Compliance and Enforcement Actions (CEA)

U.S. Department
of Transportation
Federal Aviation
Administration

Advisory
Circular

Subject: Aircraft Certification Service Voluntary
Disclosure Reporting Program

Date: 10/01/2016
Initiated By: AIR-150

AC No: 00-68

1

PURPOSE.

1.1

This advisory circular (AC) provides information and guidance to Federal Aviation
Administration (FAA) Aircraft Certification Service (AIR) Production Approval Holders
(PAHs), Design Approval Holders (DAHs), and Organization Designation Authorization
Holders (ODA Holders) who choose to voluntarily disclose apparent noncompliance with
Title 14 of the Code of Federal Regulations (14 CFR).

1.2

The procedures and practices outlined in this AC generally apply when PAHs, DAHs or
ODA Holders voluntarily disclose noncompliance with regulatory requirements. These
procedures and practices do not apply, however, to those persons who: (1) violate 14 CFR
21.2, Falsification of Applications, Reports, or Records; (2) are required to report failures,
malfunctions, and defects pursuant to 14 CFR 21.3, but fail to make those reports in the
timeframe required by the regulations; or (3) fail to report unsafe conditions pursuant to
14 CFR 183.63, Continuing Requirements: Products, Parts or Appliances.

1.3

This AC is not mandatory and does not constitute a regulation. This AC describes an
acceptable means to voluntarily disclose an apparent noncompliance. If you use the AC
to voluntarily disclose noncompliance, the processes and requirements in this AC must be
followed.

2

AUDIENCE.
This AC affects AIR regulated entities (RE), which consist of any FAA PAH, DAH, or
ODA Holder whose lead managing office is an AIR office (AIR lead ODA holder).
Note: AIR REs are not eligible to disclose via the Flight Standard electronic Voluntary
Disclosure Reporting Program (VDRP) system.
This AC also provides guidance to AIR investigating personnel for accepting and
processing noncompliance which are voluntarily disclosed.

1

10/01/2016

AC 00-68

3

RELATED REGULATIONS.
Title 14 CFR parts 21, 26, 39, 43, 45, and 183.

4

CHANGES.
This is the first issuance of this AC.

5

CANCELLATION.
This AC, which provides AIR-specific guidance for processing voluntary disclosures, as
of its effective date, replaces the use of AC 00-58B, Voluntary Disclosure Reporting
Program, dated 4/29/2009 for all FAA PAHs, DAHs, and AIR lead ODA Holders.

6

EFFECTIVE DATE.
This AC is effective 10/01/2016

7

BACKGROUND.
One of the FAA’s primary goals is to promote the highest level of safety and compliance
with regulatory standards by using the most effective means to return a RE to full
compliance. Typically, the FAA would use the compliance and enforcement processes
set forth in FAA Order 2150.3, as amended, to bring REs back into compliance when
noncompliance are found. The FAA believes aviation safety is well served by incentives
for REs to identify and correct their own instances of noncompliance and to invest more
resources in efforts to preclude their recurrence. Through this AC, the FAA is
establishing processes under which it will not initiate compliance action, administrative
action, or legal enforcement action when an entity detects noncompliance, promptly
discloses them to the FAA, meets the criteria set forth in this AC, and takes prompt
corrective action, acceptable to the FAA, to ensure the same or similar noncompliance do
not recur. This incentive is designed to encourage compliance with regulations, foster
safe operating practices, and promote the development of internal evaluation programs.

8

KEY TERMS.
The following key terms and phrases are defined to ensure a standard interpretation and
understanding of the FAA’s voluntary disclosure policy.

8.1

Evidence.
For the purpose of voluntary disclosure, evidence generally consists of written
documentation or reports that support a RE’s analysis of the disclosed apparent
noncompliance and the resulting elements of the proposed corrective action plan (CAP)
Evidence generally is derived from the following:


Documents or manuals reviewed,



Equipment examined,

2

10/01/2016

AC 00-68



Activities observed, and



Interview data.

