DOE G 414.1-2B, Quality Assurance Program Guide

Preamble to DOE G 414.1-2B, Quality Assurance Program Guide, dated 8-16-11 Quality Assurance Program (QAP) Guide Enhancements Department of Energy (DOE) elements and DOE contractors should consult this Guide to develop and implement an effective Quality Assurance Program (QAP) consistent with the Department’s quality expectations of the Quality Assurance (QA) Order, DOE Order (O) 414.1D, Quality Assurance, dated 4-25-11, and 10 C.F.R. Part 830 Subpart A, Quality Assurance Requirements, and that supports DOE Policy (P) 450.4A, Integrated Safety Management Policy, dated 4-25-11. This DOE Guide includes enhancements arising from experience with implementing DOE O 414.1D and 10 C.F.R. Part 830 Subpart A. The Guide was evaluated in light of key policy initiatives, Directive changes, and other changes that have occurred within DOE since the Guide was last updated. Evaluation and coordination with user groups have identified specific major improvements to the Guide as follows: Clarified the scope of the guidance in accordance with the revisions to DOE O 414.1D. Revised to incorporate reference to International Atomic Energy Agency (IAEA) Technical Document, IAEA-TECDOC-1169, Managing Suspect and Counterfeit Items (S/CIs) in the Nuclear Industry. Revised to provide additional guidance on S/CIs that is not captured in IAEA-TECDOC- 1169. Enhanced the guidance on corrective action programs related to DOE QA Criteria 3, Quality Improvement. Added information pertaining to the Uniform Federal Policy for Implementing Environmental Quality Systems (UFP-QS) and Mixed Analyte Performance Evaluation Program (MAPEP). Enhanced design criteria to consider safety into design. Recommended Actions for Implementing DOE G 414.1-2B The Office of Quality Assurance (HS-33) recommends that DOE elements and contractor organizations take the following actions to ensure maximum benefit from the approach defined in this Guide: Make this Guide available to senior management responsible for establishing and maintaining the QAP and the Integrated Safety Management System (ISMS). Make this Guide available to employees responsible for developing implementing processes for these systems. Consider this Guide when reviewing new and existing DOE and contractor QAPs. Consider this Guide when planning and implementing Field Office QA assessments. Provide feedback on the usefulness of this Guide to the Office of Quality Assurance (HS-33), at 301-903-5452, colette.broussard@hq.doe.gov. Existing DOE and contractor QAPs should be reviewed to verify that: Applicable quality criteria are addressed and applied for mission accomplishment; environment, safety and health; safety system software; and radiation protection programs developed to meet the requirements of DOE O 414.1D and 10 C.F.R. Part 830 with regards to safeguards and security work; Appropriate national/international standards have been identified from the established requirements set and adopted to implement the QAP; and A senior management position with responsibility for the QAP is designated in the organization and the person identified for this position is appropriately qualified (e.g., see DOE-STD-1150-2002, Quality Assurance Functional Area Qualification Standard, dated April 2002 (or latest version) for DOE qualification requirements). mailto:colette.broussard@hq.doe.gov AVAILABLE ONLINE AT: INITIATED BY: https://www.directives.doe.gov Office of Health, Safety and Security

DOE G 414.1-2B 8-16-11 QUALITY ASSURANCE PROGRAM GUIDE [This Guide describes acceptable, but not mandatory, means for complying with requirements. Guides are not requirements documents and are not to be construed as requirements in any audit or appraisal for compliance with associated rule or directives.] U.S. Department of Energy Washington, D.C. 20585 NOT MEASUREMENT SENSITIVE DOE G 414.1-2B i 8-16-11 FOREWORD This Department of Energy (DOE) Guide is available for use by all DOE elements and their contractors for use with DOE Order 414.1D, Quality Assurance, dated 4-25-11 and 10 C.F.R. Part 830 Subpart A, Quality Assurance Requirements. DOE Guides are part of the DOE Directives System and are issued to provide supplemental information regarding the Department’s expectations of its requirements as contained in Rules, Orders, Notices, and regulatory standards. Guides may also provide acceptable methods for implementing these requirements. Guides are not substitutes for requirements, nor do they replace technical standards that are used to describe established practices and procedures for implementing requirements. This Guide should not be used as requirements in any audits or appraisals for compliance with associated rules or directives. Beneficial comments (recommendations, additions, deletions, and any other pertinent data) or questions regarding this document should be sent to: Colette A. Broussard Office of Quality Assurance, HS-33 U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585-1290 Phone (301) 903-5452 Fax (301) 903-6172 E-mail:colette.broussard@hq.doe.gov Internet: http://www.hss.doe.gov This Guide is available electronically on the DOE Directives System at the following address: http://www.directives.doe.gov http://www.directives.doe.gov/ ii DOE G 414.1-2B 8-16-11 Contents 1.0 INTRODUCTION ........................................................................................................................ 1 2.0 APPLICATION ............................................................................................................................ 1 3.0 DISCUSSION ............................................................................................................................... 2 4.0 GUIDANCE FOR Quality Assurance Programs .......................................................................... 3 4.1 Management/Criterion 1 – Program .......................................................................................... 3 4.1.1 Introduction ........................................................................................................................ 3 4.1.2 Responsibilities .................................................................................................................. 4 4.1.3 Graded Approach ............................................................................................................... 4 4.1.4 Integrating the Safety Management and Quality Assurance Program ............................... 6 4.1.5 Integration of QA Criteria into DOE O 226.1B, Implementation of DOE Oversight Policy ................................................................................................................................. 7 4.1.6 Use of Technical Standards ............................................................................................. 10

4.2 Management/Criterion 2 – Personnel Training and Qualification .......................................... 11 4.2.1 Introduction ...................................................................................................................... 11 4.2.2 Responsibilities ................................................................................................................ 11 4.2.3 Qualification of Personnel ............................................................................................... 12 4.2.4 Training ............................................................................................................................ 12 4.2.5 Training Plans .................................................................................................................. 13 4.3 Management/Criterion 3 – Quality Improvement ................................................................... 13 4.3.1 Introduction ...................................................................................................................... 13 4.3.2 Quality Improvement Processes ...................................................................................... 14 4.4 Management/Criterion 4 – Documents and Records .............................................................. 17 4.4.1 Introduction ...................................................................................................................... 17 4.4.2 Document Control System ............................................................................................... 17 4.4.3 Records Management System .......................................................................................... 17 4.5 Performance/Criterion 5 – Work Processes ............................................................................ 18 4.5.1 Introduction ...................................................................................................................... 18 4.5.2 Work Performance ........................................................................................................... 18 4.5.3 Identification and Control of Items .................................................................................. 19 4.5.4 Item Protection ................................................................................................................. 19 4.6 Performance/Criterion 6 – Design........................................................................................... 19 4.6.1 Introduction ...................................................................................................................... 19 4.6.2 Design Inputs ................................................................................................................... 20 4.6.3 Design Process ................................................................................................................. 20 4.6.4 Design Output .................................................................................................................. 21 4.6.5 Design Verification .......................................................................................................... 21 4.6.6 Design Changes ............................................................................................................... 21

4.7 Performance/Criterion 7 – Procurement ................................................................................. 22 4.7.1 Introduction ...................................................................................................................... 22 4.7.2 Procurement Documents .................................................................................................. 23 4.7.3 Supplier Qualification ...................................................................................................... 23 DOE G 414.1-2B iii 8-16-11 4.7.4 Supplier Performance Monitoring ................................................................................... 24 4.7.5 Inspection of Procured Items ........................................................................................... 24 4.7.6 Supplier Documentation .................................................................................................. 25 4.7.7 Procurement of Safety-Related Items for Nuclear Facilities/Activities .......................... 25 4.7.8 Multi-Site Procurement .................................................................................................... 26 4.8 Performance/Criterion 8 – Inspection and Acceptance Testing .............................................. 26 4.8.1 Introduction ...................................................................................................................... 26 4.8.2 Process ............................................................................................................................. 26 4.8.3 Control of Measuring and Test Equipment ...................................................................... 27 4.8.4 Records ............................................................................................................................ 27 4.9 Assessment/Criterion 9 – Management Assessment ............................................................... 27 4.10 Assessment/Criterion 10 – Independent Assessment .............................................................. 28 5.0 GUIDANCE ON SUSPECT AND COUNTERFEIT ITEMS .................................................... 28 5.1 Introduction ............................................................................................................................. 28 5.2 DOE O 414.1D Requirements and IAEA-TECDOC-1169 Matrix ......................................... 28 5.3 Responsibility in Reporting ..................................................................................................... 32 5.4 Occurrence Reporting and Information Exchange .................................................................. 32 5.4.1 Reporting S/CI Discovery ................................................................................................ 32 5.4.2 Government-Industry Data Exchange Program ............................................................... 33 5.4.3 Consultation with Office of General Counsel .................................................................. 33 5.4.4 S/CI Review, Analysis, and Notification ......................................................................... 33 5.5 Reporting S/CIs to DOE OIG ................................................................................................. 36 5.5.1 Authority .......................................................................................................................... 36 5.5.2 Reporting S/CIs to OIG ................................................................................................... 36

5.5.3 Successfully Prosecuting S/CI Cases ............................................................................... 38 APPENDIX A: QUALITY MANAGEMENT SYSTEM REVIEW AND APPROVAL TEMPLATE APPENDIX B: CONTACT INFORMATION FOR OFFICE OF INSPECTOR GENERAL – OFFICE OF INVESTIGATIONS APPENDIX C: REFERENCES APPENDIX D: DEFINITIONS APPENDIX E: ACRONYMS ATTACHMENT 1: QA ASSESSMENT PLAN TEMPLATE DOE G 414.1-2B 1 8-16-11 1.0 INTRODUCTION To accomplish the Department of Energy’s (DOE) missions and objectives, DOE and its contractors are responsible for the management and oversight functions of a wide range of work activities, including basic and applied research; product development; design, construction, operation, modification, decommissioning, and environmental remediation of DOE facilities and sites. This work should be accomplished safely while minimizing potential hazards to the public, site or facility workers, and the environment consistent with the quality assurance (QA) requirements of DOE Order (O) 414.1D, Quality Assurance, dated 4-25-11, and10 C.F.R. Part 830, Subpart A, Quality Assurance Requirements. The quality criteria of DOE O 414.1D and 10 C.F.R. Part 830 Subpart A provide the requirements for a Quality Assurance Program (QAP) which ensures work is consistent with DOE requirements and expectations. This Guide (G) revises and supersedes DOE G 414.1-2A, Quality Assurance Management System Guide for Use with 10 C.F.R. 830 Subpart A, Quality Assurance Requirements, and DOE O 414.1C, Quality Assurance, dated 6-17-05. This Guide also consolidates relevant guidance from and cancels DOE G 414.1-3, Suspect/Counterfeit Items Guide for Use with 10 C.F.R. 830, Subpart A, Quality Assurance Requirements, and DOE O 414.1B, Quality Assurance, dated 11- 3-04, and DOE G 414.1-5, Corrective Action Program Guide, dated 3-2-06. International Atomic Energy Agency (IAEA) TECDOC-1169, Managing Suspect and Counterfeit Items in the Nuclear Industry, dated August 2000, has been added as a reference to provide guidance on suspect and counterfeit item(s) (S/CI(s)). Reporting of S/CIs has been added to Section 5.0 of this Guide. All software use and development should meet the applicable QA requirements using a graded approach as described in this Guide. In addition, safety software, as defined in DOE O 414.1D, should follow DOE G 414.1-4, Safety Software Guide for Use with 10 C.F.R. 830, Subpart A, Quality Assurance Requirements and DOE O 414.1C, Quality Assurance, dated 6-17-05, to meet DOE QA requirements described in Attachment 4 of DOE O 414.1D. For additional guidance on management and independent assessments, see DOE G 414.1-1B, Management and Independent Assessments Guide for Use with 10 C.F.R. Part 830, Subpart A, and DOE O 414.1C, Quality Assurance, DOE M 450.4-1, Integrated Safety Management Systems Manual; and DOE O 226.1A, Implementation of Department of Energy Oversight Policy, dated 9-27-07. For additional guidance on project QA, see DOE G 413.3-2, Quality Assurance Guide for Project Management, dated 6-27-08. 2.0 APPLICATION This Guide provides information on principles, requirements, and practices used to establish and implement an effective QAP for both non-nuclear and nuclear facilities consistent with the requirements of DOE O 414.1D and 10 C.F.R. Part 830 Subpart A, hereafter referred to as the QA Order and the QA Rule, respectively. Additional resources are available at:

http://www.hss.doe.gov/nuclearsafety/qa. http://www.hss.doe.gov/nuclearsafety/qa 2 DOE G 414.1-2B 8-16-11 This Guide may also be used by a contractor to assist in obtaining QAP approval from its DOE customer. If this Guide is in conflict with any Regulations, Orders or any contractor requirements document (CRD), the Regulation, Order, or CRD takes precedence. The methods and references described in this Guide are not mandatory and do not add, modify, or delete any requirements identified in the QA Order and QA Rule. Use of this Guide in conjunction with appropriate standards will facilitate development and approval of a QAP compliant with the QA Order and QA Rule. An organization may select alternative methods to document and implement its QAP as long as the QA regulatory requirements in the QA Rule and the additional QA requirements in the QA Order are satisfied for nuclear facilities, and all QA requirements in the QA Order are satisfied for non-nuclear facilities. The content of the QAP should be based on an organization’s unique set of responsibilities, products and services, hazards, and customer expectations. NOTE: Throughout this document, when the QA Rule is mentioned, the QA requirements from the QA Rule pertain to nuclear facilities/work only. The QA Order also contains requirements that are not found in the QA Rule (i.e., S/CI and safety software quality assurance (SSQA)). The S/CI requirements are applicable to both nuclear and non-nuclear work. The SSQA requirements are only applicable to nuclear facilities or nuclear work. This guidance includes methods for the interrelated functions and responsibilities of managing, performing, and assessing work. Implementation of a QAP will contribute to improved safety, quality, management, and reliability of DOE products and services. 3.0 DISCUSSION The quality of a product or service is the extent to which that product or service satisfies the requirements, needs, and expectations of the customer. As used in this Guide, the term ―customer‖ includes those entities that receive products and services from the organization. The attainment of quality is the responsibility of each member of an organization. The quality criteria of the QA Order and QA Rule provide the framework for a results-oriented management system that focuses on performing work safely and meeting mission and customer expectations while allowing the organization to become more efficient through process improvement. DOE’s objective is to accomplish its missions while simultaneously satisfying the QA Order, integrated safety management system (ISMS), policies and regulations, and the QA Rule (if performing nuclear work). The development and implementation of a QAP, which is implemented throughout the organization, will improve performance and provide assurance that the applicable requirements are being satisfied. The implementation of QA requirements are achieved using a graded approach. The QA requirements in the QA Order (i.e., the 10 criterion) apply to all software. Calculations and results derived from software should meet the applicable requirements using a graded approach as described in Section 4.1.3 of this Guide. Other available guidance is found in the American Society of Mechanical Engineers (ASME) NQA-1, Quality Assurance Requirements for Nuclear Facility Applications, Subpart 4.1, Application Appendix: Guide on Quality DOE G 414.1-2B 3 8-16-11

