1. SC 18 Ad Hoc Task Group API Staff Issues Ed Durante, Chair

2. API Staff Issues 1. Design Process A) What is required for evidence of design when design is performed at satellite office or other offsite location? If the design location is an API Licensee or has a QMS registered by APIQR with design in the defined scope of registration: 1) Licensed facility must demonstrate access to design documents, with focus on the design output documents necessary to produce the product. 2) Additionally, the licensed facility must provide evidence of review and verification of design output documents to confirm conformance with product requirements. 3)Additionally, the licensed facility must provide evidence of completion of applicable product verification, validation, monitoring measurement, inspection and test activities to confirm conformance to product design requirements. (This may be provided in conjunction with meeting other elements of the QMS, such as clause 7.1) 4. Additionally, licensed facility must provide evidence of control of design documents from the design location, to include control of design changes.

3. API Staff Issues 1.Design Process B) If the design location is not an API Licensee: The design location must be treated as an outsource and controlled in accordance with applicable clauses of API Q1.

4. API Staff Issues 1. Design Process Guidance on closing findings when design output does not match design input requirements. A) When the violated design input is an API Product Spec requirement: 1) Determine potential risk of the problem (i.e. engineering evaluation) as it impacts the product’s performance. (May require getting additional information/clarification from the auditor, licensee and/or the customer). 2) Remove the monogram, when possible. 3)Provide evidence of Customer Notification and customer acknowledgement of receipt. 4)Establish root cause and determine corrective action(s) 5) Require re-audit to determine implementation and effectiveness of corrective action.

5. API Staff Issues 1. Design Process Guidance on closing findings when design output does not match design input requirements. A) When the violated design input is an in-house product design or customer provided design 1)Determine potential risk of the problem (i.e. engineering evaluation) as it impacts the product’s performance. (May require getting additional information/clarification from the auditor, licensee and/or the customer). 2)Provide evidence of Customer Notification and customer acknowledgement of receipt. 3)Establish root cause and determine corrective action(s) 4) Require re-audit to determine implementation and effectiveness of corrective action.

6. API Staff Issues 1. Design Process What type of evidence is required when design is outsourced? a)Provide evidence of supplier evaluation b)Provide evidence that all activities of Q1 Clause 7.3 have been met, including design planning, input, output, verification, validation and control of design changes. c)Provide evidence of a completed/validated design package. d)The licensed facility must provide evidence of review and verification of design output. e)The licensee must provide documents to confirm conformance with product specification requirements. f)The licensee must provide evidence of completion of applicable product verification, validation, monitoring measurement, inspection and test activities to confirm conformance to product design requirements. (This may be provided in conjunction with meeting other elements of the QMS, such as clause 7.1) g)The licensee must provide evidence of control of design documents from the design location, to include control of design changes.

7. API Staff Issues 2. Product Realization Package Is a product realization package an option if design is excluded or performed at offsite location? A “Product Realization Package” is currently not required however audit evidence must exist for the following: (Note: Evidence may include observation of activities and/or review of documentation.) 1)Licensee must provide evidence that they have identified the product requirements. 2)Licensee must provide evidence of that the product requirements have been documented for the production of the product(s). 3)Licensee must provide evidence that the production processes are appropriate for the products produced. 4)Licensee must provide evidence of access to equipment and other resources necessary to produce the product(s). 5)Licensee must provide evidence of product conformance to product requirements.

8. API Staff Issues 3. Centralized Design Allow for design exclusion at local, licensed sites? No. What types of process controls would be required? See Number 1, above.

9. API Staff Issues 4.What constitutes “manufacturing”? Rather than define “manufacturing”, we should define what constitutes a “manufacturer”. “Manufacturing” is effectively defined by the product specifications. A licensed “manufacturer” is an entity that effectively controls the processes that assemble components and/or change the attributes of raw materials to produce final products that conform to product spec requirements at the licensed facility.

10. API Staff Issues 4.What constitutes “manufacturing”? A)Define minimum facility requirements or capabilities for all product specifications and/or family of a product specification. Minimum facility requirements should be defined by the Product Specifications. B)For each product under licensing scope, provide details on minimum facility and/or process requirements/competencies? Minimum facility requirements should be defined by the Product Specifications. C)Expanded licensing scopes of activities (not just products)? This is a question for the newly formed Monogram Program Board.

11. API Staff Issues 5. Responding to Audit Findings (AAR’s) What is the difference between “reason” and “root cause” when answering an AAR? Quite often root causes are perceived and accepted when they are only reasons, i.e. “we did not know” or “we were not trained” or “we did not follow procedure”. Is it acceptable to now be “trained” and to now “follow a procedure” as a solution or should we require a dive into WHY? For example, would it be acceptable for us to require a “5 WHY” type of approach? The examples stated above should be considered “reasons” and should not be considered “root causes”. “Reason” is the direct cause, where “root cause” is what is required to be addressed in order to effectively prevent recurrence. Responses should include the logical sequence that was utilized to provide evidence that the root cause was effectively determined. Once they properly identified the root cause, provide evidence that the corrections and corrective actions have been effectively implemented to prevent recurrence.