8.2

Corrective Action. The action(s) taken by a regulated entity to eliminate ongoing
noncompliance and to ensure future compliance.

8.3

Investigating Personnel (IP). AIR personnel normally involved in investigating
apparent noncompliance. For the purposes of this AC, IPs may be any of the following:


Aviation safety inspectors for PAHs,



Aviation safety engineers and flight test pilots/engineers for DAHs, or



Organization management team (OMT) leads for ODAs.

Note: The OMT lead may choose to involve OMT members in processing a disclosure,
but the lead should be the primary point of contact.
8.4

Noncompliance. As used in this process, describes any condition or discrepancy found
that is not in compliance with the regulations or with any FAA-approved
processes/procedures for which compliance is required, that requires corrective action.

8.5

Quality Escape. Products or articles that do not conform to type design which were not
detected prior to leaving a quality system.

8.6

Regulated Entity (RE). Any holder of an FAA-approved certificate, approval, or
authorization.

8.6.1

Design Approval Holder (DAH) is a holder of an FAA approved Type Certificate;
Supplemental Type Certificate, or Technical Standard Order.

8.6.2

Production Approval Holder (PAH) is a holder of an FAA-approved Production
Certificate, Parts Manufacturing Approval, or Technical Standard Order Authorization.

8.6.3

Organization Designation Authorization (ODA) Holder is, for the purposes of this AC,
the holder of an FAA-approved ODA which authorizes the ODA holder to perform
approved functions on behalf of the Administrator, and whose lead managing office is
AIR.

8.7

Remote Risk to Safety. A compromise to safety that is unlikely to occur or would
seldom occur.

8.8

Systemic Noncompliance. The occurrence of noncompliance characterized by having
similar, interconnected discrepancies throughout the system or organization and/or similar
discrepancies that occur frequently.

3

10/01/2016

AC 00-68

9

VOLUNTARY DISCLOSURE REPORTING PROGRAM

9.1

The FAA believes the open sharing of information regarding noncompliance and a
cooperative, as well as an advisory approach, to solving problems will enhance and
promote aviation safety. When a noncompliance is discovered and disclosed, the RE and
the IP should work together to identify the most appropriate means to gain compliance.

9.2

Under AIR’s VDRP there are two means by which an RE may disclose a noncompliance:
either through the informal disclosure process (see section 10) or the formal disclosure
process (see section 11). The appropriate disclosure process for a particular
noncompliance depends on the type of the noncompliance being disclosed.

9.3

To be eligible for VDRP, whether disclosing under the informal or the formal disclosure
process, the disclosure must meet the following requirements:

9.3.1

The FAA Was Notified. The RE has notified the FAA of the noncompliance promptly
after detecting it and before the FAA has learned of it by other means.

9.3.2

The Noncompliance Was Inadvertent. The noncompliance was the result of inattention
and did not result from a purposeful choice.

9.3.3

The Noncompliance Does Not Reflect a Lack of Qualification. The noncompliance does
not indicate a lack, or reasonable question, of qualification of the RE.

9.3.4

Immediate Action Satisfactory to the FAA Was Taken. Immediate action, satisfactory to
the FAA, was taken upon discovery to cease the conduct that resulted in the
noncompliance.

9.3.5

Corrective Action Plan. The RE has developed, or is developing, a corrective action plan
(CAP) and a schedule of implementation satisfactory to the FAA. For formal disclosures,
the CAP should include a follow-up self-audit to ensure the action taken corrected the
noncompliance. This self-audit is in addition to any audits conducted by the FAA.
Note: If there are minor deficiencies in the disclosure, the IP may work with the RE to
correct those prior to making a determination of acceptance.

9.4

As a condition for consideration under the VDRP, an RE must enter into an agreement for
tolling statutory or regulatory time limitations for the initiation of a legal enforcement
action in the event of a failure to complete corrective action. The agreement will specify
that the tolling period begins on the date the RE discloses the noncompliance and extends
through the date in the event the FAA makes a final determination that the RE failed to
complete corrective action. The statutory or regulatory time limitation for the initiation of
a legal enforcement action will be extended by a period equal to the duration of the tolling
period. By submitting either an informal or formal VDRP, the RE is thereby
acknowledging this agreement for tolling statutory or regulatory time limitations from the
date the RE discloses the noncompliance to the date in the event the FAA makes a final
determination that the RE failed to complete corrective action.