Assurance Requirements for Computer Software. In addition, SSQA guidance can be found in DOE G 414.1-4, Safety Software Guide and in ASME NQA-1, Subpart 2.7, Quality Assurance Requirements for Computer Software for Nuclear Facility Applications. For definitions of software and safety software, see the QA Order. 4.0 GUIDANCE FOR QUALITY ASSURANCE PROGRAMS 4.1 MANAGEMENT/CRITERION 1 – PROGRAM 4.1.1 Introduction The QA Order and the QA Rule require that an organization develop, document, implement, and maintain an effective QAP. The goal of the QAP is delivery of safe, reliable products and services that meet or exceed the customer’s requirements, needs, and expectations. The QAP is defined as the overall program or management system established to assign responsibilities and authorities, define policies and requirements, and provide for the performance and assessment of work. Defining the proper structure for the organization and the management processes necessary to conduct work within the organization is critical to assure that work can be controlled and conducted safely. This allows the organization to efficiently conduct work safely, as well as meeting or exceeding applicable requirements and expectations. 4.1.1.1 Organization The first part of developing a management system is to define the organization and its responsibilities. A well-defined organization allows individuals to understand its structure, how it operates, and provides for the desired effectiveness within the organization. Organizations should be defined and documented in sufficient detail. This allows those inside and outside the organization to adequately identify its structure, roles and responsibilities, and the authorities assigned to the individuals within the organization. In addition, interfaces within the organization should be defined in order to avoid ―stove piping‖ and a lack of communication between organizational elements. 4.1.1.2 Quality Assurance Program/Management System The criteria of the QA Order and the QA Rule prescribe a comprehensive management system for DOE work. Work should be properly defined in order to ensure that it is controlled, conducted safely, on time, and that it meets applicable requirements established by the customer, government agencies, and those internal to the organization. Organizations should establish and define documented processes that identify how the organization takes requirements for work. In addition, the organization should develop the necessary analysis, plans, strategies, and courses of action. Management should evaluate these processes on a periodic basis to assure that they remain up to date and that they remain useful and effective in allowing the organization to efficiently meet its commitments. The focus of the QAP should be to properly and safely accomplish the DOE mission. The QAP should be integrated with the ISMS as described in DOE P 450.4, Integrated Safety Management 4 DOE G 414.1-2B 8-16-11 Policy, dated 4-25-11, and DOE Acquisition Regulation 48 C.F.R. 970.5204-2 [i.e., the DEAR ISMS clause]. 4.1.2 Responsibilities The QAP should describe the organizational structure and interfaces, functional responsibilities, and levels of authority. The role of DOE and contractor senior management is to establish and cultivate principles that integrate quality requirements into daily work. Management is responsible for leadership and commitment to quality achievement and improvement in a way

that ensures the safety of the public, workers, and the environment. Management retains the primary responsibility and accountability for the scope and implementation of the QAP. However, every individual in the organization is responsible for achieving quality in his or her activities. Senior management should require and cultivate the achievement and improvement of quality at all levels of the organization and ensure that the QAP is understood and implemented. In addition, senior management is responsible for establishing the processes, including planning, scheduling, and providing resources for the work. DOE and contractor senior management should ensure flow down of the QA requirements and responsibilities throughout all levels of the organization. In addition, DOE should ensure proper oversight of the flow down of requirements by their contractors to subcontractors, vendors and suppliers. Management should promote effective achievement of performance objectives through integrated implementation of the QAP and ISMS. 4.1.3 Graded Approach A graded approach to implementing the QAP complies with requirements, rules, and regulations, and cannot compromise public, employee, or facility safety or adversely impact the environment. The graded application of facility/activity requirements is dependent on the hazards and/or level of risk associated with the activity or structures, systems, and components (SSCs) under consideration. The scope, depth, and rigor of the QAP’s application of requirements should be determined by the use of a grading process, before performing the activity. The purpose of grading is to select the controls and verifications to be applied to various items and activities consistent with their importance to safety, cost, schedule, and success of the program. Care should be taken to not double grade. Once the requirements (technical and quality) are specified in the technical procurement documents, the grading should have been done and this becomes the set of requirements that should be met. Consider the use of grading if a single or uniform method of applying a requirement across a facility or activity does not add value or reduce risk. The grading process provides the flexibility to design controls that best suit the facility or activity. The grading process is not used to obtain exemptions from the requirements of the QA Order or the QA Rule. The grading process is used to determine the appropriate controls to address and mitigate hazards and/or risks. This process is accomplished by deliberate quality planning and is based on activity-specific or facility-specific factors such as: DOE G 414.1-2B 5 8-16-11 the relative importance to safety, safeguards, and security; the magnitude of any hazard or risk involved; the life-cycle stage of a facility or activity; impact/consequences on the programmatic mission of a facility; the particular characteristics of a facility or activity; the relative importance of radiological and nonradiological hazards; and any other relevant factors. The first step in the grading process is to identify the hazards, consequences, and probability of failures for the work being performed. The second step is to specify the requirements and controls to be applied. The third step is to determine the depth, extent, and degree of rigor necessary in the application of the requirements and controls. The final step is to communicate

and implement the appropriate requirements and controls. The necessary degree of rigor should be applied by means of documented work processes (procedures, instructions, specifications, and controls). The logic, method of implementation, and basis for grading should be documented in the QAP, periodically reviewed in light of changes that may have occurred, and, if appropriate, revised to reflect those changes. The graded approach cannot be used to ―grade quality assurance criterion to zero,‖ which has the effect of eliminating all verifications of the requirement (―to get out of work‖). Even in the least stringent application, compliance with applicable portions of stated requirements is mandatory unless an exemption is approved through an appropriate process. When considering the use of grading of an item or activity, it is important to consider the impact of safety on personnel, the public, and the environment. The safety class or safety significance of the item or activity is critical to the amount of controls imposed which are necessary to assure the requisite or desired quality. Risk is a fundamental consideration in determining the extent to which controls should be applied at the facility level. The varying degrees of the controls applied should be dependent upon function, complexity, consequence of failure, reliability, repeatability of results, and economic considerations. These controls are documented and communicated to facility/activity personnel to ensure appropriate application. This documentation should take the form of written procedures, practices, requirements documents, policy statements, standing orders, or other written and controlled means as deemed appropriate by facility/activity management. The level of approval of this documentation is also based on the hazards, complexity, and/or relative risk. Based on an evaluation using these risk factors as applicable, the QAP requirements may be selected for DOE and NNSA funded facilities, activities or organizations. Depending on the evaluation, the applicable QAP requirements could be extensive and very prescriptive or few with only limited prescription requirements or few with a combination of limited and very prescriptive requirements. As examples, if a contractor is tasked with designing a safety- related or mission important item or facility, the most important QAP requirement would be the design control processes, consequently the specified QAP requirements would likely include ASME NQA-1 Requirement 3, Design Control, requirements as well as less 6 DOE G 414.1-2B 8-16-11 prescriptive requirements for organization, training, document control, records and assessments. If this task was managed by a Headquarter organization, their specified QAP would emphasize the review and acceptance of deliverables, performance of contractor assessments (technical and QAP) and less prescriptive requirements for organization, training, and records. In contrast with the example of a contractor responsible for a single design would be a contractor assigned the task of constructing or modifying a safety-related or mission important facility. Due to the risks associated with these facilities, all applicable requirements of a national consensus standard, such as ASME NQA-1, would be specified with the possible exception of Requirement 3 regarding design control. Assuming this work is managed by a

Site Office, their QAP would emphasis training, and the review, inspection and the assessment of the contractor activities. The Site Office QAP could designate NQA-1, graded as appropriate, or an International Organization for Standardization (ISO) as the standard to implement the QA requirements. (Additional examples of grading are provided in ASME NQA-1, Subpart 4.2, Guidance on Graded Application of Quality Assurance (NQA) Standard for Research and Development.) 4.1.4 Integrating the Safety Management and Quality Assurance Program The QAP should be integrated with the ISMS, as described in DOE P 450.4A, Integrated Safety Management Policy, dated 4-25-11 and DOE Acquisition Regulation 48 C.F.R. § 970.5204-2. The QAP provides processes and tools for ensuring that ISMS objectives are achieved. DOE P 450.4A expresses a fundamental expectation that work will be performed safely. The ten criteria of the QA Order and the QA Rule define the generic elements of a management system applicable to DOE work. They are implemented using a graded approach based on an evaluation of the risks associated with the work to be performed. The Safety Management System (SMS) defined in DOE O 450.2, Integrated Safety Management, dated 4-25-11, selectively applies and amplifies the generic management system requirements defined in by the ten criteria to ensure that DOE work is performed safely. This also ensures that workers, the environment, and the public are reasonably protected from harm. At the organizational or institutional level, the DOE quality and safety requirements share a management systems approach (see Table 1 below) to achieving their objectives. Therefore, the required system documentation for each ISMS description and QAP may be integrated into a single document to describe how the organization intends to implement the requirements. In some cases, the local DOE office (Site Office or Field Element) and contractor may determine that maintaining both an ISMS description and a QAP is expedient. In such cases, at a minimum, the implementing mechanisms that are described in each should be integrated to the maximum extent practical, and the system description and the QAP should cross-reference these procedures as applicable. For example, the processes and procedures for conducting management assessments should be referenced in both the QAP and the ISMS description. The table shown below is representative of criteria that apply, but is not all inclusive. DOE G 414.1-2B 7 8-16-11 Table 1: Integration of QA Criteria into the Safety Management System (SMS) Principles and Functions QA Criteria P ro gr am Tr ai n in g an d Q u al if ic at io n Q u al it y Im p ro ve m en t D o cu m en ts a n d R ec o rd s W o rk P ro ce ss es D es ig n P ro cu re m en t In sp ec ti o n /A cc ep ta n ce Te st in g M an ag em en t A ss es sm en t In d ep en d en t A ss es sm en t SMS Principles and Functions Principles 1. Line Management Responsibility for Safety X X X 2. Clear Roles and Responsibilities X X X X X 3. Competence Commensurate with Responsibilities X X 4. Balanced Priorities X X X 5. Identification of Safety Standards and Requirements X X X X X X 6. Hazard Controls Tailored to Work Being Performed X X X 7. Operations Authorization X X

Core Functions 1. Define the Scope of Work X X X X 2. Analyze the Hazards X X 3. Develop and Implement Hazard Controls X X 4. Perform Work Within Controls X X X 5. Provide Feedback and Continuous Improvement X X X X X Note: X indicates cross reference delineating (a) when the QA criteria and the principle/function have shared intent or (b) when the QA criterion is applied to the ISMS principle or function. If the implementation of QA requirements in ISMS overlaps closely, then use the same implementation process for both. Likewise, a single process (e.g., procedures and plans) that satisfies quality and safety requirements at the facility level and the activity level should be used. DOE G 450.4-1B, Integrated Safety Management System Guide (Volume 1) for Use with Safety Management System Policies (DOE P 450.4, DOE P 450.5, and DOE P 450.6); The Functions, Responsibilities, and Authorities Manual; and the DOE Acquisition Regulation, dated 3-1-01, contains information on safety management principles, supporting attributes, references, and integration methods. 4.1.5 Integration of QA Criteria into DOE O 226.1B, Implementation of DOE Oversight Policy DOE has the responsibility to perform oversight on DOE programs to ensure safe operations at the department facilities and activities. Table 2 below is an example of how oversight requirements overlap with QA requirements. 8 DOE G 414.1-2B 8-16-11 Table 2: Integration of QA Criteria into DOE O 226.1B, Implementation of DOE Oversight Policy QA Criteria P ro gr am Tr ai n in g an d Q u al if ic at io n Q u al it y Im p ro ve m en t D o cu m en ts a n d R ec o rd s W o rk P ro ce ss es D es ig n P ro cu re m en t In sp ec ti o n /A cc ep ta n ce Te st in g M an ag em en t A ss es sm en t In d ep en d en t A ss es sm en t DOE O 226.1 REQUIREMENTS 4 REQUIREMENTS a. All applicable DOE organizations must: 1) Establish and implement an effective oversight program consistent with DOE O 226.1B and the requirements of this order X X X X X X 2) Maintain sufficient technical capability and knowledge of site and contractor activities to make informed decisions about hazards, risks and resource allocation; provide direction to contractors; and evaluate contractor performance X X b. Oversight processes implemented by applicable DOE line management organizations must: 1) Evaluate contractor and DOE programs and management systems, including site assurance systems, for effectiveness of performance (including compliance with requirements). Such evaluations must be based on the results of operational awareness activities; assessments of facilities, operations, and programs; and assessments of the contractor’s assurance system. The level and/or mix (i.e., rigor or frequency in a particular area) of oversight may be tailored based on considerations of hazards, the maturity and operational performance of the contractor’s programs and management systems. X X X 2) Include written plans and schedules for planned assessments, focus areas for operational oversight, and reviews of the contractor’s self-assessment of processes and systems. Address the role of the Central Technical Authorities and their support staff for core nuclear safety functions. X X X X

3) Include DOE Headquarters line organizations’ conduct of oversight processes that are focused primarily on their DOE Field Elements, including reviewing contractor activities to the extent necessary to evaluate the implementation and effectiveness of the Field Element’s oversight of its contractors. X X X X DOE G 414.1-2B 9 8-16-11 QA Criteria P ro gr am Tr ai n in g an d Q u al if ic at io n Q u al it y Im p ro ve m en t D o cu m en ts a n d R ec o rd s W o rk P ro ce ss es D es ig n P ro cu re m en t In sp ec ti o n /A cc ep ta n ce Te st in g M an ag em en t A ss es sm en t In d ep en d en t A ss es sm en t DOE O 226.1 REQUIREMENTS 4) Include an issues management process that is capable of categorizing findings based on risk and priority, ensuring relevant line management findings are effectively communicated to the contractors, and ensuring that problems are evaluated and corrected on a timely basis. The issues management process must ensure for issues categorized as high significance findings: X X a) A thorough analysis of the underlying causal factors is completed X X b) Corrective actions that will address the cause(s) of the findings and prevent recurrence are identified and implemented; X X c) After completion of a corrective action or a set of corrective actions, the conduct of an effectiveness review using trained and qualified personnel that can verify the corrective action/corrective action plan has been effectively implemented to prevent recurrences; X X d) Documentation of the analysis process and results described in (a) and maintenance tracking to completion of plans and schedules for the corrective actions and effectiveness reviews described in (b) and (c) above, in a readily accessible system; and X X e) When findings and/or corrective actions apply to more than one Secretarial Office, a lead office is appointed by mutual agreement between the affected Secretarial Officers. X X 5) Be tailored according to the effectiveness of contractor assurance systems, the hazards at the site/activity, and the degree of risk, giving additional emphasis to potentially high consequence activities. X c. DOE line management must establish and communicate performance expectations to contractors through formal contract mechanisms. Such expectations (e.g., safety performance measures and commitments) must be established on an annual basis, or as otherwise required or determined appropriate by the Field Element. X X d. DOE line management must have effective processes for communicating oversight results and other issues in a timely manner up the line management chain, and to the contractor as appropriate, sufficient to allow senior managers to make informed decisions. X X X X X 10 DOE G 414.1-2B 8-16-11 QA Criteria P ro gr am Tr ai n in g an d Q u al if ic at io n Q u al it y Im p ro ve m en t D o cu m en ts a n d R ec o rd s W o rk P ro ce ss es D es ig n P ro cu re m en t In sp ec ti o n /A cc ep ta n ce Te st in g M an ag em en t A ss es sm en t In d ep en d en t A ss es sm en t DOE O 226.1 REQUIREMENTS e. For activities and programs at Government-owned and Government- operated facilities and sites that are not under the cognizance of a DOE Field Element, DOE Headquarters program offices must establish and implement comparably effective oversight processes consistent with requirements for the contractor assurance system (see Attachment 1 of this Guide) and DOE line management oversight processes.

X X Note: X indicates cross-reference delineating when the QA criteria are applied to the requirements DOE O 226.1B. 4.1.6 Use of Technical Standards The Government-wide philosophy of using performance expectations in combination with national and international consensus standards is consistent with the National Technology Transfer and Advancement Act of 1995 (P.L. 104-113), Office of Management and Budget (OMB) Circular A-119, Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities, and DOE O 252.1A, Technical Standards Program, dated 2-23-11. The QA Order requires the QAP to clearly identify which standards, or parts of the standards, are used to address the requirements. ASME NQA-1, Subpart 4.5, Application Guide on the Use of NQA-1-2008/1a-2009 for Compliance With Department of Energy Quality Assurance Requirements 10 CFR 830 Subpart A and DOE O 414.1, provides additional guidance on identifying gaps between DOE QA requirements and NQA-1 requirements. Additional guidance can also be found in the Energy Facility Contractors Group (EFCOG) publication titled EFCOG White Paper on NQA-1 Part II Application at http://www.efcog.org/wg/ism/docs/EFCOG_White_Paper_on_NQA-1_Subpart_2%20.pdf. 4.1.7 Other Appropriate Quality Program Guidance 4.1.7.1 Uniform Federal Policy for Implementing Environmental Quality Systems In many cases, the particular standards to be used are specified by the customer. The standards selected should suit the products and services of the organization and its customers. One example is the use of the Intergovernmental Data Quality Task Force Uniform Federal Policy for Implementing Environmental Quality Systems Evaluating, Assessing, and Documenting Environmental Data Collection/Use and Technology Programs, Version 2, March 2005 (UFP- QS). The UFP-QS outlines essential elements of a quality system (see definition of Quality System in Appendix D of this Guide) for management of environmental data collection and use. http://www.efcog.org/wg/ism/docs/EFCOG_White_Paper_on_NQA-1_Subpart_2%20.pdf DOE G 414.1-2B 11 8-16-11 The UFP-QS provides a framework to ensure that essential elements of a quality system are addressed. The UFP-QS should be used to develop a new Quality System or to evaluate the adequacy of an existing quality system. The results of that evaluation should be used to develop plans for correcting identified deficiencies in the quality system. The UFP-QS policy was developed as a joint initiative between the U.S. Environmental Protection Agency (EPA), the Department of Defense (DoD), and the Department of Energy (DOE) to resolve data quality inconsistencies and/or deficiencies in quality systems. The UFP- QS represents a voluntary consensus policy. The benefits of the use of the UFP-QS across Federal agencies include: improved effectiveness of Federal environmental programs by focusing on results, quality of data and services, and customer satisfaction; clarification of roles and responsibilities in managing and overseeing environmental data and environmental technology programs; sufficient confidence in the systems such that duplication of oversight efforts are minimized; and enhanced accountability and public confidence in environmental decisions. 4.1.7.2 The Department of Energy’s Mixed Analyte Performance Evaluation Program Analytical laboratories providing environmental analyses on behalf of DOE should participate in

