISO/ASQ Q9001 (Quality Management Systems - Requirements), and SAE AS9100 (Quality Management Systems: Aerospace Requirements). This DID can also apply when the standard is a governmental standard (e.g., EPA or FDA Good Laboratory Practices or OSHA Voluntary Protection Program) that is created, maintained, or owned by an external agency. Such external governmental standards shall be regarded as third-party standards for the sake of this DID.

k. This DID may be used alone or in conjunction with other DIDs.

l. This DID may be used when the Government requires an external (independent) quality audit for a non-governmental entity and a finding is discovered.

m. This DID is a first issuance and does not supersede any other DID.

n. This DID specifically addresses nonconformances (findings) identified during audits rather than nonconformance identified by a customer. It contrasts with Standard Form 368 (SF-368), Product Quality Deficiency Report, which is used by a customer to identify nonconforming products tendered by the Government. It contrasts with DID DI-ALSS-81535, Deficiency Report, which is used by a contractor to identify nonconforming Government-furnished material (GFM) undergoing repair. It also contrasts with DID DI-QCIC-80736, Quality Deficiency Report, which is used by a contractor who receives nonconforming GFM. This DID does not apply to GFM. This QAFRR is more akin to AF Form 4395, Logistics Compliance Assessment Program (LCAP) Finding Response.