4

10/01/2016

AC 00-68

10

INFORMAL VOLUNTARY DISCLOSURE REPORTING PROCESS.

10.1

The informal disclosure process is a streamlined means for a RE to voluntarily disclose
certain noncompliance and for an IP to process such disclosures. The IP may accept a
disclosure under the informal VDRP when:

10.1.1

The disclosure meets the requirements of section 9.3 of this AC,

10.1.2

The RE and the IP have executed an Informal Disclosure Agreement as described in
section 10.2, and

10.1.3

The disclosure does not involve:


A noncompliance that poses more than a remote risk to safety;



A quality escape for articles and parts other than cosmetic flaws (flaws that do not
affect fit/form/function); or



A systemic discrepancy to production quality system procedural requirements.

10.2

Informal Disclosure Agreement. An RE may disclose eligible noncompliance under the
informal process only if it has executed an informal disclosure agreement with the
responsible IP’s office prior to the informal disclosure. This agreement defines when and
by what means the RE discloses noncompliance. This agreement must contain the
following:

10.2.1

An agreement to the type of noncompliance that the RE may disclose informally (e.g.,
non-systemic low risk noncompliance; quality escapes due to cosmetic flaws).

10.2.2

An agreement to the timeframe and means by which the RE will disclose noncompliance
to the FAA (e.g., daily, weekly, quarterly). The timeframe must not exceed a quarterly
disclosure period.

10.2.3

An agreement to the information that the RE must report to the FAA at the time the
noncompliance(s) is disclosed. At a minimum, the RE must report the following
information:

10.3



A description of the apparent noncompliance



A causal analysis of the apparent noncompliance



A corrective action taken/planned



A date by which the RE will complete the corrective action

IP Review and Documentation of Informal Disclosures. Once the RE discloses a
noncompliance using the informal VDRP, the IP is responsible for documenting and
tracking the disclosure until the IP has verified the RE’s completion of the corrective
action to the satisfaction of the FAA. The responsible IP, at a minimum, must document:


The name of the RE;

5

10/01/2016

AC 00-68



The description of the noncompliance;



A description of the corrective action that the RE will take;



Whether or not the RE implemented the corrective action to the satisfaction of the
FAA; and



The date that the IP verified that the RE implemented the corrective action.

10.4

If compliance cannot be gained through the informal VDRP, the responsible IP will
follow the AIR Compliance and Enforcement Business Process to determine the
appropriate action needed to gain compliance.

10.5

If the IP finds that a noncompliance disclosed by the RE under an agreed-upon informal
VDRP is not eligible for acceptance because it involves any of the three exclusionary
factors in paragraph 10.1, the IP will notify the RE of such ineligibility. The IP will offer
the RE the option to disclose the noncompliance under the terms of the formal VDRP as
outlined in section 11 of this AC.
Note: If the RE discloses to the FAA an apparent noncompliance during, or in
anticipation of, an AIR audit/oversight activity, or in association with an accident or
incident, the IP may forgo the use of the VDRP and may take administrative action or
recommend legal enforcement action in accordance with Order 2150.3, as amended, and
the AIR Compliance and Enforcement Process.

11

FORMAL VOLUNTARY DISCLOSURE REPORTING PROCESS.
The formal VDRP employs a six-stage process. Responsibility for each stage is assigned
either to the RE or the IP, as described below. The FAA accepts a RE’s voluntary
disclosure under the formal VDRP when:


The disclosure meets the requirements of section 9.3 of this AC, and



The RE has not executed an Informal Disclosure Agreement prior to the disclosure
and thus is ineligible to voluntarily disclose under the informal VDRP, or



The RE is eligible to voluntarily disclose under the informal VDRP but such
disclosure is excluded under the criteria in 10.1.3.