an approved proficiency testing program such as DOE’s corporate Mixed Analyte Performance Evaluation Program (MAPEP). The purpose of MAPEP is to foster reliability and credibility for the analytical results used in the decision making process, particularly for those decisions affecting the environment, public health, and safety. Proficiency testing should be conducted on a semi-annual basis for radiological, inorganic, and organic constituents in various environmental media. Liquid MAPEP samples are prepared from radiological and stable inorganic standards traceable to the National Institute of Standards and Technology (NIST). Final concentrations for these analytes are calculated from the NIST certified standard value and the standard dilution(s) used. Solid samples are prepared from natural soil matrices spiked with NIST traceable standards for the various analytes of interest. For more information, see http://www.hss.doe.gov/CSA/analysis/asp/index.html. 4.2 MANAGEMENT/CRITERION 2 – PERSONNEL TRAINING AND QUALIFICATION 4.2.1 Introduction Qualification and training processes ensure that personnel achieve and maintain the required capabilities to perform their work. 4.2.2 Responsibilities Management is responsible for committing resources to facilitate the training and qualification http://www.hss.doe.gov/CSA/analysis/asp/index.html 12 DOE G 414.1-2B 8-16-11 processes for personnel in their organizations and ensuring that personnel hired or transferred into positions meet the appropriate requirements. Each level of the organization should adequately describe its training and qualification needs including the need for continued training to maintain job proficiency. These descriptions should include requirements, interfaces, training methods, training responsibilities, and duties of line and training organizations. 4.2.3 Qualification of Personnel Policies and procedures that describe personnel selection, training, and qualification requirements should be established for each function and follow Federal, State, and local guidelines, as applicable. These should include the minimum applicable requirements for education, experience, skill level, and physical condition. For example, DOE personnel responsible for oversight of QA at defense nuclear facilities are qualified per requirements of DOE O 426.1, Federal Technical Capability, dated 11-19-09. Likewise, the contractor requirements in DOE O 426.2, Personnel Selection, Training, Qualification and Certification Requirements for DOE Nuclear Facilities, dated 4-21-10, establishes selection, training, qualification, and certification requirements for contractor personnel who can impact the safety basis through their involvement in the operation, maintenance, and technical support of Hazard Category 1, 2, and 3 nuclear facilities. In accordance with the requirements in DOE O 426.1, senior management’s workforce analyses should identify QA and Software Quality Assurance (SQA) positions as critical technical positions. QA and SQA positions have responsibilities related to the safe operation of the facility and require specialized skills. Before personnel are allowed to work independently, management should ensure personnel have the necessary experience, knowledge, skills, and abilities. Personnel should be qualified based on factors such as: previous experience, education, and training; performance demonstrations or tests to verify previously acquired skills;

completion of training or qualification programs; and/or on-the-job training. 4.2.4 Training Training assists personnel in acquiring knowledge of the correct and current processes and methods to accomplish assigned tasks. It enables personnel to understand the fundamentals of the work, the associated hazards, the context within which the work is performed, and the reasons for any special work requirements. Training should also include appropriate stop work responsibility/authority and action/response in abnormal/emergency situations. Initial training should prepare personnel to perform their job. Continuing training should maintain and promote improved job performance and proficiency. Training can be grouped into the following categories: 1. Project-/task-specific training should impart the knowledge required for personnel to perform their assigned duties safely and successfully. This training may include project/task goals and schedules, implementing procedures, safety and hazard controls, DOE G 414.1-2B 13 8-16-11 methods, requirements, process metrics, and skills. Project/task-specific training requirements should be defined by project managers and the workers. 2. Site-/facility-specific training should convey the safety, emergency plans, security, and operations information necessary for personnel to prepare for and perform their assigned duties in the site/facility. Management is responsible for defining training requirements and ensuring that the training is administered. 3. Institutional training should convey general information about the organization’s mission, vision, goals, and management system, including a QAP overview. It may also include general knowledge or skills training. 4. QA personnel training should deliver knowledge of the QA requirements. For Federal employees performing oversight for nuclear facilities, DOE O 414.1D requires the use of DOE-STD-1150-2002, Quality Assurance Functional Area Qualification Standard, dated April 2002. This standard can be used for qualifying other QA personnel as well. 5. Safety software QA personnel training should provide knowledge of safety software requirements. For Federal employees performing oversight for nuclear facilities, DOE O 414.1D requires the use of DOE-STD-1172-2011, Safety Software Quality Assurance Functional Area Qualification Standard. This standard can be used for qualifying other safety software quality personnel. 6. Weapon QA personnel training should provide knowledge of the NNSA requirements. For Federal employees performing oversight for nuclear facilities, DOE O 414.1D requires the use of DOE-STD-1025-2008, Weapon Quality Assurance Qualification Standard. Contact the National Training Center (NTC) for additional training available at http://NTC.DOE.gov. 4.2.5 Training Plans Training plans should: be prepared for personnel responsible for managing, planning, performing, controlling, and overseeing work; be based on the function and responsibilities of the job and any specific qualification requirements; be based on current facility, site, or organization procedures; technical and professional references; and past organization/industry experience; consider changes in hazard conditions, technology, work methods, and job responsibilities; and specify the type of training records to be maintained. 4.3 MANAGEMENT/CRITERION 3 – QUALITY IMPROVEMENT 4.3.1 Introduction

Efforts related to quality improvement are intended to identify, control, and improve items, services, and processes. Improvement processes also detect and prevent problems while http://ntc.doe.gov/ 14 DOE G 414.1-2B 8-16-11 identifying the causes of problems and work needed to prevent recurrence of problems through corrective actions. The quality improvement process is a disciplined management process based on the premise that all work can be planned, performed, measured, and improved. Management should ensure that the focus is on improving the quality of products, processes, and services by establishing priorities, promulgating policy, promoting cultural aspects, allocating resources, communicating lessons learned, and resolving significant management issues and problems that can hinder the organization from achieving its objectives. Management should balance safety and mission priorities when considering improvement actions, and implement safety and ISMS for their operations and work practices, based on the ISM guiding Principles provided in DOE P 450.4A. Management should encourage employees to plan, develop, explore, and implement new ideas for improving products, processes, and services. Management commitment can be demonstrated by empowering employees to: identify and report problems; identify opportunities for improvement; identify ―best management practices;‖ develop alternative approaches for addressing problems and recommend improvements (e.g., reducing process variability or cycle time); implement the approved solution; evaluate the improvement; and provide lessons learned to other organizations. Identified problems and other related information (both positive and negative) from internal and external sources should be reviewed and analyzed to identify improvement opportunities. Implemented improvements should be monitored and methods established to verify their effectiveness. 4.3.2 Quality Improvement Processes An effectively planned and implemented QAP is one that: uses feedback to improve items, services and the associated processes that produce them; prevents or minimizes quality problems; corrects problems that occur; measures the effectiveness of corrective actions; and uses performance measures to identify strengths and weaknesses. Preventive action minimizes the occurrence of quality problems through appropriate design, inspection, procurement, and other process controls and assessment activities. DOE and contractor organizations should prioritize and focus their resources on preventive actions and on those quality problems that have the greatest potential for: posing adverse safety risks to the environment and human health; DOE G 414.1-2B 15 8-16-11 impacting the reliability of operations and products; and affecting the ability to meet customer requirements. As used in this Guide, a quality problem is a collective term that may be: a deficiency in an activity, product, service, item characteristic, or process parameter; a noncompliance to a requirement; an indeterminate/substandard condition, or a suspect/counterfeit item (S/CI) as defined in IAEA-TECDOC-1169; or conditions adverse to quality and/or significant conditions adverse to quality. 4.3.2.1 Quality Feedback Work activities and management systems can be continuously improved through assessment and feedback processes. Effective feedback from multiple sources is the foundation for processes

designed to prevent, identify, and correct problems. The least desirable form of feedback results from accidents or unplanned events that self-disclose the quality problem. The process should include the use of lessons learned from the local organization and other organizations. Identified improvement actions should also be shared with other organizations. Management should track the actions to closure and ensure that the actions are effective in providing the anticipated improvements. Implementing effective feedback processes can support meeting the requirements for the ISM core function on providing feedback and continuous improvement. Additionally, contractors at DOE facilities should develop and maintain implementing procedures for the occurrence reporting and utilization of the requirements stated in DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, dated 8-19-03. This directive requires that all notifications to DOE be timely in accordance with the significance of the occurrence and that the written notification contain appropriate information describing the occurrence, significance, causal factors, and corrective actions. DOE’s Noncompliance Tracking System (NTS), operated and managed by DOE’s Office of Enforcement, is another source of information for feedback on quality-related events. NTS is DOE’s centralized, web-based system that allows contractors to voluntarily report non- compliances of nuclear safety and worker safety, and health regulations, including the QA Rule. . See http://www.hss.doe.gov/enforce/Final_EPO_June_2009_v4.pdf for more information. 4.3.2.2 Identification of Problems Affecting Quality Problems affecting quality may be identified by internal organization sources (e.g., workers, customers, suppliers) or external sources (e.g., customers, regulators). Once identified, problems should be documented and evaluated to determine their significance. The method for determining the significance of a problem and the process for handling problems should be documented as part of the QAP. The causes of problems should be investigated and identified. Causes should be corrected to prevent recurrence of the problem. For straightforward problems, a simpler apparent cause http://www.hss.doe.gov/enforce/Final_EPO_June_2009_v4.pdf 16 DOE G 414.1-2B 8-16-11 process may be appropriate. For more serious or complex problems, a disciplined root cause analysis with a formal extent of condition review should be considered. Problems that are not significant, but can be readily corrected, should be identified and documented (e.g., by logging). These types of problems may be handled in an expedient manner that may not necessarily need to follow the more formal processes for problem documentation (e.g., nonconformance report) disposition and corrective action. Safety software problems have specific guidance in DOE G 414.1-4. 4.3.2.3 Corrective Action/Resolution of Problems Affecting Quality Problems which affect quality may be referred to as conditions adverse to quality and/or significant conditions adverse to quality, should be identified and corrected as soon as possible. The identification and reporting process should be documented and include a standard categorization of problem findings based on significance, criticality, severity, and potential impact on the safety, security, and mission of the site/organization. A corrective

action/resolution process should consist of the appropriate steps, such as (the list is neither all inclusive nor limited to): identifying a condition adverse to quality, and/or significant condition adverse to quality; taking appropriate actions as required to mitigate, stabilize and/or prevent further progression of unsafe conditions or conditions adverse to quality; documenting the condition adverse to quality and/or significant condition adverse to quality; evaluating its significance and extent; analyzing the problem and determining its causes; reporting the planned actions to the organization identifying the problem; assigning responsibility for correcting the problem; taking prompt corrective (remedial) action and documenting that action; training or retraining personnel as appropriate; taking steps to prevent recurrence; verifying implementation; documenting closure; determining effectiveness of the corrective and preventive actions for significant problems; tracking and trending conditions adverse to quality as appropriate; and communicating lessons learned as appropriate. 4.3.2.4 Quality Performance Analysis Quality problems should be resolved individually and should also be analyzed as part of a collection to identify systemic quality problems and opportunities for process improvement. DOE G 414.1-2B 17 8-16-11 4.4 MANAGEMENT/CRITERION 4 – DOCUMENTS AND RECORDS 4.4.1 Introduction The document control and records management systems should describe the process to prepare, review, approve, issue, use, revise, and maintain documents and records. Documents and records should include applicable requirements to indicate that work (including safety) has been properly specified and accomplished. Management should identify any documents and records that should be developed and controlled. Management is responsible for providing the resources necessary to accomplish the document and record requirements. 4.4.2 Document Control System A document control system should be in place to control the preparation, review, approval, issue, control, and revision of documents. Documents should be used by organizations, projects, or programs to control policy and administrative and/or technical information. A document may describe work to be done, data to be used at different locations or by different people, or, in changing situations, data to be controlled for reference purposes. The document control system should be established to supply the appropriate documents (correct and applicable revision of the documents) necessary for personnel to safely and correctly perform assigned responsibilities. Document control systems ensure that the mechanisms developed to implement the safety management functions of DOE P 450.4A are properly prepared, controlled, and available for use. Completed documents should be classified as records. 4.4.3 Records Management System A record contains information that is retained for its expected future value. Records should be sufficient to support technical and regulatory decisions and provide objective evidence that work was performed. Records may be in a variety of forms (e.g., electronic, written, or printed; microfilm; photographs; radiographs; or optical disks). Typical records include procedures; plans; manuals; training and qualification results; quality improvement results; acceptance test results; technical/regulatory correspondence; operational records; design basis descriptions;

design review results; design revisions; configuration management data; and quality problem resolutions or any other required information. Examples of facilities related records are provided in ASME NQA-1, Requirement 17, Quality Assurance Records, and the non-mandatory Appendix 17a-1, Guidance on Quality Assurance Records. Records should be compiled in a records management system as described in DOE O 243.1, Records Management Program, dated 2-3-06. The system should include provisions for specifying, preparing, reviewing, approving, disposing, and maintaining records. Procedures for records retention, protection, preservation, correction, traceability, accountability, and retrievability should also be specified. The records management system should have schedules for records retention and disposition consistent with the requirements of DOE O 200.1A, Information Technology Management, dated 12-23-08. 18 DOE G 414.1-2B 8-16-11 The hardware and software tools used to create and store records should be maintained to ensure that the records can be retrieved. The records management system should have schedules for records retention and disposition consistent with the requirements of DOE O 243.1 and DOE O 243.2, Vital Records, dated 2-2-06. Additional information can be found in DOE G 1324.5B, Implementation Guide, dated 7-19-96, primarily implements 36 C.F.R. CHAPTER XII,- Subchapter B, Records Management. DOE G 1324.5B provides detailed non-mandatory guidance and an acceptable system for the organization, maintenance, and disposition of records. 4.5 PERFORMANCE/CRITERION 5 – WORK PROCESSES 4.5.1 Introduction Work should be performed consistent with technical standards, administrative controls, and hazard controls adopted to meet regulatory or contract requirements using approved instructions, procedures, or other appropriate means. Work processes consist of a series of actions planned and carried out by qualified personnel using approved procedures, instructions, and equipment under administrative, technical, and environmental controls to achieve a result. 4.5.2 Work Performance Managers are responsible for ensuring that personnel under their supervision have the training, skills (including knowledge and understanding of the capabilities of the processes being used), equipment, work process documents, and resources needed to accomplish work. Line management and workers should cooperate to identify processes that can be improved based on feedback prior to and following implementation of the work process. Before workers begin work, management should provide adequate information on: customer requirements; hazards associated with the work; safety, administrative, technical, environmental, and quality controls to be used during the work; technical standards applicable to the work and final product; data requirements for the work and final product; acceptance criteria applicable to the work and final product; and procedures for verification of the completed work using established criteria. Procedures, work instructions, or other appropriate means used to define work processes should be documented and controlled. The scope and detail of documentation should be commensurate with the complexity and importance of the work; the skills required to perform the work; the hazards and risks or consequences of quality problems in the product, process, or service; and

the need to meet regulatory and contract requirements. Control of processes, skills, hazards, and equipment should be clearly specified, understood, and fully documented. This can serve as the point of integration for the ISMS and QA into an integrated management approach. See DOE P 450.4A and DOE O 422.1, Conduct of Operations, dated 6-29-10 for further details and additional requirements. DOE G 414.1-2B 19 8-16-11 Workers are responsible for their work quality. Workers should do work correctly the first time in accordance with established procedures and work instructions. Because workers are the best resource for contributing ideas for improving work processes, products, and services, workers should be involved in work process design, process evaluation (pre-job briefing), and provide feedback necessary for improvement. 4.5.3 Identification and Control of Items The term ―item‖ is an all-inclusive term and can be used in place of any of the following: appurtenance, assembly, component, equipment, material, module, part, structure, product, software, subassembly, subsystem, system, unit, or support system. A process for the identification and control of items should be established and implemented to: prevent the use of incorrect or defective items; identify and control S/CI(s); and provide for the control and maintenance of items. The identification and control process should apply from the manufacture and receipt of the item through delivery, installation, or use. The process should also provide for the identification and configuration control of installed or replacement items consistent with specified requirements. Suitable information used for identification can include listing the unique part, lot, heat, model, version, or serial numbers on the item or in records traceable to the item, or both. Physical identification of items is preferred. 4.5.4 Item Protection Work processes should be established and implemented to protect items in accordance with specified technical standards and administrative controls to prevent damage, loss, or deterioration. Work processes should specify protective methods for sensitive or perishable items, such as special handling, shipping, and storage controls for precision instrumentation and limited shelf life items, and for items requiring special protective environmental controls, such as temperature and humidity controls. 4.5.5 Equipment Control Work processes should be established and implemented to ensure that equipment used for process monitoring and data collection is of the proper type, range, and accuracy. Such equipment should be calibrated according to technical standards and maintained to ensure continuing data quality and process capability. (see Section 4.8 of this Guide, Inspection and Acceptance Testing.) 4.6 PERFORMANCE/CRITERION 6 – DESIGN 4.6.1 Introduction A design process should be established that provides appropriate control of design inputs, 20 DOE G 414.1-2B 8-16-11 outputs, verification, configuration, and design changes, and technical and administrative interfaces. Designs should be based on sound engineering judgment and practices, scientific principles, applicable orders, codes, and standards. Verification/validation of the adequacy of the design should be performed before equipment is placed into service. The design of SSCs, software, and processes should be subject to design process controls and

verification requirements appropriate to the level of risk the items present to the public, the worker, the environment, and project success. For additional guidance, refer to DOE O 420.1B Facility Safety, dated 4-19-10, which establishes facility safety and programmatic requirements, DOE-STD-1189-2008, Integration of Safety into the Design Process, dated March 2008 and ASME NQA-1 non-mandatory Appendix 3A-1, Guidance on Design Control. For example, selection of the applicable design control requirements for a facility should be guided by safety analyses that establish: the identification and functions of safety class and safety significant SSCs; the significance to safety of the functions performed by those SSCs; and the aspects critical to the performance, reliability, or programmatic requirements of the designed SSCs. Designs should provide for appropriate acceptance, inspection, testing, and maintenance criteria to ensure continuing reliability and safety of the items. The designer should consider the expected use and life expectancy of the items to allow appropriate disassembly and disposal requirements to be addressed. Design records should include documentation such as design inputs; calculations; design analyses; engineering reports; design outputs; design changes; design verification activities; a list of approved and controlled computer codes; and other documents that provide evidence that the design process was completed satisfactorily. 4.6.2 Design Inputs Design inputs should be based upon contractual requirements and customer expectations and should be complete and technically correct. Design inputs may include such information as the design basis, health and safety considerations, expected life cycle, performance parameters, codes and standards requirements, and reliability requirements. 4.6.3 Design Process The design process should translate design inputs into design output documents that are technically correct and compliant with the end user’s requirements. Aspects critical to the performance, safety, or reliability of the designed items should be identified during the design phase. Design output documents should be prepared to support other processes such as dose and risk assessments, procurement, manufacturing, assembly, construction, testing, operation, inspection, and maintenance. Design processes should also be considered for any engineering/design requirements during the deactivation and decommissioning of excess DOE G 414.1-2B 21 8-16-11 facilities. Technical and administrative design interfaces should be identified and methods established for their control. 4.6.4 Design Output The completed design should be recorded in design output documents such as drawings, specifications, test/inspection plans, maintenance requirements, and reports. As-built drawings and shop drawings should be maintained after production or construction to show actual configurations. Interfaces should be identified for reporting to the field for items to be installed in the field. Drawings, specifications, test/inspection plans, and other design documents should be reviewed for inspection and testing requirements including required Measuring and Test Equipment (M&TE). The administrative interface process should clearly indicate responsibilities for design output documents, including the requirements for document control, configuration management, and records management. 4.6.5 Design Verification

Design verification is a documented process for ensuring that the design and the resulting items comply with the project requirements. Design verification methods can include design reviews, alternate calculations, qualification testing, and peer review of experimental design. When appropriate, the verification process may include consideration of previous verifications of similar designs or verifications of similar features of other designs. Design verification should be performed by technically knowledgeable persons independent of those who developed the design. Interim verifications may occur at predetermined stages of design development. The extent of design verifications should be based on a graded approach depending on the product’s complexity and importance to safety and project success. Organizations rely on verified design output to support other work, such as procurement, manufacture, construction, testing, or experiments. When the verification cannot be achieved in time for these activities, unverified portions of the design should be identified and controlled. Design verifications should be completed, including preoperational testing before relying on the SSC to perform its function. 4.6.6 Design Changes Design changes should be controlled by measures commensurate with those applied to the original design. Design changes include field changes and nonconforming items dispositioned for ―use-as-is‖ or ―repair.‖ Temporary modifications should receive the same levels of control as the designs of permanent modifications. Design documents should be updated to include all design changes, including field changes, to maintain configuration control. 22 DOE G 414.1-2B 8-16-11 4.7 PERFORMANCE/CRITERION 7 – PROCUREMENT 4.7.1 Introduction The procurement process should ensure that items and/or services provided by suppliers meet the requirements and expectations of the end user. The procurement process should be planned, implemented and controlled to ensure that: identification of supplier QAP requirements using a grading process such as the process defined in section 4.1.3. proper flow down takes place and the supplier/vendor clearly understands all procurement requirements; the end user’s requirements are accurately, completely, and clearly communicated to the supplier; supplier, designer, and end user requirements are met during the production phase; the product is delivered on time; and special handling and storage requirements are specified at time of delivery. The selection of procurement requirements should be commensurate with the importance of the end use of the purchased item or service. Management controls exist for DOE procurement and subcontracts through applicable DOE Orders, the Department of Energy Acquisition Regulation (DEAR) in 48 C.F.R. subchapters A through H, and the Federal Acquisition Regulation (FAR), in 48 C.F.R. 970 et. seq. The requirements in the QA Order and the QA Rule should not be interpreted to require the development of redundant procurement management systems, but rather to ensure that existing procurement management systems adequately respond to end user requirements. The procurement process of DOE nuclear facility contractors should include a determination of the applicability of the QA Rule to the supplier or subcontractor (see 10 C.F.R. § 830.121). If applicable, procurement documents and contracts for items and services provided to facilities

covered by the QA Rule should include a statement informing the supplier/vendor or subcontractor of the QA Rule requirements and of the potential for enforcement actions under 10 C.F.R. Part 820... The QA Order requires that contractors be responsible for ensuring proper flow down of all applicable requirements (including the adopted standards) to suppliers/vendors and subcontractors. DOE should ensure proper oversight of the flow down of requirements by their contractors to subcontractors, vendors and suppliers. The DOE contractor is responsible for determining methods to ensure that procured items and services meet requirements and perform as expected, including the prevention and control of the introduction of S/CI(s). (Note: NQA-1 does not address requirements for the prevention and control of S/CI(s) – see Section 5 of this Guide.) The selection of prospective suppliers should be based on specified criteria. Suppliers/vendors should be evaluated to verify their capability to meet performance and schedule requirements. Procurement processes should be established and implemented to ensure that approved suppliers continue to provide acceptable items and services. Suppliers/vendors should be monitored to ensure that acceptable items or services are produced within the specified schedule. DOE G 414.1-2B 23 8-16-11 4.7.2 Procurement Documents Procurement documents should clearly state or reference requirements and acceptance criteria for purchased items and services. Procurement documents should include any specifications, standards, QAP requirements, and other applicable documents referenced in the design documents. Parameters and requirements should be specified, such as document submittals, product-related documentation, problem reporting, administrative documentation, personnel or materials qualifications, tests, inspections, performance expectations for services, and reviews. A graded approach should be applied based on the significance of the item or service procured. 4.7.3 Supplier Qualification The objective of evaluating suppliers is two-fold: 1) to verify the supplier has implemented a QAP that conforms to the contractual requirements; and 2) to verify that the supplier is capable of providing the items or services specified in the contract. An effective evaluation method is to conduct an assessment at the supplier’s facility. The assessment may include an evaluation of personnel, technical and equipment capabilities, and processes. Supplier qualification can include some of the following: a review of the supplier’s history of providing identical or similar items or services; a review of shared supplier quality information (e.g., DOE Consolidated Audit Program, DOE Laboratory Accreditation Program); an evaluation of certifications or registrations awarded by nationally/internationally accredited third parties; and an evaluation of documented qualitative and quantitative performance information provided by the supplier. The method or combination of methods chosen should provide adequate confidence that the supplied item or service will meet requirements. Potential suppliers should be identified as early as possible in the design and procurement process to allow time for evaluation and determination of supplier capabilities. To assist industry and government in the procurement of qualified fasteners, the Fastener Quality Act (FQA), 15 C.F.R. Part 280, was signed into law (P.L. 106-34) on June 1999. This law

protects against sale of mismarked, misrepresented and counterfeit fasteners. Under this law, all manufacturers are required that certain fasteners sold in commerce: conform to the specification to which they are represented to be manufactured; provide for accreditation of laboratories engaged in fasteners testing; and require inspection, testing and certification in accordance with standardized methods. 24 DOE G 414.1-2B 8-16-11 The U.S. Patent and Trademark Office (USPTO) provide a registered trademark list of fasteners. All DOE programs should procure bolts and fasteners in accordance with the FQA and the USPTO trademark list. The QAP or lower tier/site specific procedures should address how to procure bolts and fasteners, and the required actions that should be taken if supplier(s) do not provide fasteners in accordance with the FQA and the USPTO registered trademark list. In 1992, the U.S. Customs Service developed a Suspect/Counterfeit Part Headmark List that identified known S/CI fasteners. The list is a tool still being utilized throughout the DOE complex as an aid for identifying legacy items. All DOE programs that discover fasteners identified on the headmark list should use applicable site procedures to make S/CI determinations. A copy of the U.S. Custom’s Headmark list can be found on the HSS website at http://www.hss.doe.gov/sesa/corporatesafety/sci/ref.html. For reporting criteria, see Section 5.4, Occurrence Reporting and Information Exchange, and Section 5.5, Reporting SCI to DOE OIG, of this Guide. The USPTO list can be obtained at http://operatingexperience.doe-hss.wikispaces.net/Suspect-Counterfeit+and+Defective+Items, or at http://www.uspto.gov/trademarks/ to search the FQA Registry of fastener insignias. 4.7.4 Supplier Performance Monitoring The qualified supplier’s performance should be evaluated periodically to confirm continuing capabilities. Qualified supplier’s performance should be reviewed annually and audited every third year unless events warrant more frequent assessment. Such evaluation should include monitoring of the supplier’s work processes to ensure conformance to those requirements that cannot be readily determined by inspection or test of the product. In some cases, due to the importance of the items being procured or for known quality problems with the supplier, a full- time resident inspector may be assigned to monitor the supplier’s performance. Monitoring may include: surveillance of in-process work activities and review of work package documentation (e.g., manufacturing processes and methods); inspection of facilities and processes; review of plans and progress reports; processing and use of change information; review of internal assessments; review and disposition of nonconformances; and selection, qualification, and performance monitoring of sub-tier suppliers. 4.7.5 Inspection of Procured Items The procurement process should provide for identifying inspections and tests to ensure conformance with purchase requirements. Design and procurement documents should specify critical or important acceptance parameters for inspection. Inspections should include verification that specified documentation has been provided by the supplier, and that items were not damaged during shipment. Inspection may include the http://www.hss.doe.gov/sesa/corporatesafety/sci/ref.html http://operatingexperience.doe-hss.wikispaces.net/Suspect-Counterfeit+and+Defective+Items http://www.uspto.gov/trademarks/

DOE G 414.1-2B 25 8-16-11 following methods: inspections of materials or equipment at the supplier’s facility; receipt inspection of the shipped items using established item critical characteristics; review of objective evidence such as certifications and reports; and verification or testing of items before or following shipment. 4.7.6 Supplier Documentation Supplier-generated documents should be accepted through the procurement system and controlled and processed by the end user organization. These documents may include certificates of conformance, drawings, analyses, certified material test reports (CMTR), maintenance data, nonconformance documentation, corrective actions, approved changes, waivers, and deviations. Supplier-issued Certificates of Conformance should not be accepted without an accompanying test report that provides the results of inspection and tests required by the governing product specification or the manufacturer’s specification. 4.7.7 Procurement of Safety-Related Items for Nuclear Facilities/Activities Items procured that may affect nuclear safety should be: purchased from a supplier who meets the quality criteria in the QA Rule, and purchased from a supplier whose QAP has been evaluated and is found to be an acceptable, documented, and implemented NQA-1 program; or, if purchased from a supplier who does not have an acceptable NQA-1 program, the items should be subjected to the Commercial Grade Dedication (CGD) process. Commercial grade items that affect the safety function of the application in which they are intended for use should be accepted in accordance with the CGD process. A documented technical evaluation should be performed by the responsible design organization for acceptance of the commercial grade items. This evaluation should include: determining the safety function(s); verifying performance requirements and applicable service conditions; and verifying critical characteristics including acceptance criteria. Additional guidance for the CGD process can be found in ASME NQA-1, Subpart 2.14, Quality Assurance Requirements for Commercial Grade Items and Services, the Electric Power Research Institute (EPRI) Guideline NP-5652, 1988 Revision, Guideline for the Utilization of Commercial Grade Items in Nuclear Safety Related Applications (NCIG-07), June 1988, and the EPRI Guideline TR-102260, Supplemental Guidance for the Application of EPRI Report NP-5652 on the Utilization of Commercial Grade Items. Methods used to verify critical design characteristics and appropriateness of the item for use include processes such as the following: special test(s), inspection(s) and/or analysis; commercial grade survey of the supplier; source verification; and/or acceptable supplier item or service performance record. 26 DOE G 414.1-2B 8-16-11 4.7.8 Multi-Site Procurement Multi-site procurement is becoming common within the DOE complex and should be addressed in the QAP and the implementing procedures of each site. Interface among DOE and contractor organizations should be established and documented with a clear definition of the responsibilities of each organization with regard to quality requirements. 4.8 PERFORMANCE/CRITERION 8 – INSPECTION AND ACCEPTANCE TESTING 4.8.1 Introduction The specified inspections and tests for items, services, and processes should be performed with calibrated equipment using established acceptance and performance criteria. Inspections and

tests verify that the physical and functional aspects of items, services, and processes meet requirements and that they are fit for acceptance and use. Performance expectations, inspections, and tests should be identified or considered early in the design process and/or specified in the design output and procurement documents. Before performing inspections or tests, workers should check the materials and equipment used to perform such inspections and tests to ensure adequate calibration and acceptability. Safety software should be tested in accordance with DOE G 414.1-4. 4.8.2 Process Adequate inspection/test planning should be performed. Appropriate sections of approved codes or standards may be used for establishing acceptance requirements and inspection or test methods. In planning for inspections/tests, personnel should consider provisions for the following: identification of characteristics to be examined; required qualifications of individuals who perform the examinations; descriptions of examination methods, including equipment and calibration requirements; acceptance and rejection criteria; suitable environmental conditions; shelf life and maintenance; required safety measures; and mandatory hold points, when applicable. Personnel performing inspections and tests should be technically qualified and have the authority to access appropriate information and facilities to verify acceptance. These qualified personnel should be independent of the activities being inspected/tested and should have the freedom to report the results of the inspections/tests. Inspection/test results should be evaluated and verified by qualified personnel. DOE G 414.1-2B 27 8-16-11 4.8.3 Control of Measuring and Test Equipment Measuring and test equipment (M&TE) used for inspections, tests, monitoring, and data collection should be calibrated, maintained, and controlled using a documented process. M&TE should be checked before use to ensure that it is of the proper type, range, accuracy, and precision, and that it is uniquely identified and traceable to its calibration data. Procedures should be established for testing, retesting, adjusting, and recalibrating M&TE. M&TE should be calibrated to standards traceable to the NIST or other nationally recognized standards when appropriate. If no nationally recognized standard exists, the basis for calibration should be documented. When calibrating and/or checking M&TE for use, computer programs/software that are part of M&TE should be checked to ensure verification and validation (V&V) have been performed for the computer programs/software, and that the V&V is current. The use of M&TE should be traceable to the item inspected because measurements and tests performed with the M&TE may need to be reevaluated if the M&TE is subsequently found to be out of its acceptable calibration range. Systems that rely on recording the identity of the M&TE in work packages are ineffective because review of all work packages to identify each use of a particular M&TE is almost impossible. A process to provide traceability from the M&TE to the item inspected should be established. ISO/IEC 17025, General Requirements for the Competence of Calibration and Testing Laboratories, 2005 and ASME NQA-1, Requirement 12, Control of Measuring and Test Equipment, provide additional information on the control of M&TE. 4.8.4 Records Inspection and test records should, at a minimum, identify:

item tested; date of test; test method; tester or data recorder; observations; results and acceptability; action taken concerning problems noted; and M&TE, including serial number or unique identifier. Following any inspection or test, the resulting status of items, services, and processes should be clearly and plainly noted to ensure that only those with acceptable inspection and test results are used. The process should provide for review and re-inspection/retest of items whose inspection/test parameters have changed. 4.9 ASSESSMENT/CRITERION 9 – MANAGEMENT ASSESSMENT The QA Order and the QA Rule require that managers assess their management processes, and identify and correct problems that hinder the organization from achieving its objectives. Assessments should promote continuous improvement and ensure that the organization’s 28 DOE G 414.1-2B 8-16-11 performance is acceptable. Guidance on this topic can be found in DOE G 414.1-1B. 4.10 ASSESSMENT/CRITERION 10 – INDEPENDENT ASSESSMENT The QA Order and the QA Rule require that independent assessments are planned and conducted to measure item and service quality, to measure the adequacy of work performance, and to promote improvement. Line management should establish sufficient authority and freedom for the group performing independent assessment. Persons who perform independent assessments should be technically qualified and knowledgeable in the areas to be assessed, and should not be involved in the work being evaluated, but may be from the same organization. Guidance on this topic can be found in DOE G 414.1-1B. 5.0 GUIDANCE ON SUSPECT AND COUNTERFEIT ITEMS 5.1 INTRODUCTION Approaches and methodologies described in this section were developed to meet the requirements for S/CIs described in Attachment 3 of the QA Order. Processes established to implement QA Criteria 3, 6, 7, and 8 contribute to the prevention of the introduction of S/CIs. Organizations, as part of their QAPs, should establish effective controls and processes that will: (1) ensure items and services meet specified requirements; (2) prevent entry of S/CI(s) into the DOE supply chain; and (3) ensure detection, control, reporting, and disposition of S/CI(s). This section provides guidance for documenting and implementing an effective S/CI process that will meet the QA Order requirements for S/CI. Programs are free to choose any national or international consensus standards and industry best practices for S/CIs, as long as the QAP documents how the S/CI requirements in the QA Order are met. This section and the IAEA-TECDOC-1169 are intended to assist organizations in establishing QA procedures and practices to eliminate the hazards created by S/CIs that are present in DOE facilities and to prevent any further introduction of S/CIs. 5.2 DOE O 414.1D REQUIREMENTS AND IAEA-TECDOC-1169 MATRIX This section provides a matrix (see Table 3) of where the guidance in the IAEA-TECDOC-1169 meets the S/CI requirements for the control of S/CIs. Table 3: DOE QA Requirements for S/CI and Guidance in IAEA-TECDOC-1169 S/CI Requirements in DOE O 414.1D from Attachment 3 IAEA-TECDOC-1169 2. REQUIREMENTS. The organization's QAP must: 2.a. Include a S/CI oversight and prevention process commensurate with the facility/activity hazards and mission impact. 2.1 Management Responsibility1 2.b. Identify the position responsible for S/CI activities and for serving

as a point of contact with the Office of Health, Safety, and Security. 2.0 Management 2.1 Management Responsibility 2.3 Training 2.c. Provide for training and informing managers, supervisors, and workers on S/CI processes and controls (including prevention, detection, and disposition of S/CIs). 3.0 Performance 3.1 General 3.2 Engineering 3.3 Procurement 3.4 Inspection and testing for acceptance 2.d. Prevent introduction of S/CIs into DOE work by— (1) engineering involvement: (a) in the development of procurement specifications; (b) during inspection and testing; and (c) when maintaining, replacing, or modifying equipment; 3.3 Procurement (2) identifying and placing technical and QA requirements in procurement specifications; 3.4 Inspection and testing for acceptance (3) accepting only those items that comply with procurement specifications, consensus standards, and commonly accepted industry practices; and 3.4 Inspection and testing for acceptance 3.5 Disposition of installed S/CIs 1 Safety applications are those whose failure could adversely affect the environment, safety, or health of the public or workers. This term includes safety systems in nuclear facilities (see 10 C.F.R. § 830.3). D O E G 4 1 4 .1 -2 B 2 9 8 -1 6 -1 1 DOE G 414.1-3 19 11-3-04 *See Section 5.3 **See Section 5.4 ***See Section 5.5 S/CI Requirements in DOE O 414.1D from Attachment 3 IAEA-TECDOC-1169 (4) Inspecting inventory and storage areas to identify, control, and disposition for S/CIs. 2.e. Include processes for inspection, identification, evaluation, and disposition of S/CIs that have been installed in safety applications 2 and other applications that create potential hazards. Also address use of supporting engineering evaluations for acceptance of installed S/CI as well as marking to prevent future reuse. 3.2 Engineering 3.5 Disposition of installed S/CIs 4.0 Assessment 2.f. Conduct engineering evaluations to be used in the disposition of identified S/CIs installed in safety applications/systems or in applications that create potential hazards. Evaluations must consider potential risks to the environment, the public and workers cost/benefit impact, and a schedule for replacement (if required). 3.2 Engineering 3.5 Disposition of installed S/CIs 4.0 Assessment 2.g. Perform the evaluation to determine whether S/CIs installed in non- safety applications pose potential safety hazards or may remain in place. Disposition S/CIs identified during routine maintenance and/or inspections to prevent future use in these applications. 3.5 Disposition of installed S/CIs 4.0 Assessment 2.h. Report to the DOE Inspector General per paragraph 3. below, and DOE O 221.1A, Reporting Fraud, Waste, and Abuse to the Office of Inspector General, dated 04-19-08 (or latest version) 3 0 D O E G 4 1 4 .1 -2 B 8 -1 6 -1 1 S/CI Requirements in DOE O 414.1D from Attachment 3 IAEA-TECDOC-1169 2.i. Collect, maintain, disseminate, and use the most accurate, up to date information on S/CIs and suppliers. Sources are identified on the DOE S/CI website (http://www.hss.energy.gov/csa/csp/sci/). 2.0 Management 2.4 Communication and information sharing 2.5 Non-conformance identification and disposition 3.2 Engineering 2.j. Conduct trend analyses for use in improving the S/CI prevention process. 3.2.3 Engineering input to information management Note: DOE O 210.2, DOE Corporate Operating Experience Program,

dated 06-12-06 (or latest version) requires review of existing lessons learned reports and submittal of new lessons learned reports for use in improving the S/CI prevention process. 2.4 Communication and information sharingError! ookmark not defined. 3. INSPECTOR GENERAL. Contact the DOE Inspector General (IG), before destroying or disposing of S/CIs and corresponding documentation, to allow the IG to determine whether the items and documentation need to be retained for criminal investigation or litigation. 4. OCCURRENCE REPORTING. S/CIs must be reported in accordance with DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, dated 08-19-03 (or latest version). D O E G 4 1 4 .1 -2 B 3 1 8 -1 6 -1 1 http://www.hss.energy.gov/csa/csp/sci/ 32 DOE G 414.1-2B 8-16-11 5.3 RESPONSIBILITY IN REPORTING The organization’s QAP should include an S/CI oversight and prevention process commensurate with the facility/activity hazards and mission impact. The QAP should address responsibility for ensuring that the requirements listed below are met, including the flow down of the requirements to contractors, subcontractors, suppliers and vendors. S/CI requirements include: identifying the position responsible for S/CI activities, and for serving as a point of contact with the Office of Health, Safety, and Security (HSS); reporting to the DOE Inspector General; and issuing lessons learned reports for use in improving the S/CI prevention process in accordance with DOE O 210.2A, DOE Corporate Operating Experience Program, dated 4-8-11. The responsible personnel should contact the DOE Inspector General (IG) before destroying or disposing of the S/CI(s) and the corresponding documentation. This allows the IG to determine whether the items and documentation need to be retained for criminal investigation or litigation. S/CIs are reported in accordance with DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, dated 8-19-03. As shown in Table 3, guidance for most DOE S/CI requirements is provided in the IAEA- TECDOC-1169. The guidance for Occurrence Reporting and Information Exchange for S/CI requirements not provided by the IAEA document is described in the following Section of this Guide. The IAEA-TECDOC-1169 is available at www.iaea.org. 5.4 OCCURRENCE REPORTING AND INFORMATION EXCHANGE 5.4.1 Reporting S/CI Discovery The QA Order states that items, services, and processes that do not meet the specified requirements be identified, controlled, and corrected. DOE M 231.1-2 requires prompt reporting of all S/CIs, regardless of their location/application. S/CIs should be reported to the responsible DOE Operations Office manager and program manager by means of the Occurrence Reporting Processing System (ORPS), and to the Office of Inspector General (OIG). The use of ORPS and the S/CI notification process will facilitate the contractor’s reporting obligation. Reporting an S/CI in ORPS does not substitute for reporting to the OIG. Prompt reporting of S/CIs in ORPS contributes to improvement of safety, regulatory compliance, and reliability. The S/CI information reported in ORPS is also used by Program Offices, other DOE contractors, HSS, OIG, and, where appropriate, by external agencies to prevent the spread of potentially hazardous items. For this reason, information reported should be sufficient to alert other organizations of S/CIs, and potential safety or performance problems

associated with the items. Historically, many S/CIs and defective items have been identified via ORPS. HSS reviews ORPS events on a daily basis for S/CIs and defective items (DIs) with potential safety impacts on DOE operations. http://www.iaea.org/ DOE G 414.1-2B Page 33 6/30/2011 5.4.2 Government-Industry Data Exchange Program The Office of Management and Budget Policy Letter No. 91-3 requires DOE to participate in the exchange of failure experience information concerning S/CIs. Accordingly, DOE and their contractors should participate in the Government-Industry Data Exchange Program (GIDEP). Information on joining and participating in GIDEP can be found at http://www.gidep.org. HSS utilizes GIDEP as an S/CI information source to search for S/CIs that may have potential impacts on DOE operations. A data collection sheet (DCS) is then prepared and the information posted to the S/CI database on the HSS S/CI Web site. DOE and its contractors should also use GIDEP information in their procurement, inspection, and maintenance processes to prevent introduction of S/CIs, assist in the identification of S/CIs that have already entered the facility, and for reporting S/CI discoveries. 5.4.3 Consultation with Office of General Counsel Federal program managers should consult with DOE’s or NNSA’s Office of General Counsel regarding legal questions arising from any S/CI occurrence. Typical legal questions involving an S/CI report include disclosure restrictions; procedures to protect Government rights against S/CI suppliers; and proper liaison procedures among DOE programs and investigative, law enforcement, or prosecuting agencies (e.g., the OIG, Defense Criminal Investigative Service [under Department of Defense], Federal Bureau of Investigation, U.S. Department of Justice, and U.S. Attorneys). Within the Office of General Counsel, the Office of Assistant General Counsel for Civilian Nuclear Programs should be consulted for S/CI issues involving nuclear safety. For S/CI issues involving procurement and contractual-related issues, the Office of Assistant General Counsel for Procurement and Financial Assistance should be consulted. Both offices are located at DOE HQ. 5.4.4 S/CI Review, Analysis, and Notification 5.4.4.1 S/CI Review and Analysis HSS has corporate responsibility for DOE’s S/CI process. This responsibility includes the collection and review of information from internal and external sources, and the identification and dissemination of potential S/CI and DI information to the DOE complex. Figure 1 depicts a flowchart of the S/CI notification process. S/CI information sources include ORPS, GIDEP, Institute of Nuclear Power Operation (INPO), NTS database, accident investigation reports, and Nuclear Regulatory Commission (NRC) Generic Communications. http://www.gidep.org/ Figure 1 - Suspect/Counterfeit Item Notification Chart Source of Information PSO documents results of review and actions. Results may be that there are no S/CI-DIs. Implements corrective action HSS reviews, consolidates results and closes inquiry HSS initiates S/CI-DI Operating Experience Notifications For high profile or special case S/CI-DI, HSS develops & transmits investigation lines of inquiry to the PSOs Initiates Occurrence Report Field does search for S/CI-DIs & reports to PSOs PSOs initiate investigation with the field offices HSS reviews Operating Experience S/CI-DI issue

Notifies the IG When S/CI-DIs are identified, the field: OTHER IG GIDEP INPO ORPS 3 4 D O E G 4 1 4 .1 -2 B 8 -1 6 -1 1 DOE G 414.1-2B 35 8-16-11 For each potential S/CI identified, HSS prepares a data collection sheet (DCS) and assigns a tracking number. The DCS is used to facilitate review of the S/CI or DI and to document actions taken to resolve the issue. After appropriate review, the DCS is published by HSS. HSS evaluates identified S/CIs and DIs using screening criteria for its applicability to DOE, and to determine what actions should be taken. HSS may also obtain advice and assistance from other subject matter experts in DOE to assist in making this determination. Typical screening criteria include: Is this a repeat occurrence? Does the issue affect more than one site or have the potential to affect more than one site? Has the issue been declared a S/CI or DI, or does it have the potential to be declared a S/CI or DI? Is an investigation underway or about to be initiated regarding potential criminal activities? Does the issue have any immediate or potential regulatory, environmental, health, or safety impact? Could other organizations address the issue more appropriately? Does the issue have any complex-wide implication? Is this a legacy item(s) (e.g., high strength bolts found installed (time unknown), no manufacturer insignia, or unknown supplier)? 5.4.4.2 S/CI Notification Process The purpose of the S/CI notification process is to provide a coordinated mechanism for the timely dissemination and field review of information concerning potential S/CIs. Based on the potential significance of the S/CI and its applicability to DOE, the information may be provided to the DOE complex using one of several methods. Operating experience notifications, which potentially include: o HSS Safety Alert – if documentation clearly indicates that an S/CI or DI may be involved, and a significant regulatory, environmental, health, or safety impact exists. o POC Notification – if documentation indicates that the S/CI or a DI may be in use at DOE facilities. o Operating Experience Summary – if documentation indicates that the S/CI or a DI may be applicable to DOE facilities. Complex-wide submittal of ORPS reports. DCS posted on the DOE HSS S/CI Web site at (http://www.hss.energy.gov/csa/csp/sci/), and possibly distributed through the e-mail listserver. Possible notification of S/CI points of contact in the field or at HQ. Regardless of how the information is disseminated, field and HQ organizations should review the information for potential applicability to their own facilities and operations. When an organization identifies an S/CI or DI, it submits an ORPS report and notifies the local OIG. S/CI information also is shared via other methods. The HSS Operating Experience Committee http://www.hss.energy.gov/csa/csp/sci/ 36 DOE G 414.1-2B 8-16-11 conducts monthly conference calls and periodically discusses specific information regarding newly identified S/CIs or offers presentations from internal and external organizations concerning the status of existing and/or the development of S/CI programs. The Operating Experience Wiki page (http://operatingexperience.doe-hss.wikispaces.net/) hosts a dedicated web space for S/CI specific information, including informational publications, presentations, and videos from internal and external organizations.