Note: In the context of the AIR VDRP, “other means” (see section 9.3.1) does not include
in-service items reported through the RE’s Continued Operational Safety Process (COSP)
or the Monitor Safety/Analyze Data (MSAD) process. If the RE reports an in-service
issue through COSP or MSAD that was later discovered to be a quality escape, the
disclosure is still acceptable provided it meets the criteria outlined in section 9.3 of this
AC.
11.1

Stage I — Initial RE Notification to the FAA of an Apparent Noncompliance.
The following guidance applies when the RE notifies the FAA of an apparent
noncompliance:

11.1.1

Notification must be directed to the appropriate IP who has oversight of the RE.

6

10/01/2016

AC 00-68

11.1.2

Notification must be submitted to the IP via written hardcopy or email.

11.1.3

Notification should be submitted by the RE within 24 hours of the RE discovering the
apparent noncompliance. An IP may use discretion and accept disclosures that exceed the
24-hour policy when the IP determines that a later submission is justified based on the
specific circumstances. The RE should not delay notification for any reason. The
following are examples of discretion for VDRP notification acceptance:

11.1.4

11.1.3.1

A voluntary disclosure may be accepted if received later than 24 hours after
discovering the noncompliance if the FAA has learned of an apparent
noncompliance from an ASAP report as described in AC 120-66, Aviation
Safety Action Program (ASAP), as amended.

11.1.3.2

A voluntary disclosure may be accepted if received later than 24 hours after
the RE discovers the apparent noncompliance if (1) the RE discovered the
noncompliance as a result of an ODA self-audit and (2) the noncompliance
does not pose more than a remote risk to safety. If the noncompliance poses
more than a remote risk to safety, the 24 hour policy applies. The RE must
disclose the noncompliance in accordance with this AC and note the
noncompliance in the self-audit report as described in FAA Order 8100.15,
Organization Designation Authorization Procedures.

Notification must address the following items:
11.1.4.1

Brief Description of Apparent Noncompliance. A brief description of the
apparent noncompliance, including an estimate of the duration of time that it
remained undetected, as well as by whom, where, how, and when it was
discovered.

11.1.4.2

Verification the Noncompliance has Ceased. Verification that
noncompliance ceased after the apparent noncompliance was identified.

11.1.4.3

Brief Description of Immediate Action. A brief description of the
immediate action taken after the apparent noncompliance was identified, the
immediate action taken to terminate the conduct that resulted in the apparent
noncompliance, and identification of the person responsible for taking the
immediate action.

11.1.4.4

Verification of Evaluation. Verification that the RE is evaluating its
operations to determine if there are any systemic problems and the
corrective steps necessary to prevent the apparent noncompliance
from recurring.

11.1.4.5

Identification of Responsible Person. Identification of the person
responsible for the implementation of the CAP.

11.1.4.6

Acknowledgement of Written Report. Acknowledgment that a detailed
written report will be provided to the IP within 10 working days.
7

10/01/2016

AC 00-68

11.2

Stage II—FAA Response to the RE.
After receiving the RE’s initial notification, the IP will do the following:

11.2.1

The IP will review the disclosure and confirm that the submission meets the requirements
set forth in paragraph 9.3 of this AC.

11.2.2

If the IP determines the disclosure is acceptable, the IP will:


Issue a written acknowledgment (letter/electronic method). This acknowledgement
should include a request for a written report, as described in 11.3 of this AC;



Assign a VDRP tracking number to the disclosure; and



Enter all required VDRP information into the office tracking system.

11.2.3

If the IP determines the disclosure is not acceptable, the IP will follow the AIR
Compliance and Enforcement Business Process to determine the appropriate action and
will notify the RE.

11.3

Stage III—Written Report of the RE’s Apparent Noncompliance.
The RE will provide the written report to the IP within 10 working days after the RE
makes the initial notification, regardless of whether the RE has received the IP’s written
acknowledgement of receipt of the RE’s initial notification. If the RE does not fully
develop a proposed CAP within 10 working days, the RE will provide at least an
overview of its CAP in the written report submitted within the 10 working days. The RE
must submit a detailed description of the CAP within 30 calendar days after initial
notification. The written report must include the following information:

11.3.1

Regulation or Procedure Violated. A list of the specific FAA regulation(s) or
procedure(s) for which compliance is required that may have been violated.

11.3.2

Summary of the Noncompliance. A description of the noncompliance, including the
duration of time it remained undetected, as well as how and when it was detected.

11.3.3

Immediate Action Taken. A description of the immediate action(s) taken to terminate the
conduct that resulted in the noncompliance occurring. This includes when the action was
taken and who was responsible for taking the action.

11.3.4

Explanation of How the Noncompliance Was Inadvertent. An explanation that
demonstrates the apparent noncompliance was inadvertent. Inadvertent conduct (1) is the
result of inattention and (2) does not result from a purposeful choice to engage in the
conduct that results in the noncompliance.

11.3.5

Analysis of the Noncompliance. Analysis includes the identification of all causes
associated with the noncompliance, as well as a summary of the evidence and supporting
documentation that demonstrates the scope of the noncompliance.

11.3.6

Corrective Action Plan. A detailed description of the proposed CAP, outlining the
planned corrective actions, proposed long-term corrective actions, the responsibilities for
8

10/01/2016

AC 00-68

implementing the corrective action, a timeline for completing the CAP, and a self-audit
following implementation to ensure the corrective action(s) is effective. The following
are examples of the types of questions or issues the CAP should address:


Does the noncompliance involve equipment, facilities, or individuals beyond those
addressed in the initial notification and for which immediate action was taken?



Are procedural or organizational changes necessary?



How will the RE determine whether or not any procedural or organizational changes
are effective?



What procedures will the RE develop to ensure that it will periodically review the
affected area in order to identify and mitigate risk concerns before a noncompliance
results?



Who will be responsible for performing periodic reviews?



To whom in the RE’s organization will the results of those periodic reviews be
reported, and how will they be documented?



A schedule for completion of a self-audit by the RE following implementation of the
CAP to verify the action taken was effective in correcting noncompliance. The
proposal should also include identification of the individual(s) responsible for
conducting the self-audit. This self-audit is in addition to any audit conducted by the
FAA.

11.3.7

Responsible RE Focal Point. Identification of the RE focal point responsible for
monitoring the implementation and completion of the CAP.

11.4

Stage IV—Written Report Review and Corrective Action Plan Agreement.
The IP will work with the RE to ensure the RE has identified all cause(s) and systemic
issue(s) that led to the noncompliance. This collaboration helps ensure the corrective
action(s) contained in the CAP are acceptable to the FAA.

11.4.1

If the IP has agreed to the RE’s CAP, the IP will:


Issue written notification (letter/electronic means) to the RE indicating the proposed
CAP is accepted and the disclosure is closed subject to reopening as a legal
enforcement action if the RE fails to implement the corrective action agreed upon in
the CAP.



Update the office VDRP tracking system with the required fields.

11.4.2

If after working with the RE, the IP and the RE cannot agree on a CAP under the VDRP
that is satisfactory to the FAA, the IP will pursue the appropriate enforcement action by
taking administrative action or recommending legal enforcement action in accordance
with Order 2150.3, as amended, and the AIR Compliance and Enforcement Process.

11.5

Stage V—RE’s Implementation of a Corrective Action Plan

9

10/01/2016
11.5.1

AC 00-68

After the FAA has accepted the RE’s CAP, the RE will begin/continue to implement
corrective action(s) as outlined in the CAP. During the implementation period, the IP and
RE should continue to work together. During the implementation, the RE is responsible
for:


Ensuring that it completes all corrective action(s) outlined in the written report as
agreed upon by the RE and the IP, and



Conducting a self-audit at the completion of the corrective action(s) to ensure proper
implementation and the effectiveness of the implementation.

11.5.2

Changes can be made to the CAP when either the RE or the IP have identified the need.
If a change to the CAP is needed, the RE should submit the proposed change in writing to
the IP. The IP should review the proposed change and issue an amended written
notification if the change is accepted.

11.5.3

The IP should monitor the implementation of the corrective step(s) and assess the RE’s
corrective effort(s). If, during this period, the IP determines the step(s) taken by the RE
are not those documented in the CAP or the corrective action agreed upon is not being
completed satisfactory to the FAA, the closure of the VDRP may be rescinded and legal
enforcement action initiated.

11.6

Stage VI—FAA Verification of Completed Corrective Action Plan
Once the RE has completed all corrective action(s) under the CAP, the RE will notify the
IP of such completion. After receiving notification of the completed CAP, the IP will
verify whether or not the corrective action is satisfactory to the FAA. The IP should
conduct the verification during the next scheduled oversight activity or earlier at the
discretion of the IP.

11.6.1

If the IP verifies that the RE implemented the CAP to the satisfaction of the FAA, the IP
documents the completed verification in the IP’s local office’s VDRP tracking system.
The IP should notify the RE either orally or in writing that the IP has verified that the RE
has completed the CAP to the satisfaction of the FAA.

11.6.2

If the RE did not implement the CAP as agreed upon between the RE and the IP and to
the satisfaction of the FAA, the IP pursues legal enforcement action for both the original
noncompliance and any subsequent noncompliance that have occurred due to the lack of
corrective action.

12

ORGANIZATION DESIGNATION AUTHORIZATION SELF-AUDIT
DISCLOSURES.
When an ODA self-audit identifies noncompliance that do not pose more than a remote
risk to safety, the RE can disclose those noncompliance with the self-audit report and do
not need to meet the initial 24 hour reporting requirement as outlined in this process. The
IP and the RE will still follow the processes outlined in this AC for corrective action once
the disclosure is made.

10

10/01/2016

AC 00-68

For any noncompliance found during an ODA self-audit that pose more than a remote
risk to safety, the ODA must disclose within the 24 hour timeframe and follow the formal
VDRP process outlined in this AC.
13

REPEATED NONCOMPLIANCE.
If a repeated noncompliance occurs, notwithstanding the fact that a CAP was
satisfactorily completed and followed, the procedures outlined in this AC may apply to
the disclosure of the repeated noncompliance. Upon consideration of the facts and
circumstances surrounding the repeated noncompliance, the IP will determine on a caseby-case basis whether to accept a report involving repeated noncompliance under the
VDRP in accordance with this AC. REs and IPs are encouraged to evaluate the systemic
issues and circumstances surrounding each apparent noncompliance.

14

DISPUTE RESOLUTION.
When disputes occur regarding the acceptance of a proposed comprehensive fix or a
modification thereto before the fix is considered satisfactory, the IP and the RE may
request that the issue be resolved at the next level of management within the FAA. This
allows for an independent assessment of the areas in disagreement.

15

APPLICABILITY OF THE FREEDOM OF INFORMATION ACT (FOIA) TO
SELF-DISCLOSURE RECORDS.
Information submitted by the RE to the FAA for review pursuant to this voluntary selfdisclosure program is protected from release to the public in accordance with the
provisions under 14 CFR Part 193.

16

WHERE TO FIND THIS AC.

16.1

You may find this AC at http://www.faa.gov/regulations_policies/advisory_circulars/.

16.2

If you have any suggestions for improvements or changes, you may use the template
provided at the end of this AC.

David W. Hempe
Deputy Director, Aircraft Certification Service

11

10/01/16

AC 00-68
Appendix A
Appendix A. ADVISORY CIRCULAR FEEDBACK INFORMATION

If you find an error in this AC, have recommendations for improving it, or have suggestions
for new items/subjects to be added, you may let us know by (1) complete the form online at
https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx or (2) emailing this form to [email protected]
Subject: AC

Date: ___________

Please check all appropriate line items:
An error (procedural or typographical) has been noted in paragraph _______ on page
_______.
Recommend paragraph _______ on page _______ be changed as follows:

In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)

Other comments:

I would like to discuss the above. Please contact me.
Submitted by: _________________________________

A-1

Date: __________________