5.5 REPORTING S/CIs TO DOE OIG 5.5.1 Authority DOE O 221.1A requires DOE and contractor personnel to report instances of suspected fraud, waste, and abuse to the OIG. This all-encompassing requirement includes S/CIs. Reporting S/CIs pursuant to other DOE directives (e.g., reporting in ORPS) does not substitute for reporting S/CIs to the OIG. 5.5.2 Reporting S/CIs to OIG 5.5.2.1 General DOE field elements and contractors report any S/CIs discovered during receipt, maintenance, testing, inspection, or use, and when there is reason to believe that a fraudulent act occurred during the manufacturing, shipping, testing, or certification of the S/CI. The following are some, but not all, indicators that should cause suspicion of fraud: Although Item X was ordered and billed, evidence exists that the supplier intentionally provided Item Y. The S/CI, sold as new, shows evidence of prior use. Evidence shows that the manufacturer or supplier: o intentionally provided altered or incomplete testing data, and/or o did not disclose that some testing data were missing. Performance is inconsistent with certification or testing data furnished by the manufacturer or supplier. Product failure rate exceeds expectations. The manufacturer’s name, logo, serial number, or manufacture date appear to have been altered. Product is certified as meeting specified criteria, but fails independent QA test. http://operatingexperience.doe-hss.wikispaces.net/ DOE G 414.1-2B 37 8-16-11 5.5.2.2 Who Should Report S/CI(s) to OIG DOE or its contractors at the site (i.e., location) where the S/CI(s) are initially discovered should report directly to the OIG. Responsibility for reporting S/CI(s) to the OIG, as described in this Guide, should be defined at each location. 5.5.2.3 Where to Report Reports to the OIG should be made to the local Office of Investigations within the OIG nearest the location where the S/CI(s) were initially discovered. Direct coordination with the local Office of Investigations will ensure communication of the necessary information. Reports may also be made directly to the OIG Hotline. Appendix B contains the location, mailing address, telephone number, and fax number of the Office of Investigations for the local OIG field offices, as well as the contact information for the OIG Hotline. 5.5.2.4 What to Report Report specific characteristics of the potential fraud, including: Description of the S/CI (e.g., raw material, fasteners, electrical components, valves, fittings, ratchet straps); Location of the discovery (e.g., receiving inspection, specific building and room installed); Name of manufacturer, distributor, and supplier; Identifying numbers (e.g., serial number, model number, product code); Point of contact for information on the location of the S/CI and corresponding documentation; Date of the S/CI discovery; Occurrence report number (if available); Intended end use (e.g., facility construction, component or equipment assembly); Significance of the S/CI; Dollar value of the S/CI; and Other pertinent information, including any action that is underway by the DOE or other agencies. 5.5.2.5 When to Report If an S/CI is identified, an Occurrence Report is submitted to ORPS, and the IG is notified in accordance with the requirements in DOE O 221.1, Reporting Fraud, Waste, and Abuse to the Office of the Inspector General, dated 4-19-08. 5.5.2.6 How to Report

The S/CI may be reported by letter, telephone, fax, or electronic mail to the appropriate OIG field office (see Appendix B). 38 DOE G 414.1-2B 8-16-11 5.5.2.7 How to Secure the S/CI S/CIs and corresponding documentation should be held in a secure area per the local non- conforming item procedures until the OIG has been notified and has responded to the notification and given disposition directions. S/CI procedures should address appropriate segregation of S/CI(s), where appropriate, and the use of hold tags. 5.5.2.8 What to Expect from the OIG Once the OIG has been notified, the OIG will respond, absent compelling circumstances, within ten (10) calendar days of the notification as to its intent regarding opening an investigation. If the OIG opens an investigation, DOE and its contractors will retain and secure the S/CI and corresponding documentation until the investigation is completed or otherwise released by the OIG. In some instances, the OIG may take custody of the S/CI. The OIG will also require the corresponding documentation for investigative purposes. At case closing, or when the S/CI is no longer needed for evidentiary purposes, the OIG will provide notice releasing the S/CI from the hold status. Once the S/CI is released from the hold status, disposal of the S/CI may proceed in accordance with approved procedures that clearly identify item(s) as noncompliant and prevent inadvertent use, installation or return to storage/inventory. If authorized by the OIG, destruction of the S/CI should be performed in a manner so as to permanently and irrevocably alter the S/CI so that it cannot be used. If the OIG does not respond as described in this paragraph, DOE and contractor personnel should feel free to contact the OIG. If the OIG decides not to pursue an investigation or similar review, the OIG will give notice releasing the S/CI from hold status. This action should not preclude DOE or its contractors from denying payment, returning substandard or otherwise DIs to the sender, or seeking other contractual remedies, as appropriate. The OIG’s decision to release an S/CI from a hold status should not be interpreted as having any bearing on the safety or usability of the product in question. Release means that the OIG does not need the items for evidentiary purposes. NOTE: Returning a substandard or otherwise DI(s) to the sender could result in resale of that item. The purchaser should take action to ensure that either the supplier’s performance is improved or the supplier is removed from the approved suppliers list. 5.5.3 Successfully Prosecuting S/CI Cases The best defense against the introduction of S/CIs into the DOE complex is a well-managed and up-to-date QA program. Prosecution of S/CI offenders is an integral part of the DOE internal control structure and is used to discourage would-be offenders; however, prosecution without an effective QA program will not prevent the introduction of S/CIs into the DOE complex. Implementing the following suggestions will improve the chances for successfully prosecuting an S/CI offender: Identify the S/CI during initial receipt at its point of entry into the DOE complex (i.e., where goods ordered are opened, inspected, tested (when applicable), and compared to the requisition and shipping paperwork). DOE G 414.1-2B 39 8-16-11 Limit and document the chain-of-custody of the S/CI and paperwork from receipt until the OIG releases the S/CI from a hold status.

Ensure that requisitions or purchase orders contain specific product requirements (where possible, do not purchase products from after-market dealers or grey market arena). Require the manufacturer and supplier to certify that the products supplied conform to contract requirements and specifications. Conduct an independent test or evaluation to show that the product does not conform to contract requirements. DOE G 414.1-2B Appendix A 8-16-11 A-1 APPENDIX A: QUALITY ASSURANCE PROGRAM REVIEW AND APPROVAL TEMPLATE This review template is intended for use by the DOE for evaluating a DOE Site Office or Contractor Quality Assurance Program (QAP) submittal consistent with DOE O 414.1D (the QA Order) and/or 10 C.F.R. Part 830 (the QA Rule). It may also be used by DOE or contractors to review other QAPs. This appendix refers to various DOE Orders, Policies, Standards, and Guides. The user is advised to use the current revision of the referenced documents. 1.0 REVIEWER QUALIFICATION Federal personnel assigned to lead review teams at nuclear facilities, and recommend approval of the contractor QAP should have been qualified, at a minimum, to DOE-STD-1150-2002, Department of Energy (DOE) Quality Assurance Functional Area Qualification Standard, dated April 2002 which is consistent with DOE O 426.1 Federal Technical Capability, dated 11-19- 09. Team members may also be qualified but, at a minimum, should have demonstrated proficiency in quality assurance (QA) and should be technically qualified and/or knowledgeable in the areas they are assigned to review. 2.0 QUALITY ASSURANCE PROGRAM REVIEW The DOE reviewer/approval authority should do the following as part of planning and performance of the review. List the requirements, in addition to the QA Order and the QA Rule, applicable to the QAP, such as: o safety structures, systems, and components identified and discussed in the safety basis documents; o appropriate standards selected (e.g., NQA-1, ISO 9001); and o integration with other management system and quality requirements (e.g., integrated safety management system (ISMS), QC-1). Use the guidance provided in this document. DOE programs may use the applicable edition of ASME NQA-1 including appropriate Addenda (or a later edition), Quality Assurance Requirements for Nuclear Facility Application, Part I and applicable requirements of Part II based on the status of the facility. Apply the review to all project quality-related activities. Determine the responsibilities for review and approval of initial submittals and revisions of the QAP description. As part of the review, evaluate the implementation of the QAP where possible. Understand the applicable contract quality requirements and expectations. Appendix A DOE G 414.1-2B A-2 8-16-11 3.0 GENERAL PROCESS FOR THE REVIEW Prepare a review plan in advance. Base the review plan on this document and the applicable edition of NQA- 1 (or other appropriate standard(s) for non-nuclear work) and the contract. Identify the quality criteria that apply to the work. Prepare checklists for the review. Use the questions identified below as a starting point and expand them using the contract, this Guide, and the applicable edition of NQA-1. Complete the review and document the results. Notify the contractor of the review results, provide any directed changes to the contractor’s QAP, and inform the contractor of the status (approved, conditionally

approved, or disapproved). Notify the contractor of any work restrictions relating to conditional approvals or disapprovals. 4.0 CHECKLIST (SEE CORRESPONDING SECTIONS OF THIS GUIDE AS LISTED BELOW) This section provides example questions for initial QAP review. Initial review should have the greatest rigor and subsequent reviews should evaluate programmatic changes and performance results. 4.1 MANAGEMENT/CRITERION 1 – PROGRAM Does the quality assurance description describe the established organizational structure, functional responsibilities, levels of authority, and interfaces for those managing, performing, and assessing the work? Has the organization designated the senior management position responsible for development and maintenance of the QAP? Does the organization demonstrate senior management leadership for quality and the QAP? Are senior management expectations for implementation adequately defined and delineated? Have the requirements for ISMS been adequately addressed and integrated into the QAP? Are there organizations excluded from the scope of the quality assurance program? If so, is there sufficient justification for the exclusion? Are the internal and external interfaces documented? Have adequate resources been identified for quality program activities, such as planning, auditing, supplier qualification, technical document review, inspection, calibration, etc.? Does the QA program description describe management processes, including planning, scheduling, and providing resources for the work? Does the QA program description define a process for grading the application of requirements based on hazards and mission? DOE G 414.1-2B Appendix A 8-16-11 A-3 Does the QA program description address the general requirements for a QAP? Does the QA program description have a process for the prevention and control of S/CI? Does the QA program description address the safety software requirements? Has the QA program description been prepared using the applicable edition of NQA-1-for organizations responsible for nuclear facilities or nuclear facility oversight applications? If not related to a nuclear facility, were other consensus standards appropriate for the mission used (ISO 9001, ASQ Z 1.13, QC-1)? Does the QA program description include a commitment to the standard? Does the QAP include any exemptions from portions of the selected standard? Are those exemptions supported by an adequate basis? Is the process for determining the quality requirements applicable to subcontractors/suppliers and passing those requirements down through contracts clearly defined? Is this process applicable to all contracts? Has DOE Site Office or contractor senior management endorsed the QAP through a written quality policy statement? 4.2 MANAGEMENT/CRITERION 2 – PERSONNEL TRAINING AND QUALIFICATION Is the methodology described for establishing requirements to train and qualify personnel so that they are capable of performing their assigned work? Does the organization have evidence of an established and documented training plan? Have adequate resources been identified to support the selection, training, and qualification of personnel conducting work? Does the training and qualification program describe the positions and functions to which it applies? Are the requirements defined for the qualification and/or certification of personnel in the

various functional areas (e.g., lead auditors, auditors, subject matter experts, nondestructive examination personnel, welders, etc.)? Is the methodology described for providing continuing training to personnel to maintain their job proficiency? 4.3 MANAGEMENT/CRITERION 3 – QUALITY IMPROVEMENT Has the organization established, implemented, and documented processes to detect and prevent quality problems? Do work processes, procedures, etc., call for identification and reporting of problems? Does senior management policy encourage problem detection and prevention? Do processes exist for communicating lessons learned and performance information? Is a method described for categorizing the significance of problems? Is the approach to identify, control, and correct items, services, and processes that do not meet established requirements (nonconforming) adequately described? Does this approach include the requisite discipline involvement to adequately evaluate Appendix A DOE G 414.1-2B A-4 8-16-11 and disposition the nonconforming item, service, or process? Does this approach address the identification and control of nonconforming items such that it prevents inadvertent use? Does the QA program description address documentation and correction of quality problems associated with services and processes? Does the QA program description provide for the identification of the causes of problems and require identification of actions to prevent recurrence as a part of correcting the problem? Does the QA program description describe methods for addressing cause, extent, and remedial and preventative actions for quality problems? Is a process identified to review item characteristics, process implementation, and other quality-related information to identify items, services, and processes needing improvement? Is a quality performance analysis system specified (e.g., six sigma, metrics and indicators, trending)? Does the performance analysis system provide a mechanism for feedback to affected and related entities in the organization? 4.4 MANAGEMENT/CRITERION 4 – DOCUMENTS AND RECORDS How does the organization prepare, review, approve, issue, use, and revise documents to prescribe such things as processes, requirements, and design? Does a document control system exist that provides these functions? Verify that key functions such as procedures relating to the quality criterion (e.g., design, procurement, work control, inspection, testing) are described in approved document. Verify that documents prescribe not only internal processes, but also processes to oversee contractors and suppliers. Verify that the DOE Site Office key work processes and the activities in their functions, responsibilities, and authorities (FRA) are supported by documents. Verify that the DOE Site Office has a documented process for the receipt and distribution of government furnished information from one contractor to another contractor. How does the organization specify, prepare, review, approve, and maintain records? Does a documented records management system exist that provides these functions? How are the requirements of the National Archives and Records Administration addressed? What is the quality records standard applied to the contract? 4.5 PERFORMANCE/CRITERION 5 – WORK PROCESSES How does the QA program description provide methods for ensuring that work is DOE G 414.1-2B Appendix A 8-16-11 A-5

performed consistent with technical standards, administrative controls, and other hazard controls? Are the core functions and guiding principles of the DOE Integrated Safety Management System addressed consistent with DOE O 436.1, Departmental Sustainability, dated 5-2-11; and with applicable chapters in DOE O 422.1 Conduct of Operations, dated 6-29-10? Do the approved documents (instructions, procedures, or other appropriate means for the work processes) meet regulatory or contract requirements? Does the QA program description provide methods to identify and control items to ensure their proper use? Does the QA program description adequately describe the method to maintain items to prevent their damage, loss, or deterioration? Does this method address the requirements (e.g., DOE O 433.1B, Maintenance Management Program for DOE Nuclear Facilities, dated 4-21-10)? Are S/CI(s) addressed in the context of maintenance? Does the QA program description describe an adequate calibration and maintenance system for equipment used for process monitoring or data collection? 4.6 PERFORMANCE/CRITERION 6 – DESIGN Determine whether the Site Office performs design work as the design authority. If not, a documented process should cover oversight of contractor design activities (see Section 4.4 of this Guide, Documents and Records). DOE oversight activities may include setting of high- level requirements for the facility/system, reviewing and commenting on completed systems design descriptions, or approving critical decision points for moving from preliminary design to final design. Do design items and processes use sound engineering/scientific principles and appropriate Standards and Orders (e.g., DOE O 420.1B)? Is the use of software in the design and safety analysis process controlled consistent with DOE G 414.1-4? What method is used to incorporate applicable requirements and design bases in design work? Are design changes controlled at the same level as the design? How are design interfaces identified and controlled, within the design authority and externally with customers and suppliers, including subcontractors? Does the QA program description describe a process for design verification and/or validation for design products? Does the process require the use of individuals or groups other than those who performed the work? Is the work verified/validated before approval and implementation of the design? Is there a system for engineering involvement in the identification, analysis, and control of suspect/counterfeit items that could affect safety? How does the design authority control changes to procurement documents that include design requirements? Appendix A DOE G 414.1-2B A-6 8-16-11 4.7 PERFORMANCE/CRITERION 7 – PROCUREMENT How are the requirements established for the procurement of items and services? Do the requirements include performance specifications and acceptance criteria provided by the design authority and expectations? Are procurement document changes managed and controlled at the same level as the original procurement document? Does this process require design authority approval of changes to design requirements? Does a system exist to evaluate and select prospective suppliers based on specified criteria? Does a system exist for identification of potential suspect/counterfeit items and the prevention of their procurement? Does the organization have standard contract clauses for

this purpose? Is supplier documentation managed and controlled? How are processes established and implemented to ensure that approved suppliers continue to provide acceptable items and services? Is such a process graded to ensure that safety- related items and mission-critical items are subject to more rigorous methods (e.g., inspection and testing at the manufacturer and upon receipt)? 4.8 PERFORMANCE/CRITERION 8 – INSPECTIONS AND ACCEPTANCE TESTING How are inspections and tests specified for items, services, and processes? How are acceptance and performance criteria established and used? Are inspection and acceptance tests planned and controlled? Does a system exist for documenting the results of inspections and tests? Is inspection and test equipment controlled by a process to ensure it is calibrated and maintained? 4.9 ASSESSMENT/CRITERION 9 – MANAGEMENT ASSESSMENT Does the QA program description describe how managers, at all levels, assess their management processes? Does the QA program description provide for the identification and correction of problems that hinder the organization from achieving its objectives? Do managers take responsibility for, and directly participate in, the assessments? Has third party certification been considered? Used? Is DOE G 414.1-1B used to develop the management assessment process? 4.10 ASSESSMENT/CRITERION 10 – INDEPENDENT ASSESSMENT Has the independent assessment process been adequately defined and documented? Are independent assessments (e.g., audits) planned and conducted to measure item and DOE G 414.1-2B Appendix A 8-16-11 A-7 service quality, to measure the adequacy of work performance, and to promote improvement? Does the group performing independent assessments have sufficient authority and freedom from line management (i.e., it is not directly responsible for the work being assessed)? Are the persons conducting independent assessments technically qualified and/or knowledgeable in the areas to be assessed? Does a process exist to obtain technical experts for assessments when none are available in the organization? Has third party certification been considered? Used? Is the independent assessment process applied to internal and external organizations? Does a system exist for reporting assessment results to responsible management and for assuring that action is taken to correct identified issues? Is senior management informed of assessment results and engaged in ensuring responsible management response to identified issues? Are DOE G 414.1-1B and appropriate national standards used to develop the independent assessment process? DOE G 414.1-2B Appendix B 8-16-11 B-1 APPENDIX B: CONTACT INFORMATION FOR OFFICE OF INSPECTOR GENERAL – OFFICE OF INVESTIGATIONS OIG HOTLINE (FOR USE WHEN OTHER LOCAL CONTACT CANNOT BE MADE) U.S. Department of Energy Hotline Telephones: Office of Inspector General (202) 586-4073 OIG Hotline and Analysis Section (800) 541-1625 MS 5D-031, IG-20 FAX: (202) 586-4902 1000 Independence Avenue, SW EMAIL: IGHOTLINE@hq.doe.gov Washington, DC 20585 DOE G 414.1-2B Appendix B B-2 8-16-11 ALBUQUERQUE U.S. Department of Energy Office of Inspector General Office of Investigations P.O. Box 5657 Albuquerque, NM 87185 (505) 845-4009 FAX: (505) 845-4663 CHICAGO U.S. Department of Energy Office of Inspector General Office of Investigations P.O. Box 338 Lemont, IL 60439

(630) 252-2631 FAX: (630) 252-7594 DENVER Golden Field Office U.S. Department of Energy Office of Inspector General Office of Investigations 1617 Cole Blvd. Golden, CO 80401 (720) 356-1719 FAX: (720) 356-1720 DISTRICT OF COLUMBIA U.S. Department of Energy Office of Inspector General Office of Investigations MS 5D-031, IG-22 1000 Independence Avenue, SW Washington, DC 20585 (202) 586-8519 FAX: (202) 586-5697 IDAHO FALLS U.S. Department of Energy Office of Inspector General Office of Investigations P.O. Box 51566 Idaho Falls, ID 83405-1566 (208) 526-4227 FAX: (208) 526-4175 LAS VEGAS U.S. Department of Energy Office of Inspector General Office of Investigations M/S-574, P.O. Box 98518 Las Vegas, NV 89193-8518 (702) 295-0877 FAX: (720) 295-0255 LIVERMORE U.S. Department of Energy Office of Inspector General Office of Investigations P.O. Box 2270 Livermore, CA 94551 (925) 422-2885 FAX: (925) 422-3230 OAK RIDGE U.S. Department of Energy Office of Inspector General Office on Investigations P.O. Box 6318 Oak Ridge, TN 37831 (865) 576-9200 FAX: (865) 576-8111 DOE G 414.1-2B Appendix B 8-16-11 B-3 PITTSBURGH U.S. Department of Energy Office of Inspector General Office of Investigations P.O. Box 10940 Pittsburgh, PA 15236-0940 (412) 386-6185 FAX: (412) 386-4971 RICHLAND U.S. Department of Energy Office of Inspector General 1838 Terminal Drive, Suite A Richland, WA 99352 (509) 376-8783 FAX: (509) 376-7458 SAVANNAH RIVER U.S. Department of Energy Office of Inspector General Office of Investigations P.O Box 447 New Ellenton, SC 29809 (803) 725-7319 FAX: (803) 725-5384 DOE G 414.1-2B Appendix C 8-16-11 C-1 APPENDIX C: REFERENCES The following references provide requirements and acceptable methods for implementing many of the quality assurance (QA) requirements of DOE O 414.1D, Quality Assurance, dated 04-25- 11 and 10 C.F.R. Part 830 Subpart A. No single reference fully addresses all QA requirements. The principles, recommended approaches, and applications contained in these references may be used with the QA requirements to develop an effective quality system. Most of the documents listed here are accessible online. DOE Orders, Policies, Manuals, Guides, and Standards are available at www.directives.doe.gov; C.F.R.s, OMB Circulars and Public Laws may be accessed at www.gpoaccess.gov; and NRC documents are available at www.nrc.gov. 1.0 RELATED GOVERNMENT POLICIES, RULES, AND ORDERS 10 C.F.R. Part 820, Procedural Rules for DOE Nuclear Activities Facilities. 10 C.F.R. Part 830, Nuclear Safety Management. 36 C.F.R., Chapter XII, Subchapter B, Subpart A, Federal National Archives and Records Administration. 48 C.F.R. Parts 1–99, Federal Acquisition Regulations System. 48 C.F.R. 970, Department of Energy Acquisition Regulation (DEAR), DOE Management and Operating Contracts. DOE O 200.1A, Information Technology Management, dated 12-23-08. DOE O 210.2, DOE Corporate Operating Experience Program, dated 6-12-06. DOE O 221.1A Reporting Fraud, Waste and Abuse to the Office of Inspector General, dated 4-19-08. DOE O 226.1A, Implementation of Department of Energy Oversight Policy, dated 7-31-07. DOE O 231.1A, Environment, Safety and Health Reporting, dated 6-3-04. DOE O 252.1A, Technical Standards Program, dated 2-23-11. DOE O 360.1B, Federal Employee Training, dated 10-11-01. DOE O 414.1D, Quality Assurance, dated 4-25-11.

http://www.directives.doe.gov/ http://www.gpoaccess.gov/ http://www.nrc.gov/ Appendix C DOE G 414.1-2B C-2 8-16-11 DOE O 420.1B CHG 1, Facility Safety, dated 4-19-10. DOE O 422.1, Conduct of Operations, dated 6-29-10. DOE O 426.1, Federal Technical Capability, dated 11-19-09. DOE O 426.2, Personnel Selection, Training, Qualification, and Certification Requirements for DOE Nuclear Facilities, dated 4-21-10. DOE O 436.1, Departmental Sustainability, dated 5-2-11 DOE O 450.2, Integrated Safety Management, dated 4-25-11. DOE P 426.1, Federal Technical Capability Policy for Defense Nuclear Facilities, dated 12-10-98. DOE P 450.4A, Integrated Safety Management System Policy, dated 4-25-11. Public Law 104-113, National Technology Transfer and Advancement Act of 1995. 2.0 RELATED GUIDES, MANUALS AND STANDARDS DOE-EM-SRP-2001, Standard Review Plan (SRP) Protocol for QAP/QIP Review, Protocol for EM-HQ Review/Field Self-Assessment of Site-Specific Quality Assurance Programs (QAPs)/Quality Implementation Plans (QIPs), 2 nd Edition, March 2010. DOE G 413.3-2, Quality Assurance Guide for Project Management, dated 6-27-08. DOE G 414.1-1B, Management and Independent Assessments Guide for Use with 10 C.F.R., Part 830, Subpart A, and DOE O 414.1C, Quality Assurance; DOE M 450.4-1, Integrated Safety Management System Manual; and DOE O 226.1A, Implementation of DOE Oversight Policy, dated 9-27-07. DOE G 414.1-4, Safety Software Guide for use with 10 C.F.R 830, Subpart A, Quality Assurance Requirements, and DOE O 414.1C, Quality Assurance, dated 6-17-05. DOE G 450.3-3, Tailoring for Integrated Safety Management Applications, dated 2-1-97. DOE G 450.4-1B Vol. 1, Integrated Safety Management Guide (Volume 1) for Use with Integrated Safety Management System Policies (DOE P 450.4, DOE P 450.5, and DOE P 450.6); the Functions, Responsibilities, and Authorities Manual; and the Department of Energy Acquisition Regulation, Volume 1, dated 3-1-01. DOE G 1324.5B, Implementation Guide for 36 C.F.R. Chapter XII - Subchapter B, dated 7-19-96. DOE G 414.1-2B Appendix C 8-16-11 C-3 DOE M 231.1-2, Occurrence Reporting and Processing of Operations Information, dated 8-19-03. DOE-NE-STD-1004-92, Root Cause Analysis Guidance Document, dated February 1992. DOE/NNSA, Weapon Quality Policy (QC-1), Rev. 10, dated 2-10-04. DOE/RW-0333P, Office of Civilian Radioactive Waste Management, Quality Assurance Requirements and Description (Rev. 13). DOE-STD-1150-2002, Quality Assurance Functional Area Qualification Standard, dated April 2002. DOE-STD-1172-2011, Safety Software Quality Assurance Functional Area Qualification Standard, dated 03-2011 DOE-STD-1189-2008, Integration of Safety into the Design Process, dated March 2008. Office of Management and Budget Circular A-119, Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities, dated 2-10-98. American National Standards Institute (ANSI)/American Society for Quality (ASQ), Z 1.13-1999, Quality Guidelines for Research, 1999. ANSI/National Conference of Standards Laboratories, Z540-1-1994, Calibration Laboratories and Measuring and Test Equipment: General Requirements, 1999. ANSI/International Organization for Standardization (ISO)/American Society for Quality (ASQ) Q9001:2008, Quality Management Systems: Requirements, 2008. ANSI/ISO/ASQ Q9004:2000, Quality Management Systems: Guidelines for Performance Improvements, 2001.

ANSI/ISO/ASQ QE19011S-2004, Guidelines for Quality and/or Environmental Management Systems Auditing, U.S. Version with supplemental guidance added. ANSI/ASQ E4-2004, Standard: Quality Systems for Environmental Data and Technology Programs – Requirements with Guidance for Use, 2004. American Society of Mechanical Engineers (ASME) NQA-1-2008, Quality Assurance Requirements for Nuclear Facility Applications, Part 1, Subpart 2.7, 2001. ASME NQA-1, Subpart 4.1, Application Appendix: Guide on Quality Assurance Requirements for Computer Software Appendix C DOE G 414.1-2B C-4 8-16-11 ASME NQA-1a-2009, Addenda A to Quality Assurance Requirements for Nuclear Facility Applications, 8-31-09. International Atomic Energy Agency IAEA-TECDOC-1169, Managing Suspect and Counterfeit Items for the Nuclear Industry, 2005. IAEA-TECDOC-1090, Quality Assurance within Regulatory Bodies, June 1999. IAEA-GS-R-3, Management Systems for Facilities and Activities, 2006. 3.0 RELATED REFERENCES Intergovernmental Data Quality Task Force, Uniform Federal Policy for Quality Assurance Project Plan – Evaluating, Assessing, and Documenting Environmental Data Collection and Use Programs, EPA: EPA-505-B-04-900A; DoD: DTIC ADA 427785; DOE: DOE/EH- 0667, Version 2, March 2005. American National Standard ANSI/ASQC E4-1994, Specifications and Guidelines for Quality Systems for Environmental Data Collection and Environmental Technology Programs, dated 1-3-95. American Society for Nondestructive Testing (ASNT) ASNT-CP-105-2006, ASNT Standard Topical Outlines for Qualification of Nondestructive Testing Personnel. DOE-STD-3009-94, Preparation Guide for U.S. Department of Energy Nonreactor Nuclear Facility Documented Safety Analyses, dated July 1994. DOE-STD-1025-2008, Weapon Quality Assurance Qualification Standard DOE-STD-1027-92, Hazard Categorization and Accident Analysis Techniques for Compliance with DOE O 5480.23, Nuclear Safety Analysis Reports, dated December 1992. Electric Power Research Institute (EPRI) Guideline NP-5652, Guideline for the Utilization of Commercial Grade Items in Nuclear Safety Related Applications (NCIG-07), 1988 Revision, June 1988. EPRI Guideline TR-102260, Supplemental Guidance for the Application of EPRI Report NP- 5652 on the Utilization of Commercial-Grade Items. ISO/IEC 17025, General Requirements for the Competence of Calibration and Testing Laboratories, 2005. U.S. Nuclear Regulatory Commission (NRC) NUREG 0856, Final Technical Position on Documentation of Computer Codes for High-Level Waste Management, 1983. NRC NUREG/CR-5151, Performance-Based Inspections, June 1988. DOE G 414.1-2B Appendix C 8-16-11 C-5 NRC Regulatory Guide 1.28, Quality Assurance Program Criteria (Design and Construction), Rev. 4, dated June 2010. NRC Regulatory Guide 1.33, Quality Assurance Program Requirements (Operation), Rev. 2, February 1978. DOE G 414.1-2B Appendix D 6/30/2011 D-1 APPENDIX D: DEFINITIONS Certificate of Conformance. A document signed or otherwise authenticated by an authorized individual certifying the degree to which items or services meet specified requirements. Certified Material Test Report (CMTR). A written and signed document that is approved by a qualified party and contains data and information that attests to the actual properties of an item and the actual results of all required tests. Commercial Grade Item. An item that is: a) not subject to design or specification requirements

that are unique to nuclear or mission critical facilities or activities; b) used in applications other than nuclear or mission-critical facilities or activities; and c) to be ordered from the manufacturer/supplier on the basis of specifications set forth in the manufacturer’s published product description (e.g., a catalog). Contractor. For purposes of the directives system, corporate organizations under contract with DOE to perform services with the clause at DEAR 970.5204-2, laws, regulations, and DOE directives, in their contract. [Note: This definition of contractor does not include all of the procurement contracts entered into by DOE.] (Source DOE O 251.1C). A contractor is an all- inclusive term used for the corporation, company or affiliates, entities, partners, etc., where the contractor is a LLC or partnership consisting of two or more partner corporations. Commercial Grade Dedication. An acceptance process undertaken to provide reasonable assurance that a commercial grade item to be used in a safety system or mission essential facility meets specified requirements. This assurance is achieved by identifying the critical characteristics of the item and verifying their acceptability by inspections, tests, or analyses performed by the purchaser or third party dedicating entity after delivery, supplemented as necessary by one or more of the following: commercial grade surveys, product inspections or witness at hold points at the manufacturer’s facility, and analysis of historical records for acceptable performance. Engineering Evaluation. A technical review conducted by qualified engineering and other technical personnel using accepted methods to determine the actual or potential cause of a substantial safety hazard and the effect of an S/CI. Nonconformance. A deficiency in characteristic, documentation, or procedure that renders the quality of an item or activity unacceptable or indeterminate. Quality System: A structured and documented management system describing the policies, objectives, principles, organizational authority, responsibilities, accountability, and implementation plan of an organization for ensuring quality in its work processes, products (items), and services. The Quality System provides the framework for planning, implementing, and assessing the work performed by an organization and for carrying out required quality assurance (QA) and quality control (QC) activities (source: ANSI/ASQC E4). Appendix D DOE G 414.1-2B D-2 8-16-11 Safety System. A DOE nuclear and nonnuclear facility structure, system, or component of which the preventive or mitigative function is a major contributor to defense-in-depth (i.e., prevention of uncontrolled material release) or worker safety as determined from hazard analysis. Also, a DOE structure, system, or component, including a primary environmental monitor or a portion of a process system, the failure of which could adversely affect the environment, safety, or health of the public or workers. DOE G 414.1-2B Appendix E 8-16-11 E-1 APPENDIX E: ACRONYMS ANSI American National Standards Institute ANST American Society for Nondestructive Testing ASME American Society of Mechanical Engineers ASQ American Society for Quality C.F.R. Code of Federal Regulations CGD Commercial Grade Dedication CHRIS Corporate Human Resources Information System CRD contractor requirements document DCS Data Collection Sheet DEAR Department of Energy Acquisition Regulation

DI Defective Items DoD Department of Defense DOE Department of Energy EFCOG Energy Facility Contractors Group EM Environmental Management EPA Environmental Protection Agency FAR Federal Acquisition Regulation FQA Fastener Quality Act FRA Functions, Responsibilities, and Authorities FRAM Functions, Responsibilities, Authorities Manual GC General Counsel GIDEP Government-Industry Data Exchange Program HSS Health, Safety and Security IAEA International Atomic Energy Agency IG Inspector General INPO Institute of Nuclear Power Operations ISMS Integrated Safety Management System ISO International Organization for Standardization MAPEP Mixed Analyte Performance Evaluation Program M&TE Measuring and Test Equipment NIST National Institute of Standards and Technology NNSA National Nuclear Security Administration NQA Nuclear Quality Assurance NRC Nuclear Regulatory Commission NTC National Training Center OE Operating Experience OIG Office of Inspector General OMB Office of Management and Budget ORPS Occurrence Reporting Processing System PSO Program Secretarial Office QA Quality Assurance QAP Quality Assurance Program Appendix E DOE G 414.1-2B E-2 8-16-11 QIP Quality Assurance Implementation Plan S/CIs Suspect and Counterfeit Items SMS Safety Management System SSC Structures, Systems and Components STD Standard SQA Software Quality Assurance UFP-QS Uniform Federal Policy for Implementing Environmental Quality Systems USPTO U.S. Patent and Trademark Office V&V Verification and Validation DOE G 414.1-2B Attachment 1 8-16-11 Page-1 [QA Assessment Plan Template] Quality Assurance Assessment Plan For ______________________ Office of __________________________________ Department of Energy Office of _______________________ Date: DOE G 414.1-2B Attachment 1 8-16-11 Page-3 CONTENTS 1 . SCOPE................................................................................................................ Page 4 2 . OBJECTIVE: ..................................................................................................... Page 4 3 . REQUIREMENTS ............................................................................................. Page 4 4 . ASSESSMENT TEAM ...................................................................................... Page 5 5 . ACTIVITIES TO BE ASSESSED ................................................................................ Page 5 6 . ORGANIZATIONS TO BE NOTIFIED...................................................................... Page 12 7 . APPLICABLE RECORDS, INTERVIEWS, OBSERVATIONS ............................ Page 12 8 . SCHEDULE ....................................................................................................... Page 13 9 . APPENDIX 1-A. ASSESSMENT TEAM MEMBERS’ BIOGRAPHICAL INFORMATION ................................................................................................ Page A-1 This assessment plan template is intended for use by the DOE for planning and assessing DOE Site Office QA implementation. It provides a broad based starting point for developing an assessment plan and lines of inquiries that should be supplemented by local requirements. Users are expected to limit the scope and focus the plan on the specific areas of interest for the given assessment. This template may be easily modified for use by DOE to plan and conduct assessments of contractor QAP implementation.

Attachment 1 DOE G 414.1-2B Page 4 8-16-11 1.0 SCOPE This assessment is considered a preliminary assessment of the implementation of QA policies and principles in ______________ operations related to ____________ activities. The areas of interest or activities to be assessed are identified in Section _____. (1) Program – (2) Personnel Training and Qualification – (3) Quality Improvement – (4) Documents and Records – (5) Work Processes – (6) Design – (7) Procurement – (8) Inspections and Acceptance Testing – (9) Management Assessment – (10) Independent Assessment – (11) Software Quality Assurance – (12) Suspect/Counterfeit Items Prevention – (13) Corrective Action Management Program – (14) Integrated Safety Management – __________ A follow-up assessment, pending the outcome of this assessment, is anticipated on or about _________ 2.0 OBJECTIVE To provide feedback for continuous improvement: A process is established and effectively implemented to continuously improve safety and improve the efficiency and quality of operations. Procedures and mechanisms are in place to implement integrated safety management and quality assurance programs through approved program plans. 3.0 REQUIREMENTS DOE O 414.1D, Quality Assurance 10 C.F.R. 830, Nuclear Safety Management DOE P 450.4, Safety Management System Policy Site-specific QA documentation DOE G 414.1-2B Attachment 1 6/30/2011 Page 5 Site-specific ISMS documentation Organization or Site-specific functions, responsibilities, and authorities manual/functions, responsibilities, and authorities (FRAM/FRA) 4.0 ASSESSMENT TEAM The Assessment Team will be composed of the following individuals: ____________________________________ Team Leader ____________________________________ (Observer) ____________________________________ (Observer) Brief biographical information for each team member is provided in Appendix 1-A. 5.0 ACTIVITIES TO BE ASSESSED The Assessment Team will review the implementation of Quality Assurance (QA) and Integrated Safety Management Systems (ISMS) by evaluating some of the primary ___________ functions and high-risk ____________ activities. The Team will focus on __________________ function(s) and a selected set of high-risk (hazard) activities. The Team will choose which activities to evaluate from a list of activities prioritized by risk provided by ___________ prior to or at the initial briefing. For a chosen activity, the ____________________________ topics will be evaluated by ―drilling down‖ into the activity by lines of inquiry. Personnel interviews and observations may be utilized as determined by the Team while on-location. As lines of inquiry are being pursued, the Team will also evaluate a number of general QA and ISMS topics, including ____________________________________________. Spot-checks of QA and/or ISMS implementation in __________________________ may also be conducted during the assessment of the major activities. The initial lines of inquiry listed below will be utilized during evaluation of specific work processes. 5.1 REVIEW AREA 1 – PROGRAM 1. Review the organization and reporting chain (Criterion 1, DOE O 414.1D) to ensure that clear lines of authority are established and utilized. What is the organization structure of this activity? Has the organization selected and integrated a national or international standard into the QAP description and implementing procedures?

Are functional responsibilities for QA defined and implemented for this activity? What is the organization structure of the QA oversight of this activity? Is the QA organization independent of the line management organizations? Attachment 1 DOE G 414.1-2B Page 6 8-16-11 What is the commitment of upper, middle, and lower management to the QA program and its implementation? How is Quality policy promulgated and Quality improvement implemented throughout the organization associated with this activity? Are QA audits, surveillances, and nonconformance reports part of the QA program? What are the QA interface points with organizations that support this activity, and how is QA communicated to and implemented through them? What is the process for determining the QA requirements for _____ and/or its contractors for this activity, and what is the review/approval/ implementation status of this process? How are quality problems identified, documented, corrected, and prevented in the future for this activity? How are Readiness Assessment and Operational Readiness Review results integrated with quality improvement and operational efficiency? How are quality and efficiency improvements implemented, and how are lessons learned applied to this activity? 2. Review the graded approach and any criteria for determining what QA management requirements are implemented for various types of work. What are the levels of risk associated with an activity? What is the process for grading the application of QA requirements for activities? Does it identify consequences, requirements, and depth/extent/rigor necessary in application of those requirements? What is the level of commitment of this activity’s senior management to QA? What are the greatest concerns regarding QA and ISMS implementation? Are controls and verifications applied to this activity consistent with their importance to safety, cost, schedule, and success of this mission? Are controls documented and communicated to personnel involved in this activity to ensure appropriate application and implementation? 3. Review and approval of contractor QAPs for selected high-risk activities. What is the QA program description? Is the QA program description approved? If not, when will it be approved? What is the review process for the approval of the QA program description for this activity? What is the process for determining the QA requirements for _____ and its contractor(s) for this activity, and what is the review/approval/implementation status of this process? What is/are the major contractor’s QA program descriptions, and is it/are they implemented? DOE G 414.1-2B Attachment 1 6/30/2011 Page 7 5.2 REVIEW AREA 2 – PERSONNEL TRAINING AND QUALIFICATION Evaluate the status of implementation of a training and qualification program that ensures personnel are capable of performing their assigned work. What is the organization’s documented training plan? Is it adequate and effective? How are training requirements established? What is the review and approval process? Does the organization have adequate resources, processes, and responsible elements to support the selection, training, and qualification of personnel conducting work? Does the training and qualification program describe the positions and functions to which it applies? How are certifications and special qualifications (e.g., auditors, subject matter experts,

nondestructive examination personnel, welders, etc.) established and maintained current? How is proficiency established and maintained for operational positions and/or functions? How is on-the-job training established and maintained? How is the required reading program established and maintained? 5.3 REVIEW AREA 3 – QUALITY IMPROVEMENT 1. Evaluate the status of implementation of a quality improvement process to detect and prevent quality problems. Do established work processes and procedures adequately identify and report quality problems? Does senior management policy encourage problem detection and prevention? What are the existing processes for communicating lessons learned and performance information? Are they adequate? Are they effective? How is the significance of quality problems categorized and prioritized? Does this quality improvement process provide for the identification of the causes of problems? Does it require identification of actions to prevent recurrence? Are both of these required as part of the problem correction process? Is implementation effective? How are cause, extent, and remedial and preventative actions for quality problems addressed? 2. Evaluate the approach to identification, control, and correction of items, services, and processes that do not meet established requirements (nonconforming). What procedures determine which disciplines or functions evaluate and disposition the nonconforming item, service, or process? Are they adequate? What procedures identify and control nonconforming items to prevent their inadvertent use? Are these procedures adequate? How are quality problems associated with services and processes documented and corrected? Attachment 1 DOE G 414.1-2B Page 8 8-16-11 3. Evaluate the process to review item characteristics, process implementation, and other quality-related information to identify items, services, and processes needing improvement. What quality performance analysis system is in place (e.g., six sigma, metrics and indicators, trending)? Is it adequate? How does the performance analysis system provide for feedback to affected and related organizations or groups? 5.4 REVIEW AREA 4 – DOCUMENTS AND RECORDS 1. Evaluate the process for preparation, review, approval, issue, use, and revision of documents that prescribe processes, requirements, and design. What is the approved document control system providing the above functions? Is it documented? Does it clearly describe responsibilities and functions? Is it adequate? Are key functions, such as procedures, related to the quality criteria (e.g., design, procurement, work control, inspection, testing) described in reviewed and approved documents? Are key work processes and associated activities and functions in the FRA supported by documentation? 2. Evaluate the process for specification, preparation, review, approval, and maintenance of records. What is the approved and documented records management system providing the above functions? Is it adequate? Are the requirements of the National Archives and Records Administration addressed? What is the quality records standard applied to the applicable contract(s), and is it fully implemented? 5.5 REVIEW AREA 5 – WORK PROCESSES Evaluate the implementation of quality management principles in work processes. Are the methods adequate for ensuring that work is performed consistent with technical

standards, administrative controls, and other hazard controls? Are the core functions and guiding principles of ISMS addressed in work processes? Do the approved instructions, procedures, and other appropriate means for the work processes meet regulatory or contract requirements? What are the methods that identify and control items to ensure their proper use? What are the methods that maintain items to prevent their damage, loss, or deterioration? Are these methods adequate? (see Review Area 3, items 2 and 3 of this Attachment.) What are the requirements for and methods of ensuring adequate calibration and maintenance for equipment used for process monitoring or data collection? Are they adequate? DOE G 414.1-2B Attachment 1 6/30/2011 Page 9 Is there an adequate system in place for use and control of software in accordance with DOE G 414.1-4? 5.6 REVIEW AREA 6 – DESIGN Evaluate the implementation of quality management principles in design. How has this office determined whether it performs actual design work? If not, how is oversight of contractor design addressed and documented? How is the training and qualification of personnel carried out for this oversight of design? Are appropriate standards and sound engineering and scientific principles applied to design items and processes? How is this documented? Is the graded approach utilized properly? Is the use of software in the design and safety analysis process controlled in accordance with DOE G 414.1-4? What method is used to incorporate applicable requirements and design bases in design work? Are design changes controlled at the same level as the design? How are design interfaces identified and controlled, within the design authority and externally with customers and suppliers, including subcontractors? What is the process for design verification and/or validation for design products? Is it adequate? Are individuals other than those performing the design work utilized? Is the design work verified/validated before approval and implementation of design? What is the system for engineering involvement in the identification, analysis, and control of suspect/counterfeit items that could affect safety? Is it documented? Is it adequate? 5.7 REVIEW AREA 7 – PROCUREMENT 1. Review contract List A/List B requirements for proper flow down to contractors of DOE O 414.1D and/or 830 Subpart A requirements. Review the list of contractors. Review _____________________________ contract (Team will select). What is the schedule of assessments for this contractor? For this contractor, how are quality problems identified, documented, reported, corrected, and prevented in the future? How are past assessment results implemented? How are flow down requirements to subcontractors verified? Tracked? How does __________ ensure that the QA program description and ISMS are implemented for all contractors? How does the Field Office assessment program of this contractor continuously improve quality and efficiency of operations? Review recent Customer Review Survey for activities of this contractor. How is feedback relayed to the contractor? What are the follow through activities? Attachment 1 DOE G 414.1-2B Page 10 8-16-11 How are contractor commitments tracked? Enforced? How are new QA and ISMS requirements incorporated into existing contracts? 2. Evaluate the process for review of proposals and selection of contractors, QA and ISMS

requirements flow down, customer requirements flow down What is the contractor evaluation process used? What is the process for determining customer requirements/specifications and how are these requirements captured and incorporated in the contract? How are QA and ISMS requirements flowed down to the contractor and subcontractor? How is the qualification of persons who evaluated the proposals determined? Compare with training and qualification records in CHRIS. Review Contractor Records retained. Are the records complete? How are new QA requirements incorporated into new contracts? 5.8 REVIEW AREA 8 – INSPECTIONS AND ACCEPTANCE TESTING Evaluate the process for inspections and acceptance testing of items, services, and processes. What is the method for specifying inspections and tests for items, services, and processes? Is it adequate? How are acceptance and performance criteria established and utilized? Is the graded approach applied satisfactorily? What is the process for inspecting, testing, and accepting software products? Is it adequate? What standards and requirements are invoked? Are inspections and acceptance tests planned and controlled? How? How are inspections and acceptance tests results documented? Is inspection and test equipment calibration established and maintained? How? How is traceability of calibration maintained? Is it adequate? 5.9 REVIEW AREA 9 – MANAGEMENT ASSESSMENT Evaluate the assigned responsibility for _________ implementation of Management Assessment (Criterion 9 DOE O 414.1D) for selected activities. What is the schedule of management assessments? How was the risk model utilized to determine assessment areas, schedule, and rigor? Does the management assessment program include all levels of management? If so, how? Are managers actively involved in the assessment or relying on others for the assessment? How are quality problems identified, documented, reported, corrected, and prevented in the future? How are past management assessment results implemented? DOE G 414.1-2B Attachment 1 6/30/2011 Page 11 How does the management assessment program continuously improve quality and efficiency of operations? How was result of the assessment incorporated in the lessons learned program? 5.10 REVIEW AREA 10 – INDEPENDENT ASSESSMENT Evaluate the assigned responsibility for ____________ implementation of Independent Assessment (Criterion 10, DOE O 414.1D for selected activities. What is the schedule of independent assessments for this activity? How was the risk model utilized to determine assessment areas, schedule, and rigor? Is the independent assessment program adequately defined and documented? By what criteria are assessors chosen for independent assessments? What is the process for reporting independent assessment results and required corrective actions to responsible management? How are past independent assessment results tracked through completion of corrective actions? How are past independent assessment results implemented? What performance parameters does the independent assessment program measure? How does the independent assessment program continuously improve quality and efficiency of operations? How was result of the assessment incorporated in the lessons learned program? 5.11 REVIEW AREA 11 – SOFTWARE QUALITY ASSURANCE Evaluate the status of implementation of a software QA program.

What safety-related software packages does the contractor use? What DOE SQA policies and requirements exist for these software packages? Are these incorporated into a formal QA program by the contractor? Does the contract include anything specific with regard to DOE SQA policy and requirements? What are oversight processes/activities for SQA? Has there been any assessment to date either independently or as part of other QA or performance assessments? 5.12 REVIEW AREA 12 – SUSPECT/COUNTERFEIT ITEMS PREVENTION Review the oversight of the S/CI Prevention process implementation. Does the contractor have an S/CI process in place? What is the oversight process for this activity? What are the findings/observations of the most recent two assessment of this program? What are the corrective actions initiated to address any issues? How are these tracked? 5.13 REVIEW AREA 13 – INTEGRATED SAFETY MANAGEMENT Attachment 1 DOE G 414.1-2B Page 12 8-16-11 Review the integration of ISMS into the overall quality assurance program for selected high risk activities. What is the management system utilized for implementing ISMS for this activity? What are the roles and responsibilities for ISMS implementation? Are they clearly defined/documented? Are they implemented? What is the process for feedback and continuous improvement in ISMS implementation? How are ISMS lessons learned applied to this activity? Are ISMS line management responsibilities defined and implemented? What work controls are in place to ensure safety? What is the process for determining and grading the application of ISMS requirements? What is the commitment of upper, middle, and lower management to the ISMS and its implementation? How are Readiness Assessment and Operational Readiness Review results integrated with ISMS and operational efficiency? What are the greatest concerns regarding ISMS implementation? 6.0 ORGANIZATIONS TO BE NOTIFIED List the organizations to be assessed and other appropriate organizations that should be notified prior to the assessment. 7.0 APPLICABLE RECORDS, INTERVIEWS, AND OBSERVATIONS The Assessment Team will require support from __________ to do an effective assessment. The Team has identified preliminary list of records, interviews, and observations of interest. It should be noted that additional ones may be identified as the assessment progresses. __________ should be prepared to provide in advance the records and documents identified and make the required individuals available for the interviews. Record Review: FRAM Quality Assurance Program Description ISMS Description Contract List A/List B requirements Contractor QAP approval List of current projects and activities Management Assessment schedule Independent Assessment schedule For ISMS: Oversight Assessment Plan for FY____ FY____ Safety Performance Objectives DOE G 414.1-2B Attachment 1 6/30/2011 Page 13 Current _____ ISMS Description Contractor ISMS Description Contract Section I DEAR Clauses 970.5223-1 and 970.5204-2 Interviews: Senior Management (closeout) Facility and Operations Team Leader Quality and Safety Division Director Quality Assurance and Process Management Team Leader Quality Assurance Subject Matter Expert Facility and Materials Disposition Division Acting Director Waste Disposition Division Acting Director Lead Facility Representative Facility Engineers Others as needed Observations:

Any Management Assessment in progress Any Independent Assessment in progress Oversight or surveillance of contractor’s S/CI process implementation Corrective action status or planning meeting Software QA activity Performance measure status meeting Effectiveness verification of any ISMS improvement action 8.0 SCHEDULE Table 1, below, lays out the proposed schedule for the assessment. The Assessment Team will arrive at the site on _____, _____. The briefing shown in Figure 1 will commence as soon as the Team arrives on site, which is expected to be ________. The activities in the following _____ days will include interviews of key personnel and may include observations of activities. The Assessment Team Leader, in conjunction with ___________ management will identify the individuals that need to be invited for discussions and the activities to be observed. Attachment 1 DOE G 414.1-2B Page 14 8-16-11 Table 1: Proposed Assessment Schedule Date: Time: Travel to: Time: Briefing Review list of current high-risk activities Determine schedule for closeout meeting Collect documents Review documents Date: Time: ISMS Integration into QA Graded Approach definition, procedures, and implementation Time: Contractor Lists A and B Specific Contracts and Procurement Contractor Oversight o QA program description review and approval S/CI Implementation o CAMP o Software QA o Feedback and lessons learned Date: Time: Continue oversight elements Time: New Contract(s) - Review Status o QA requirements flow down o Technical requirements flow down o Bidders questions Date: Time: Management Assessments Independent Assessment Additional Assessment Topics As Required Time: Team meeting Closeout meeting Date: Time: Travel back to DOE HQ DOE G 414.1-2B Appendix 1-A 8-16-11 Page 1-A APPENDIX 1-A: ASSESSMENT TEAM MEMBERS’ BIOGRAPHICAL INFORMATION [Include the following information in the plan for the Team Leader and all members of the Assessment Team] Team Leader – Name & Title: Experience: Education: Personal: Team Leader – Name & Title: Experience: Education: Personal: Team Leader – Name & Title: Experience: Education: Personal: