AUDIT REPORT

Audit of NRC’s Vendor Inspection Program

OIG-10-A-20 September 28, 2010

All publicly available OIG reports (including this report) are accessible through

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

September 28, 2010

MEMORANDUM TO: R. William Borchardt

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S VENDOR INSPECTION PROGRAM

(OIG-10-A-20)

Attached is the Office of the Inspector General’s (OIG) audit report titled, Audit of NRC’s 

Vendor Inspection Program.

The report presents the results of the subject audit. Agency comments provided at the 

August 31, 2010, exit conference and an additional meeting on September 10, 2010,

have been incorporated, as appropriate, into this report.

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915 or RK Wild, Team Leader, Nuclear Reactor Safety Audit Team, at 415- 5948.

Attachment: As stated 
Electronic Distribution

Edwin M. Hackett, Executive Director, Advisory Committee 

 on Reactor Safeguards

E. Roy Hawkens, Chief Administrative Judge, Atomic Safety 

 and Licensing Board Panel

Stephen G. Burns, General Counsel

Brooke D. Poole, Director, Office of Commission Appellate Adjudication

James E. Dyer, Chief Financial Officer

Hubert T. Bell, Inspector General

Margaret M. Doane, Director, Office of International Programs

Rebecca L. Schmidt, Director, Office of Congressional Affairs

Eliot B. Brenner, Director, Office of Public Affairs

Annette Vietti-Cook, Secretary of the Commission

R. William Borchardt, Executive Director for Operations

Michael F. Weber, Deputy Executive Director for Materials, Waste,

 Research, State, Tribal, and Compliance Programs, OEDO

Darren B. Ash, Deputy Executive Director 

 for Corporate Management, OEDO

Martin J. Virgilio, Deputy Executive Director for Reactor

 and Preparedness Programs, OEDO

Nader L. Mamish, Assistant for Operations, OEDO

Kathryn O. Greene, Director, Office of Administration

Patrick D. Howard, Director, Computer Security Office

Roy P. Zimmerman, Director, Office of Enforcement

Charles L. Miller, Director, Office of Federal and State Materials

 and Environmental Management Programs

Cheryl L. McCrary, Director, Office of Investigations

Thomas M. Boyce, Director, Office of Information Services

James F. McDermott, Director, Office of Human Resources

Michael R. Johnson, Director, Office of New Reactors

Catherine Haney, Director, Office of Nuclear Material Safety

 and Safeguards

Eric J. Leeds, Director, Office of Nuclear Reactor Regulation

Brian W. Sheron, Director, Office of Nuclear Regulatory Research

Corenthis B. Kelley, Director, Office of Small Business and Civil Rights

James T. Wiggins, Director, Office of Nuclear Security

 and Incident Response

Marc L. Dapas, Acting Regional Administrator, Region I

Luis A. Reyes, Regional Administrator, Region II

Mark A. Satorius, Regional Administrator, Region III

Elmo E. Collins, Jr., Regional Administrator, Region IV
Audit of NRC’s Vendor Inspection Program

i

EXECUTIVE SUMMARY

BACKGROUND

The Nuclear Regulatory Commission (NRC) endeavors to protect the 

public health and safety and the environment by overseeing vendor 

compliance with NRC’s regulations for assuring the integrity of domestic 

and global parts and services supplied to nuclear power reactors. 

Vendors manufacture a range of components such as fasteners, pumps, 

valves, and reactor vessels, as well as provide design, engineering, and 

construction services. While most vendors do not hold NRC licenses, they 

are nonetheless bound through contracts with licensees, applicants, or 

other vendors to comply with NRC’s quality assurance regulations

contained in Appendix B to Title 10, Code of Federal Regulations 

(10 CFR), Part 50 (Appendix B). Vendors are also required to comply with 

10 CFR Part 21 (Part 21). NRC conducts reactive and routine inspections 

of vendors’ implementation of Appendix B and Part 21 requirements.

PURPOSE

The audit objective was to assess NRC’s regulatory approach for ensuring 

the integrity of domestic and foreign safety-related parts and services 

supplied to current or prospective nuclear power reactors.

RESULTS IN BRIEF

Beginning in 2007, the agency proactively enhanced its overall approach 

to vendor inspections and increased vendor outreach efforts. After the 

creation of the Office of New Reactors (NRO), two new branches were 

established to perform additional vendor inspections, including routine 

inspections. The Office of the Inspector General (OIG) has identified 

areas that need management attention while NRO continues its ongoing 

vendor inspection activities. Specifically:

 Improvements to NRO’s vendor inspection planning would enhance 

the process NRC uses to identify and select vendors for routine 

inspections.

o NRO’s planning process for identifying and selecting vendors for 

routine inspections, and its strategy for guiding the process, is 
Audit of NRC’s Vendor Inspection Program

ii

largely an informal one. Simply identifying the number of 

vendors is challenging, and NRO does not know how many 

vendors there are or how to identify changes in the vendor 

universe. Furthermore, NRO’s planning for selecting vendors 

for inspection is based on an approach that relies primarily on 

professional judgment. Moreover, NRO’s overall strategic 

approach to vendor identification and selection planning is 

informal as indicated by NRO staff, who have varying views of 

the purposes of the Vendor Inspection Program and routine 

vendor inspections.

 NRC has an opportunity to more effectively communicate its regulatory 

expectations and requirements to vendors.

o NRC relies on nuclear vendors’ understanding and 

implementation of its regulations to assure that safety-related 

components will perform adequately in service, and that defects 

are reported. In order for vendors supplying nuclear 

components and services to be knowledgeable of their 

obligations under the regulations, NRC must effectively 

communicate the regulations. NRC has undertaken a number 

of efforts to communicate regulations to vendors, but some 

vendors are not aware of all obligations or NRC expectations. 

NRC’s approach to communicating with vendors is not as 

effective as it could be because it does not have an outreach/ 

communications plan. When vendors are not knowledgeable of 

their obligations under NRC regulations, vendors might not 

report defects or otherwise fully assure that safety-related 

components will perform adequately in service.

 Commercial-grade dedication and Part 21 regulations and guidance 

could be clarified.

o Even when vendors are aware of the applicable NRC 

regulations and other regulatory information, NRC could clarify 

its expectations and requirements for Part 21 and for the 

process of obtaining parts from commercial suppliers known as 

commercial-grade dedication. NRC presumes that adherence 

to its regulatory requirements on the part of licensees and 

vendors assures safety. However, nuclear vendors are 

confused about how to adequately implement Part 21 and 
Audit of NRC’s Vendor Inspection Program

iii

commercial-grade dedication due to unclear, insufficient, or 

conflicting guidance. Consequently, vendors might fail to 

implement various aspects of their programs in accordance with 

NRC’s regulations, guidance, or expectations. Ultimately, this 

could lead to vendors (1) supplying parts and services to 

nuclear power plants that do not meet NRC regulatory 

requirements or quality assurance expectations, and (2) 

inadequately reporting defects.

 Calibration laboratory approval guidance could be clarified.

o NRC’s guidance for approving accredited commercial-grade 

calibration laboratories—which calibrate measuring and test 

equipment used by vendors to evaluate the properties of 

materials and parts—could be clarified. In response to a 

request from one of its licensees, NRC allowed a process 

permitting the licensee to approve calibration laboratories based 

on the reviews performed by accrediting bodies in lieu of an 

Appendix B audit or a commercial-grade survey. However, 

since NRC’s guidance documents describing this process are 

disparate, vendors are confused about, and have difficulty 

implementing, the process. Consequently, vendors’ approval of 

laboratories may not be in accordance with NRC’s expectations, 

vendors may find themselves unknowingly in violation of 

Appendix B or NRC commercial-grade dedication requirements, 

and vendors could find they have used out-of-calibration 

equipment during the manufacturing process.

 NRC’s approach to counterfeit, fraudulent, and substandard items 

(CFSI) could be strengthened.

o NRC could strengthen its current approach to CFSI. Both the 

Federal Government and private sector have recognized the 

increasing prevalence of CFSI in nuclear and other industries. 

However, NRC’s approach has been primarily reactive and 

based largely on the abilities of one or two individuals to monitor 

and evaluate the threat. This is because NRC lacks a formal 

strategy and plan to monitor and evaluate potential CFSI, and 
Audit of NRC’s Vendor Inspection Program

iv

consider program changes to address the issue. Consequently, 

the lack of any formal strategy or framework could result in 

reactor construction problems with major implications for public 

health and safety.

RECOMMENDATIONS

This report makes 10 recommendations to help NRC improve its oversight 

of the nuclear vendors and the parts and services they supply to nuclear 

power plants. A consolidated list of the recommendations appears in 

Section IV of this report.

AGENCY COMMENTS

On August 17, 2010, OIG provided a draft report to the Executive Director 

for Operations. OIG held an exit conference with the agency on 

August 31, 2010. During that meeting agency management provided 

informal comments to the draft report. Also, on September 10, 2010, OIG 

held an additional meeting with NRC staff to discuss the agency’s informal 

comments to the draft report. On September 14, 2010, OIG provided the 

agency a revised draft report, and on September 17, 2010, the agency 

declined to provide any formal comments. The final report incorporates 

revisions made, where applicable, as a result of meetings with NRC staff.
Audit of NRC’s Vendor Inspection Program

v

ABBREVIATIONS AND ACRONYMS

A2LA American Association for Laboratory Accreditation

Appendix B Title 10 Code of Federal Regulations, Part 50, Appendix B, 

Quality Assurance Criteria for Nuclear Power Plants and 

Fuel Reprocessing Plants

ASME American Society of Mechanical Engineers

10 CFR Title 10, Code of Federal Regulations

CFSI counterfeit, fraudulent, and substandard items

DOD Department of Defense

EPC engineering, procurement, and construction

EPRI Electric Power Research Institute

FAA Federal Aviation Administration

FY fiscal year

GAO Government Accountability Office

IAEA International Atomic Energy Agency

IMC Inspection Manual Chapter

IP Inspection Procedure

NRC Nuclear Regulatory Commission

NRO Office of New Reactors

NRR Office of Nuclear Reactor Regulation

NUPIC Nuclear Procurement Issues Committee

NVLAP National Voluntary Laboratory Accreditation Program

OIG Office of the Inspector General

Part 21 Title 10 Code of Federal Regulations, Part 21, Reporting of 

Defects and Noncompliance

QA Quality Assurance
Audit of NRC’s Vendor Inspection Program

vi

TABLE OF CONTENTS

EXECUTIVE SUMMARY....................................................................................... i

ABBREVIATIONS AND ACRONYMS .................................................................. v

I. BACKGROUND .............................................................................. 1

II. PURPOSE ...................................................................................... 5

III. FINDINGS....................................................................................... 5

A. Enhanced Planning Would Improve Vendor

Identification and Selection ..................................................... 7

B. Opportunity To More Effectively Communicate 

Requirements........................................................................ 15

C. Commercial-Grade Dedication and Part 21 Regulations 

and Guidance Could Be Clarified.......................................... 23

D. Calibration Laboratories Approval Guidance 

Could Be Clarified ................................................................. 33

E. NRC’s Approach to Counterfeit, Fraudulent, and 

Substandard Items Could Be Strengthened.......................... 36

IV. CONSOLIDATED LIST OF RECOMMENDATIONS ..................... 42

V. AGENCY COMMENTS................................................................. 43

APPENDIX

SCOPE AND METHODOLOGY .............................................................. 44
Audit of NRC’s Vendor Inspection Program

1

I. BACKGROUND

The Nuclear Regulatory Commission (NRC) endeavors to protect the 

public health and safety and the environment by overseeing vendor 

compliance with NRC’s regulations for assuring the integrity of domestic 

and global parts and services supplied to nuclear power reactors. NRC

directly oversees compliance by conducting reactive and routine 

inspections of vendors, and indirectly through licensee audits of vendors

and through American Society of Mechanical Engineers (ASME) 

standards. Vendors manufacture a range of components such as 

fasteners, pumps, valves, and reactor vessels, as well as provide design, 

engineering, and construction services.

While most vendors do not hold NRC licenses, they are nonetheless 

bound through contracts with licensees, applicants, or other vendors to 

comply with NRC’s quality assurance regulations contained in Appendix B 

to Title 10, Code of Federal Regulations (10 CFR), Part 50 (Appendix B). 

Vendors are also required to comply with 10 CFR Part 21 (Part 21).

Appendix B

Appendix B requires that a quality assurance program be applied to all 

activities affecting structures, systems, and components of reactors that 

prevent or mitigate the consequences of postulated accidents that could 

cause undue risk to the health and safety of the public. The appendix 

establishes quality assurance requirements for the design, manufacture, 

construction, and operation of those structures, systems, and 

components. In particular, Appendix B requirements apply to all activities 

affecting the safety-related functions of those structures, systems, and 

components, which include the following: designing, purchasing, 

fabricating, handling, shipping, storing, cleaning, erecting, installing, 

inspecting, testing, operating, maintaining, repairing, refueling, and 

modifying. 

Vendors have a unique relationship with NRC through licensees given 

that, while the regulation requires licensees to establish and implement an 

Appendix B quality assurance program, it does not specifically require this 

of vendors. Vendors are nonetheless required to comply because this 

requirement is passed down from licensees to vendors through contracts. 
Audit of NRC’s Vendor Inspection Program

2

For some new reactor projects, the applicant or licensee oversees its 

engineering, procurement, and construction (EPC) contractor’s quality 

assurance program; the EPC oversees its vendors’ quality assurance 

programs; the vendors oversee their sub-vendors’ quality assurance 

programs; the sub-vendors oversee sub-sub-vendors’ quality assurance 

programs; and so on, as shown in Figure 1. Likewise, operating reactor 

licensees oversee the quality assurance programs of their vendors, and so 

on. Ultimately, the applicant or licensee must ensure that applicable 

regulatory requirements, which are necessary to assure adequate quality, 

are included in the documents for procurement of material, equipment, 

and services, whether purchased by the applicant, or licensee, or by its 

vendors or sub-vendors.

 Figure 1: Vendor Quality Assurance (QA) Oversight Process

Source: Office of the Inspector General (OIG) analysis and NRC documents.
Audit of NRC’s Vendor Inspection Program

3

Part 21

Part 21 establishes (1) procedures for reporting defects in safety-related 

components, and (2) a process for providing reasonable assurance that 

commercial off-the-shelf parts used in nuclear power plant safety-related 

applications will perform their intended safety function. Vendors are 

required to notify NRC of a defect in a basic component—also referred to 

as a “safety-related” component. 

Vendors and their customers often acquire parts from commercial 

suppliers that do not produce parts specifically designed or manufactured 

for a nuclear safety-related application. These parts are called 

commercial-grade items. If a customer decides to purchase commercialgrade items, Part 21 requires the customer receiving the items to use a 

commercial-grade dedication process to provide reasonable assurance

that these items destined for use in nuclear power plants will perform their 

intended safety function. Commercial-grade dedication is an acceptance 

process, performed under an Appendix B quality assurance program. The 

outcome of this process is a commercial part deemed equivalent to an 

item designed and manufactured under an Appendix B quality assurance 

program. 

NRC’s Vendor Inspection Programs

NRC conducts reactive and routine inspections of vendors’ 

implementation of Appendix B and Part 21 requirements. Typically, 

reactive inspections are performed by NRC’s Office of Nuclear Reactor 

Regulation (NRR), and routine inspections are performed by NRC’s Office 

of New Reactors (NRO). 

NRR inspections are generally focused on vendors supplying to the 

current fleet of nuclear reactors operating in the United States. The source 

of these reactive inspections stems from parts failures, allegations, and 

observed performance problems of a particular vendor, among other 

things. During fiscal year (FY) 2009 and the first half of FY 2010, NRR 

devoted 2.1 full-time equivalent staff to vendor inspection and related 

activities. During the period January 2009 through March 2010, NRR 

performed five of these reactive inspections, which resulted in findings that 

the vendor was not in compliance with one or more aspects of Part 21 or 

Appendix B.
Audit of NRC’s Vendor Inspection Program

4

In 2007, NRC established a routine inspection program in NRO. Like the 

NRR inspection program, the NRO inspection program inspects vendors’ 

implementation of Appendix B and Part 21 and is focused on vendors who 

currently supply, or plan to supply, to the new generation of power 

reactors being developed in the United States. During FY 2009 and the 

first half of FY 2010, NRO devoted 23.8 full-time equivalent staff to vendor 

inspections, inspection program development, vendor outreach, and other 

related activities. During the period January 2009 through March 2010, 

NRO performed 16 of these routine inspections, which resulted in findings 

that the vendor was not in compliance with one or more aspects of Part 21 

or Appendix B.

Global Market for Nuclear Parts

Vendors providing safety-related parts and services for the nuclear 

industry have become increasingly global over the last few decades. For 

example, NRC regulations require parts of the reactor coolant pressure 

boundary1to be manufactured according to the ASME Boiler and 

Pressure Vessel Code. The code requires those vendors manufacturing 

reactor coolant pressure boundary parts to have an ASME nuclear, or “Ntype,” certificate. According to OIG analysis of industry documents, the 

number of U.S. vendors maintaining an ASME N-type certificate 

decreased to roughly 125 in 2009 from about 500 in 1980. The number of 

international ASME N-type certificates has fluctuated between about 80 

and 100 certificates. As of 2009, there were about 100 international firms 

with ASME N-type certificates.

 

1

The reactor coolant pressure boundary is a primary barrier that protects the public from exposure to 

radiation.
Audit of NRC’s Vendor Inspection Program

5

II. PURPOSE

The audit objective was to assess NRC’s regulatory approach for ensuring 

the integrity of domestic and foreign safety-related parts and services 

supplied to current or prospective nuclear power reactors. See the report 

Appendix for information on the audit scope and methodology.

III. FINDINGS

Beginning in 2007, the agency proactively enhanced its overall approach 

to vendor inspections and increased vendor outreach efforts. After the 

creation of NRO, two new branches were established to perform additional 

vendor inspections, including routine inspections. The staff:

Developed program documents and inspection procedures.

Increased NRC’s outreach related to new reactor vendor activities.

Established cooperative relationships with regulators from other 

countries.

Initiated actions to evaluate counterfeit, fraudulent, and 

substandard items efforts within the industry.

Held the first NRC vendor workshop.

However, OIG has identified opportunities to further improve the program 

at both the office and the agency level. 

At the office level:

Improvements to NRO’s vendor inspection planning would enhance 

the process NRC uses to identify and select vendors for routine 

inspections. 
Audit of NRC’s Vendor Inspection Program

6

At the agency level:

The extent of regulations and guidance applicable to vendors is not 

readily apparent, and NRC has an opportunity to more effectively 

communicate its regulatory expectations and requirements to vendors. 

NRC could clarify its expectations and requirements for Part 21 and 

commercial-grade dedication.

NRC could clarify its expectations for approving certain accredited 

calibration laboratories.2 

NRC’s approach to monitoring and evaluating counterfeit, fraudulent, 

and substandard items in the nuclear supply chain could be 

strengthened.

 

2 Calibration laboratories calibrate measuring and test equipment used by vendors to evaluate the 

properties of materials and parts.
Audit of NRC’s Vendor Inspection Program

7

A. Enhanced Planning Would Improve Vendor Identification and 

Selection 

Improvements to NRO’s Vendor Inspection Program planning approach 

would enhance the process for identifying and selecting vendors for 

inspections. Currently, NRO’s vendor identification and selection planning 

process is largely informal, and faces challenges in accurately identifying

the number of vendors supplying to the nuclear industry and in selecting

vendors for inspection. This is because NRO does not have a 

management framework that includes a formalized, documented approach 

for identifying and selecting vendors for inspection. Consequently, NRO’s 

implementation of the Vendor Inspection Program, including resource 

planning and knowledge management efforts, may be hindered. 

Furthermore, NRO’s current, less formal approach to planning could miss 

vendors that should be identified for potential vendor inspections. 

Importance of a Formal Approach to Planning 

Government, industry, and academic studies have all emphasized the 

importance of a formal approach to planning. Implementing large-scale 

change management initiatives, such as mergers and organizational 

transformations, are not simple endeavors and require the concentrated 

efforts of both leadership and employees. As shown in Table 1,

commonly accepted, formal approaches to planning include establishing 

an overall strategy and goals, establishing methodologies for setting 

priorities, identifying performance metrics, and managing resources. 
Audit of NRC’s Vendor Inspection Program

8

Table 1: Key Elements of Program Planning

Overall Strategy and Goals

Establishing a strategic framework and goals for an organization is integral to 

effective management and planning. Agency management is responsible for 

developing the detailed policies, procedures, and practices to fit their agency’s 

operations and to ensure that they are built into and are an integral part of 

operations.

Methodologies for Setting Priorities

Establishing action-oriented implementation goals and a timeline with milestones 

to track the organization’s progress towards its goals is essential. By 

demonstrating progress towards these goals, the organization builds momentum 

and demonstrates that real progress is being made. In addition, having 

implementation goals and milestone dates helps pinpoint performance shortfalls 

and gaps and suggests midcourse corrections, including any needed 

adjustments to the organization’s future goals and milestones.

Identifying Performance Metrics

Specific metrics to monitor, evaluate, and report on results allows for a feedback 

process to clearly identify areas for improvement. Failure to establish metrics to 

evaluate success and failure will result in an organization unable to clearly 

evaluate mission accomplishment. Furthermore, such organizations will not 

know which activities are succeeding or failing.

Managing Resources and Change

Effective agencies are also characterized by having a senior manager who has 

ultimate authority for, and budgetary control over, program implementation. For 

example, International Atomic Energy Agency (IAEA) guidance for managing 

program changes in nuclear utilities includes identification of a project leader and 

an outline of the costs, benefits, and risks involved. For significant changes, 

executive oversight bodies are often used to establish priorities, monitor 

progress, and remove barriers to change.

Source: OIG analysis based on Government Accountability Office, IAEA, and academic 

documents.

Planning at the program level is also important to improve successful 

implementation and outcomes. NRO has recognized the importance of 
Audit of NRC’s Vendor Inspection Program

9

program-level planning for two emerging challenges, the Advanced Power 

Reactor Program and NRO’s Pandemic Response, when it produced 

formal planning documents for these programs. These planning 

documents do not necessarily contain all of the key elements of program 

planning, as described above. However, each of these planning 

documents is adapted to the needs of the programs at their current stages 

of development. For example, the Advanced Power Reactor Program 

plan is currently focused on identifying the resource needs to stand up the 

program, whereas the NRO Pandemic Response plan provides officespecific, detailed guidance to be used in conjunction with NRC’s

Pandemic Plan.

NRO Vendor Identification and Selection Planning Process Is Largely 

Informal 

NRO’s planning process for identifying and selecting vendors for routine 

inspections, and its strategy for guiding the process, is largely an informal 

one. Simply identifying the number of vendors is challenging, and NRO 

does not know how many vendors there are or how to identify changes in 

the vendor universe. Furthermore, NRO’s planning for selecting vendors 

for inspection is based on an informal approach that relies primarily on 

professional judgment. Moreover, NRO’s overall strategic approach to 

vendor identification and selection planning is informal as indicated by 

NRO staff, who have varying views of the purposes of the Vendor 

Inspection Program and routine vendor inspections.

Vendor Identification Presents Challenges

Identifying the vendors who supply to U.S. nuclear licensees is 

challenging. While vendors have to meet NRC regulations for providing 

quality products to the nuclear industry, vendors do not have to register 

with or seek licensing approval from NRC. Consequently, NRO staff 

members do not know how many vendors there are for the purpose of 

selecting vendors for inspection and assessing current resource needs. 

When asked how many vendors supplied safety-related items to the 

nuclear industry, NRO managers and staff members opined a wide 

numerical range of vendors, from 300 or 400 to “thousands.” Lacking any 

formal method for acquiring this information, vendor inspection staff 

members attempt to gauge the number of vendors by consulting various 
Audit of NRC’s Vendor Inspection Program

10

industry vendor lists, attending industry meetings, and reviewing 

licensees’ vendor lists, when such lists are available. Nonetheless, none 

of these sources are comprehensive, which helps to explain why staff 

members have such wide-ranging perceptions for the number of vendors. 

Such differences of opinion about the number of vendors across the 

spectrum of staff members complicates vendor selection and resource 

planning. 

Vendor Selection Approach Relies on Professional Judgment

NRO’s planning for selecting vendors for inspection is based on an 

informal approach that relies primarily on professional judgment. 

Typically, this professional judgment is exercised during brainstorming at 

group meetings and when individual vendor inspection staff members are 

solicited for suggestions based on their own experiences or knowledge. 

For example, one manager told OIG that people sitting down and 

discussing whom to inspect is the best method and that other approaches 

would be “unmanageable.” Some NRO managers maintained that they

conduct only 10 to 15 inspections per year and that, given the small 

number of inspections, there is no need for a more formal approach to 

selecting vendors for inspection. However, other NRO managers agreed,

given the small number of inspections, that is all the more reason to have 

a more methodical vendor selection process.

A more formal, risk-based vendor selection methodology is available to 

agency vendor inspectors, yet most NRO inspection staff members did not 

appear to be aware of this methodology. In 2004, vendor inspection staff 

members in NRR developed a methodology for identifying and prioritizing 

key characteristics that would allow for a more rigorous selection of 

vendors for inspection by NRC. The methodology was derived from a 

risk-based model developed by the Federal Aviation Administration (FAA). 

The model included procedures for identifying and categorizing levels of 

risk, such as a given vendor’s performance history, whether it was foreignbased or domestic, as well as the complexity of components being 

manufactured and whether the components would be used in safetyrelated systems. While this modified FAA methodology was never 

formally validated by NRR, some NRR staff have used it informally; 

however, NRO management and staff members were not using—or even 

familiar with—this risk-based tool for vendor selection.
Audit of NRC’s Vendor Inspection Program

11

A senior NRO inspector pointed to the vendor selection criteria in 

Inspection Manual Chapter (IMC) 2507, Construction Inspection Program: 

Vendor Inspections, as criteria by which NRO can identify vendors for 

inspection (see Figure 2). However, the broad-based criteria in IMC 2507 

are not formally tied to a methodology that links the inspection staff 

members’ variously-stated purposes of an inspection with the known 

vendor universe. 

Figure 2: Broad Vendor Selection Criteria Excerpted from IMC 2507

Source: NRC Web site.

NRO Staff Have Varying Views of the Purposes of the Vendor Inspection 

Program

NRO’s overall strategic approach to vendor identification and selection 

planning is informal, as indicated by NRO staff who have varying views of 

the purposes of the Vendor Inspection Program and routine vendor 

inspections. For example, one senior NRO manager told OIG that 

conducting routine inspections was “a required duty” that “provided value 
Audit of NRC’s Vendor Inspection Program

12

added,” while another senior NRO manager said that the main intent of 

the program was to ensure quality by “maintaining a global presence.” Yet 

another staff member said that the program was intended to “maintain 

adequate oversight” of vendors. In no instance did NRO Vendor 

Inspection Program management or staff point to a commonly understood 

purpose of the program and the routine inspections that NRO conducts.

NRO’s Vendor Inspection Program Lacks a Formalized, Documented 

Planning Approach

On the whole, the NRO Vendor Inspection Program conducts its activities 

without the benefit of a management framework that includes a 

formalized, documented planning approach. That is, NRO has not 

developed planning and guidance documents for the purpose of:

Articulating the goals and objectives of the program and establishing 

metrics to guide progress towards the overall program goals.

Identifying vendors with Appendix B quality assurance programs that 

supply safety-related parts and services to the nuclear industry.

Setting risk-informed priorities for which vendors to inspect. 

Program planning begins with identifying goals and objectives for the 

program. NRO management maintains that the vendor inspection 

planning approach is based on management’s overall vision, and the 

program as it currently exists is the realization of that vision. However, 

management acknowledged that this vision was not formal in the sense 

that it was not documented. In addition, NRO management has not 

articulated clear goals and objectives for the purpose of conducting routine 

vendor inspections. 

NRO does not have formal metrics and measures in place to guide the 

Vendor Inspection Program towards achieving its overall strategy and 

goals, identifying environmental changes, and determining resource 

needs. NRO management stated that they measure program results 

based on inputs received from the reactive inspection program in NRR, as 

well as the improved performance of some of the vendors. Given a 

vendor universe that ranges from a couple hundred to possibly thousands 

of vendors, it is unlikely that the 13 to 17 vendors that NRO inspects per 
Audit of NRC’s Vendor Inspection Program

13

year is representative of overall vendor performance. This is especially so 

given the lack of any formal methodology for identifying and selecting 

vendors for inspection. 

Program Resource Planning and Knowledge Management at Risk 

Without clearly articulated goals and objectives for the program; a 

formalized, risk-informed documented approach to planning vendor 

identification and selection for inspection; or metrics for evaluating 

program performance, NRO’s implementation of the Vendor Inspection 

Program, including resource planning and knowledge management 

efforts, may be hindered. This is especially true given changes in the new 

licensing environment. NRC is currently reviewing 18 combined operating 

license applications for a potential 27 new reactors. But this number is 

likely to change in the future, as is the number of potential domestic and 

international vendors supplying new construction efforts. NRO’s current, 

less formal approach to planning could be missing vendors that should be 

identified for potential vendor inspections and may also result in 

expending resources to conduct information-gathering inspections of 

vendors rather than focus specifically on verifying the vendor’s compliance 

with the regulations. For example, OIG observed one inspection where 

the vendor’s organization, relationship to the licensee, and scope of work 

were not known. Consequently, the inspection team was faced with 

justifying the inspection on the basis of what they learned about that 

vendor’s ongoing activities, rather than from specific criteria provided 

through a documented planning approach. 

Additionally, NRO’s informal, undocumented approach to identifying 

vendors for inspection could affect knowledge transfer efforts from more 

experienced inspectors to newer, less experienced staff members. 

Currently, Vendor Inspection Program management relies largely on a 

process whereby the vendor identification and selection process is 

communicated verbally from managers to staff members. However, 

transfers, promotions, and retirements have reduced the number of 

vendor inspection staff members who are qualified to lead inspections. 

Newer staff members, therefore, are coming to the Vendor Inspection 

Program without the same level of institutional knowledge as their 

predecessors. Given some of the ongoing personnel changes within 

NRO, a senior manager was unaware if existing NRO guidance was 

sufficient for newer, less experienced inspectors.
Audit of NRC’s Vendor Inspection Program

14

Resource planning in NRO is also at risk. Without a formalized, 

documented approach to identifying vendors for inspection, NRO is left to 

estimate the size of both the domestic and foreign vendor universe, the 

purpose and number of desired inspections, and the resulting resource 

requirements to perform those inspections. For example, in a December 

2009 memorandum to the Commission, NRO asserted that “the 

appropriate number of inspections to be conducted annually will always be 

a matter of judgment.” In any case, agency managers stated that “NRC is 

in a flat budget world” and the constrained budget has been the primary 

determinant in how many vendors can be inspected. Such a resourceconstrained environment makes formal, documented planning even more 

important in the effort to identify vendors for potential inspection. 

Recommendations

OIG recommends that the Executive Director for Operations:

1. Develop an NRO Vendor Inspection Program planning document that: 

a. Articulates a clear purpose for the Vendor Inspection Program.

b. Establishes metrics to evaluate the success of the Vendor 

Inspection Program.

2. Develop and document a methodology to identify vendors that supply 

safety-related parts and services to the nuclear industry with Appendix 

B quality assurance programs.

3. Develop and document a risk-informed methodology to select vendors 

for inspection. 
Audit of NRC’s Vendor Inspection Program

15

B. Opportunity To More Effectively Communicate Requirements 

NRC relies on nuclear vendors’ understanding and implementation of its 

regulations to assure that safety-related components will perform 

adequately in service, and that defects are reported. In order for vendors 

supplying nuclear components and services to be knowledgeable of their 

obligations under the regulations, NRC must effectively communicate the 

regulations. NRC has undertaken a number of efforts to communicate 

regulations to vendors, but some vendors are not aware of all obligations 

or NRC expectations. NRC’s approach to communicating with vendors is 

not as effective as it could be because it does not have an outreach/

communications plan. When vendors are not knowledgeable of their 

obligations under NRC regulations, vendors might not report defects or 

otherwise fully assure that safety-related components will perform 

adequately in service.

Vendors’ Role in the Oversight of Quality Requires Adequate 

Awareness of Requirements 

The two primary NRC regulations regarding vendor quality assurance 

oversight are Appendix B and Part 21. Appendix B enumerates quality 

assurance criteria for components and services used in nuclear power 

plants. Part 21 establishes (1) procedures for reporting defects in safetyrelated components, and (2) a process for providing reasonable 

assurance that commercial parts used in nuclear power plants in safety 

related applications will perform their intended safety function.

NRC relies on vendors’ awareness and implementation of Appendix B and 

Part 21 requirements to assure that safety-related systems will perform 

adequately in service, and that defects are reported. NRC also 

recognizes the importance of effectively communicating these regulations 

to vendors supplying safety-related nuclear components and has therefore 

engaged in a number of efforts to make vendors aware of their obligations. 

In fact, NRC recognizes this as so important, it attempts to make both 

vendors and licensees aware of the particular role vendors play in 

overseeing vendor and sub-vendor activities related to the design, 

manufacture, construction, and operation of safety-related systems and 

components. 
Audit of NRC’s Vendor Inspection Program

16

NRC leadership and vendor inspection staff members have stressed the 

importance of vendors being aware of and understanding their obligations 

under NRC regulations. For example, while speaking at an American 

Nuclear Society conference, NRC’s then-Chairman urged licensees, 

consultants, and vendors to be prepared to face the challenge of 

overseeing the quality and authenticity of globally manufactured 

components. In addition, NRC vendor inspection staff members have 

emphasized vendor awareness of NRC regulations and have stressed this 

to vendors and licensees at various nuclear industry conferences and 

during vendor inspections. 

In addition to relying on vendors’ awareness and implementation of the 

regulations, NRC vendor inspection staff members expect licensees to 

inform their vendors of NRC regulations and pass along other information 

that could potentially increase vendor knowledge and understanding of 

vendor obligations under NRC regulations. For example, a vendor 

inspection staff member told OIG auditors that “since licensees approve 

vendor programs and buy components from vendors, licensees make sure 

vendors receive the information.”

NRC’s Communication Approach 

NRC has reached out to vendors to inform them of their regulatory 

obligations and NRC expectations, yet the agency’s approach to 

communicating with vendors is not as effective as it could be. For each of 

NRC’s primary methods of communicating with vendors—presentations, 

two vendor workshops, generic communications, the NRC Web site—OIG 

auditors obtained direct feedback from some vendors that indicated 

problems with being aware of or receiving information from the agency. 

Furthermore, NRC staff members are unsure of the effectiveness of the 

agency’s outreach and communications activities. 

Presentations

NRC vendor inspection staff members have given 38 presentations at no 

fewer than 21 nuclear industry-led meetings over the last 5 years. These 

presentations generally covered reporting of defects and noncompliance; 

quality assurance processes; commercial-grade dedication; preventing the 

entrance of counterfeit, fraudulent, and substandard items into the nuclear 
Audit of NRC’s Vendor Inspection Program

17

supply chain; and NRC vendor inspection activities. These presentations 

were directed at vendors and licensees at various nuclear industry-related 

conferences and meetings. 

When asked about the effectiveness of the presentations at industry-led 

meetings, NRC staff members could not point to any formal vendor 

feedback or agency analysis of effectiveness. Rather, NRC’s vendor 

inspection staff members have simply asserted they believe these 

presentations are effective. For example, a senior member of the vendor 

inspection staff contended that they know presentations at conferences 

are effective because inspection staff members will inspect a vendor they 

have not inspected in nearly 2 decades and not find “15,000 problems.” 

Another senior member of the vendor inspection staff said they know 

vendors are aware of their obligations merely because the regulations are 

public. However, it is difficult to claim that presentations are effective 

given that all vendors do not attend industry meetings, NRC does not 

generally know which vendors have attended all meetings, and NRC has 

not limited inspections to vendors who have attended industry meetings. 

OIG sought feedback from vendors about the effectiveness of NRC 

presentations as a method of obtaining knowledge about the regulations, 

and noted a variety of vendor concerns. For example, one recently 

inspected small vendor supplying safety-related nuclear components 

contended it is not always able to attend these meetings given scheduling 

or cost constraints. Additionally, some vendors are not aware of NRC 

presentations at meetings and, in any case, do not always have access to 

all industry-related meetings. For example, while the Electric Power 

Research Institute (EPRI)3and the Nuclear Procurement Issues 

Committee (NUPIC)4periodically host conferences, vendors generally are 

not invited to all meetings and sometimes do not have access to industrygenerated guidance related to implementing NRC regulations. 

Additionally, some vendors are located outside the United States and do 

not always hear of these events; others, who are aware, told OIG auditors 

they are not always able to attend given the travel costs. 

 

3

EPRI is an independent, non-profit company performing research, development, and demonstration in 

the electricity sector for the benefit of the public.

4 NUPIC is an organization of nuclear power utilities in the United States and overseas. On behalf of its 

members, NUPIC evaluates suppliers that have five or more NUPIC members as customers through jointutility Appendix B audits.
Audit of NRC’s Vendor Inspection Program

18

2008 Vendor Workshop

NRC hosted a Vendor Workshop in 2008, with the purpose to:

1) Facilitate discussions on reactor construction issues.

2) Provide the opportunity for vendors to understand regulations.

3) Show how NRC evaluates vendors’ implementation of NRC 

regulations. 

The main session of the workshop was devoted to providing NRC and the 

nuclear industry some perspectives on implementing NRC regulations and 

related vendor issues (see Figure 3).

Figure 3: Presentations Covered at NRC’s 2008 Vendor Workshop

Source: NRC Web site.
Audit of NRC’s Vendor Inspection Program

19

NRC attempted to notify vendors of the workshop in several ways. 

Vendor inspection staff members personally contacted some vendors. 

The agency also issued a press release and posted a notification of the 

workshop on its Web site. Additionally, NRC notified vendors of the 

workshop by requesting industry associations—such as NUPIC and the 

Nuclear Energy Institute—to pass the notice to vendors. 

In fact, NRC relies on industry associations and licensees to pass 

information to vendors, but NRC is not able to verify whether this 

information is received by vendors. For example, a vendor who recently 

entered the nuclear industry indicated it was not aware of the 2008 vendor 

workshop. Another vendor told OIG auditors it would not have been 

aware of the workshop had it not recently interacted with NRC in an earlier 

inspection, despite the fact that it supplied to numerous licensees. A 

representative from a licensee and another from a vendor also told OIG 

auditors they do not always pass NRC information to their vendors or subvendors. 

Although NRC solicited feedback from attendees, the effectiveness of 

NRC’s efforts to notify the vendor universe about the workshop is largely 

unknown. NRC senior vendor inspection staff members conceded not all 

vendors were made aware of the 2008 workshop and NRC staff members 

are not sure how many vendors were actually notified. One NRO 

manager expressed surprise that so many vendors attended the 

workshop. OIG has since determined that at least 186 different vendors 

and utilities were represented at the 2008 workshop, which is likely a 

fraction of the vendors providing components and services to the nuclear 

industry under NRC regulations. 

Generic Communications 

NRC issued several generic communications to licensees regarding 

vendor-related quality assurance issues.5 Moreover, in 2007, NRC issued 

Information Notice 2007-40 directly to vendors who supply safety-related 

components to facilities licensed by NRC, as seen in Figure 4. 

 

5 NRC strives to maintain an effective generic communications program for the purpose of communicating 

with the nuclear industry on generic issues. Generic communications are issued to inform the nuclear 

industry of issues related to safety, security, safeguards, and environmental significance. 
Audit of NRC’s Vendor Inspection Program

20

Figure 4: Addressees and Purpose Excerpted from Information Notice 2007-40 

Source: NRC Web site.

The purpose of this information notice was to inform vendors of NRC 

findings of inadequate implementation of regulatory requirements. The 

information notice was sent to vendors on an NRC e-mail listserv and to 

other vendors listed on an industry association vendor list. Similar to 

outreach for the vendor workshop, while NRC vendor inspection staff 

members recognized the importance of making vendors aware of their 

obligations under the regulations, NRC relied on industry associations and 

licensees to pass this information to vendors, and cannot verify whether 

vendors received the information notice.6 

Several vendors and workshop attendees indicated they were either not 

aware or did not understand the purpose of NRC generic communications. 

OIG auditors reviewed questions submitted at the 2008 vendor workshop, 

 

6 While NRC internal procedures do not require staff to track receipt of information notices, NRC relies on 

licensees and vendors to pass this and similar information to their suppliers. 
Audit of NRC’s Vendor Inspection Program

21

interviewed vendors at nuclear industry meetings, and observed NRC 

inspections of vendors. Licensee and vendor representatives told OIG 

auditors that NRC efforts are mostly targeted at large vendors, and new 

vendors do not know how to obtain information on compliance. One 

licensee representative also remarked that vendors who do not have an 

ongoing relationship with a licensee have difficulty obtaining vendorrelated information.

NRC Web Site

NRC vendor inspection staff members often direct vendors and licensees 

to the NRC Web site to obtain information on vendors’ obligations under 

NRC regulations, but some vendors have trouble navigating the NRC Web 

site. To begin with, it is not clear from the NRC home page where a 

vendor unfamiliar with NRC or the Web site should begin. Vendors and an 

industry consultant told OIG auditors that while NRC posts valuable 

information on its Web site, many stakeholders are unaware of vendorspecific information on the Web site while others have difficulty navigating 

the site. For example, a vendor currently supplying components for the 

nuclear industry told OIG auditors that the NRC Web site is “tedious” and 

“not user friendly.” This vendor also complained that while it conducts 

weekly searches for vendor-specific material, most of the search results 

point the vendor to unrelated information. Additionally, a small vendor 

new to the industry told OIG auditors it had difficulty navigating the NRC 

Web site and was unsure it was getting the most up-to-date information or 

recent Web pages. Moreover, an industry consultant told OIG auditors 

many vendors fear they might be in violation of NRC regulations because 

they are unable to distinguish old information from recent changes and 

updates on the NRC Web site. 

NRC Would Benefit from a Formal, Documented Plan 

NRC does not currently have—and would benefit from—a formal, 

documented outreach/communications plan for vendor-related activities. 

A formal plan would include a means for identifying the target audience 

and the specific messages to be communicated to vendors, measurable 

objectives, an implementation strategy, a means to weigh the efficiency 

and effectiveness of various outreach and communications methods, and 

a means to obtain feedback. 
Audit of NRC’s Vendor Inspection Program

22

Decreased Vendor Ability To Assure Quality of Components and 

Services 

When vendors are not aware of the regulations, they might not report 

defects or otherwise fully assure that safety-related components will 

perform adequately in service. Throughout OIG’s audit, vendors, 

licensees, industry consultants, and NRC staff members expressed 

concerns about the nuclear industry’s awareness of NRC regulations and 

changes in regulation, guidance from NRC, and industry-generated 

information related to assuring that safety-related components perform 

adequately in service and that defects are reported. For example, during 

a recent nuclear industry procurement meeting, representatives from 

several licensees and vendors discussed the challenges of assuring that 

new, current, and foreign vendors are aware of their obligations under 

NRC regulations. 

Because NRC does not have an outreach/communications plan for 

vendor-related activities, it cannot fully identify and reach its target 

audience, or effectively plan presentations in light of varying vendor 

sophistication or ability to understand information. A documented plan 

would help NRC evaluate whether outreach activities effectively 

communicate intended messages, and build upon previous outreach 

activities by integrating feedback from vendors into an overall outreach 

strategy. 

Recommendation

OIG recommends that the Executive Director for Operations:

4. Develop and use a vendor outreach/communications plan. 
Audit of NRC’s Vendor Inspection Program

23

C. Commercial-Grade Dedication and Part 21 Regulations and Guidance 

Could Be Clarified

Even when vendors are aware of the applicable NRC regulations and 

other regulatory information, NRC could clarify its expectations and 

requirements for Part 21 and commercial-grade dedication.

7 NRC 

presumes that adherence to its regulatory requirements on the part of 

licensees and vendors assures safety. However, nuclear vendors are 

confused about how to adequately implement Part 21 and commercialgrade dedication due to unclear or insufficient guidance and guidance that 

conflicts with regulation. Consequently, vendors might fail to implement 

various aspects of their programs in accordance with NRC’s regulations, 

guidance, or expectations. Ultimately, this could lead to vendors (1) 

supplying parts and services to nuclear power plants that do not meet 

NRC regulatory requirements or quality assurance expectations, and (2) 

inadequately reporting defects. 

NRC Regulatory Requirements and Expectations for Nuclear 

Vendors 

According to agency management, NRC presumes safety based on 

regulatory compliance. That is, NRC presumes that adherence to its 

regulatory requirements on the part of licensees and vendors assures (1) 

the quality of safety-related parts and services, (2) that safety-related 

components will perform adequately in service, and (3) that defects will be 

properly reported. The primary regulations applicable to nuclear vendors 

are Appendix B and Part 21. NRC regulatory requirements and guidance 

applicable to vendors covers such topics as the nuclear procurement 

process, including the use of commercial off-the-shelf parts and services,

and the reporting of defects. 

The Nuclear Procurement Process

The regulation of vendors is, in part, based on the nuclear procurement 

process, which is intended to assure that plants obtain quality products 

and services. Vendors that supply safety-related equipment or services to 

the nuclear industry must meet NRC’s quality assurance requirements, as 

 

7

If a customer decides to purchase commercial-grade items, Part 21 requires the customer receiving the 

items to use a commercial-grade dedication process to provide reasonable assurance that these items 

destined for use in nuclear power plants will perform their intended safety function.
Audit of NRC’s Vendor Inspection Program

24

promulgated in Appendix B.8 Therefore, nuclear power plant safetyrelated structures, systems, and components must be designed and 

manufactured under an Appendix B quality assurance program. 

Under NRC regulations, safety-related parts and services can only be 

procured in two ways, as shown in Figure 5. The purchaser of safetyrelated parts or services implementing an Appendix B quality assurance 

program can procure parts and services from a vendor that has been 

approved by the purchaser through an audit of that vendor’s Appendix B 

quality assurance program. Alternatively, the purchaser, through its 

Appendix B quality assurance program, may opt to dedicate commercialgrade items provided by commercial firms using a process described in 

Part 21.

 

8

Appendix B requires that a quality assurance program be applied to all activities affecting structures, 

systems, and components of reactors that prevent or mitigate the consequences of postulated accidents 

that could cause undue risk to the health and safety of the public. The appendix establishes quality 

assurance requirements for the design, manufacture, construction, and operation of those structures, 

systems, and components. 
Audit of NRC’s Vendor Inspection Program

25

Figure 5: The Nuclear Procurement Process

Source: OIG analysis and NRC documents.

Commercial-Grade Dedication

Commercial-grade dedication is an acceptance process undertaken to 

provide reasonable assurance that a commercial-grade item9to be used 

as a basic component10 will perform its intended safety function. In this 

respect, the commercial-grade item is deemed equivalent to an item 

custom designed and manufactured under an Appendix B quality 

 

9

A commercial-grade item is a structure, system, or component that was not designed and manufactured 

as a basic component.

10 A basic component is a structure, system, or component that assures the integrity of the reactor coolant 

pressure boundary; the capability to shut down the reactor and maintain it in a safe shutdown condition; 

or the capability to prevent or mitigate the consequences of accidents. It is, essentially, a safety-related 

component.
Audit of NRC’s Vendor Inspection Program

26

assurance program. NRC regulations require commercial-grade 

dedication to be performed under an Appendix B quality assurance 

program.

Commercial-grade dedication is defined in Part 21. That regulation 

defines a process to provide reasonable assurance that a commercialgrade item will perform its intended safety function. Specifically, Part 21 

states that this assurance is achieved by identifying the critical 

characteristics11 of the item and then verifying the item meets these critical 

characteristics through one or more of four acceptance methods.12 EPRI, 

a private industry group, developed guidance for licensees to use in 

utilizing commercial-grade items. In Generic Letter 89-02, NRC 

conditionally endorsed EPRI’s guidance on commercial-grade dedication. 

Requirements for Reporting Defects and Posting

Nuclear licensees and vendors are required to report to NRC when a 

nuclear power plant safety-related component contains a defect that could 

create a “substantial safety hazard,”13 and the documents relating to this 

reporting requirement are to be posted on the vendor’s premises. NRC 

promulgated defect reporting requirements through Part 21. Part 21 

established a process by which licensees and vendors must evaluate 

“deviations”14 to determine whether they could cause a substantial safety 

hazard. A deviation that could cause a substantial safety hazard is a 

“defect.” Licensees and vendors must report defects to NRC. Part 21 

also prescribes that its requirements be prominently posted on the 

premises of any facility licensed or otherwise regulated in the United 

States under the Atomic Energy Act of 1954. 

 

11 Critical characteristics are those important design, material, and performance characteristics of a 

commercial-grade item that, once verified, will provide reasonable assurance that the item will perform its 

intended safety function.

12 Part 21 describes four methods for accepting commercial grade items: (1) inspections, tests, or 

analyses; (2) commercial grade surveys; (3) product inspections or witness at holdpoints at the 

manufacturer’s facility; and (4) analysis of historical records for acceptable performance.

13 A substantial safety hazard is a loss of safety function to the extent that there is a major reduction in the 

degree of protection provided to public health and safety for any facility or activity licensed or regulated by 

NRC.

14 A deviation is a departure from the technical requirements included in a procurement document.
Audit of NRC’s Vendor Inspection Program

27

Vendors Are Confused About Commercial-Grade Dedication and Part 

21 Regulatory Requirements 

Vendors are confused about and are having difficulty implementing NRC 

regulations and guidance on (1) commercial-grade dedication acceptance 

methods and sampling, (2) Part 21 reporting requirements, and (3) Part 21 

posting requirements. 

Confusion Over Commercial-Grade Dedication Acceptance Methods and 

Sampling

Vendors are confused about NRC’s commercial-grade dedication 

expectations and requirements. NRC vendor inspections indicate that 

implementation of commercial-grade dedication programs is a problem for 

vendors. From January 2006 through March 2010, 18 vendors were

found to have deficient commercial-grade dedication programs. During an 

inspection, one vendor quality assurance manager referring to 

commercial-grade dedication said that he had “been doing this for 3 or 4 

decades and [was] just now figuring out how it is supposed to work.” 

Vendors are specifically confused about which one, if any, of the four 

acceptance methods is specifically required for accepting an item from a 

commercial supplier. Several questions submitted by vendors to NRC

during the 2008 NRC vendor workshop expressed confusion about 

whether one of the acceptance methods was required to be conducted as 

required by Part 21. Additionally, a nuclear industry consultant who 

regularly interacts with nuclear vendors told the OIG that many vendors 

ask him about this issue. 

Vendors are also confused about how to conduct sampling of identical 

commercial items during the commercial-grade dedication process. 

Vendors dedicating identical items might need to destroy some of the 

items during testing to determine if all the items are acceptable. Because 

the items are destroyed, a sample must be selected, and an adequate 

basis for the sample must be documented. OIG witnessed one vendor’s 

staff struggle to explain its justification in a sampling plan that called for 

sampling only one item per lot. Additionally, several of the questions 

submitted to NRC during the December 2008 NRC vendor workshop, 

which included presentations on commercial grade dedication and 
Audit of NRC’s Vendor Inspection Program

28

sampling, indicated that vendors were confused about how to conduct 

sampling during commercial-grade dedication.

Confusion About How To Adequately Implement Part 21 Reporting 

Requirements

Another regulatory area that is confusing to vendors is how to adequately 

implement a Part 21 program. Part 21 requires vendors to evaluate 

deviations that could cause a substantial safety hazard or inform their 

customers if they are unable to perform the evaluation. If a deviation 

could cause a substantial safety hazard, it is considered a defect, and 

licensees and vendors must report defects to NRC. Of the 57 vendor 

inspection reports issued January 2006 through March 2010, 32 included 

one or more notices of violation against Part 21, indicating that the nuclear 

vendors’ Part 21 programs had one or more deficiencies. 

OIG observed firsthand how Part 21 is confusing to vendors. During four 

of eight vendor inspections that OIG observed,15 NRC identified 

inadequacies with the vendors’ Part 21 implementation procedures. One 

vendor quality assurance manager told the OIG that he gets “mixed 

signals” on Part 21. For example, with regard to Part 21 reporting, the 

quality assurance manager said it is hard to understand when to submit a 

Part 21 report. This manager explained that his company was criticized 

during an Appendix B audit by the customer for making a Part 21 report 

when it should not have, and then for not making a report when it should 

have.

Difficulty Implementing Part 21 Posting Requirements

Additionally, vendors are having difficulty complying with Part 21 posting 

requirements. Vendors must post a current copy of Part 21, Section 206 

of the Energy Reorganization Act, and the vendor’s procedures (or 

information that explains how to obtain a copy of the procedures) adopted 

to implement the regulation in a conspicuous position on the vendor’s 

premises. At five of the six domestic16 vendor inspections that OIG 

observed, NRC reviewed the vendors’ compliance with Part 21 posting 

requirements. Of those five vendors, NRC found three of the vendors’ 

 

15 Of the eight inspections OIG observed, two were followups to previous inspections that had indentified 

inadequacies with the vendors’ implementation of Part 21.

16 Part 21 posting requirements apply only to facilities in the United States.
Audit of NRC’s Vendor Inspection Program

29

attempts to comply with the posting requirements were inadequate, but 

NRC did not issue violations for the non-compliant postings. For example, 

in one instance NRC found that the vendor’s Part 21 posting did not 

include the title of the vendor’s Part 21 procedure or information on where 

the procedure is located. NRC inspectors chose not to issue a violation 

for this omission.

Issues with Regulations and Guidance Cause Confusion 

Vendors are confused about commercial-grade dedication and Part 21 

regulatory obligations due to unclear or insufficient guidance and guidance

that conflicts with regulation. Specifically, (1) some of the industry 

guidance that NRC has conditionally endorsed for commercial-grade 

dedication acceptance methods conflicts with NRC regulations, (2) NRC 

has not approved any guidance for sampling for commercial-grade 

dedication, (3) NRC has not issued any guidance explaining a process 

that it considers compliant with Part 21, and (4) NRC’s Web site does not 

clearly reflect when the Part 21 regulation has changed.

Commercial-Grade Dedication Guidance Conflicts with Regulation

Vendors are confused about whether one of the four acceptance methods 

for commercial-grade dedication is required because industry guidance 

that was conditionally endorsed by NRC conflicts with NRC regulatory 

requirements. According to Part 21, dedication is conducted by identifying 

the critical characteristics of the item and verifying their acceptability by 

inspections, tests, or analyses performed by the purchaser after delivery, 

supplemented as necessary by one or more of the remaining acceptance 

methods. However, EPRI’s guidance—which was conditionally endorsed 

by NRC—indicates that the four acceptance methods, either individually or 

in combinations, is adequate. This conflicts with Part 21 because the first 

method (inspections, tests, or analyses) would always be performed 

according to Part 21, whereas EPRI’s guidance says any of the four

acceptance methods is suitable. 

NRC Does Not Have Guidance for Sampling in Commercial-Grade 

Dedication

Vendors are also confused about how to conduct sampling of identical 

commercial parts during the commercial-grade dedication process 
Audit of NRC’s Vendor Inspection Program

30

because NRC has not approved any guidance on sampling for 

commercial-grade dedication. In 1997, NRC issued draft guidance for 

sampling in commercial-grade dedication and, in 1999, EPRI issued its 

own guidance document. However, NRC has neither approved its draft 

guide, nor endorsed EPRI’s guidance. In the absence of approved 

regulatory or industry guidance, NRC staff point vendors to two inspection 

procedures (IP)—IP 38703 and IP 43004—for guidance on sampling. 

These inspection procedures are written as guidance for NRC inspection 

staff members assessing sampling in commercial-grade dedication. The 

procedures are not a model for licensees or vendors to use in 

implementing NRC regulatory requirements.

NRC Has Not Issued Guidance Explaining Part 21 Reporting 

Requirements

Vendors are confused about how to implement Part 21 reporting 

requirements because NRC has not issued regulatory guidance describing 

a process that it considers compliant with the regulation. Many 

stakeholders have pointed to Part 21 as being one of the most complex 

regulations NRC has ever issued. In light of this, regulatory guidance 

could help vendors understand a process that NRC considers compliant 

with the regulation. However, NRC has not issued any guidance to help 

vendors implement Part 21. Recognizing that this regulation is difficult to 

understand, NRC has proposed a comprehensive rulemaking to revise 

Part 21. The rulemaking may begin in FY 2012 and could take 3 or 4 

years to complete.

Part 21 Changes Are Not Clearly Indicated on the NRC Web Site

Vendors are having difficulty complying with Part 21 posting requirements

because the regulations on NRC’s Web site do not clearly reflect what or 

when changes have been made when regulations are revised, as shown 

in Figure 6. Compliance with the posting requirement necessitates that 

the vendor have the most up-to-date revision of Part 21. However, 

because vendors do not know where to go to get the most up-to-date 

version and they do not know when the regulation changed, vendors have

difficulty complying with this requirement. In one example, a vendor 

quality assurance manager explained that NRC previously issued his 

company a violation for an out-of-date Part 21 posting. He said that as a 

result of that inspection, he revised his procedure to check the regulations 
Audit of NRC’s Vendor Inspection Program

31

for changes every year. Even though a year had not yet elapsed since he 

last checked to see if the regulation had changed, he decided to check 

anyway, and in fact the regulation had changed. He said that if he had 

followed his firm’s procedure, his company would have again been in 

violation. 

Figure 6: NRC’s Title 10 Web Page

Source: NRC Web site.

Vendor Confusion Might Lead To Inadequate Implementation of 

Appendix B and Part 21 Requirements 

As a result of vendors’ confusion about NRC regulatory requirements and 

expectations, vendors may fail to implement various aspects of their 

Appendix B and Part 21 programs in accordance with NRC’s regulations, 
Audit of NRC’s Vendor Inspection Program

32

guidance, or expectations. Vendors might not implement commercialgrade dedication requirements—including acceptance methods and 

sampling—in the manner that NRC expects or in compliance with the 

regulation, which could lead to substandard safety-related parts being 

supplied to nuclear power plants. Additionally, vendors might not be 

properly implementing Part 21 evaluation, reporting, and posting 

requirements, which could lead to (1) defects not being properly reported 

and (2) vendors unknowingly violating Part 21 posting requirements. If 

defects go unreported, it is possible that substandard safety-related parts 

could be supplied to, or in service at, operating nuclear power plants. 

Recommendations

OIG recommends that the Executive Director for Operations:

5. Align NRC guidance and regulations to clarify acceptance methods for 

commercial-grade dedication.

6. Issue regulatory guidance to clarify sampling expectations for 

commercial-grade dedication.

7. Issue regulatory guidance describing a process that NRC considers 

acceptable for compliance with Part 21.

8. Clearly indicate via the NRC public Web site how and when Part 21 

has changed.
Audit of NRC’s Vendor Inspection Program

33

D. Calibration Laboratories Approval Guidance Could Be Clarified

NRC’s guidance for approving accredited commercial-grade calibration 

laboratories—which calibrate measuring and test equipment used by 

vendors to evaluate the properties of materials and parts—could be 

clarified. In response to a request from one of its licensees, NRC allowed 

a process permitting the licensee to approve calibration laboratories based 

on the reviews performed by accrediting bodies in lieu of an Appendix B 

audit or a commercial-grade survey. However, since NRC’s guidance 

documents describing this process are disparate, vendors are confused 

about, and have difficulty implementing, the process. Consequently, 

vendors’ approval of laboratories may not be in accordance with NRC’s 

expectations, vendors may find themselves unknowingly in violation of 

Appendix B or NRC commercial-grade dedication requirements, and 

vendors could find they have used out-of-calibration equipment during the 

manufacturing process.

Accredited Commercial-Grade Calibration Laboratories

Calibration laboratories calibrate measuring and test equipment used by 

vendors to evaluate the properties of materials and parts. Under 

Appendix B, licensees and vendors must adequately control measuring 

and test equipment used on safety-related parts. In many instances, 

vendors send measuring and test equipment to a calibration firm for 

necessary calibration and adjustment. Calibration of measuring and test 

equipment used by vendors manufacturing safety-related parts must be 

procured from an Appendix B firm approved by the purchaser, or the 

services must undergo the commercial-grade 

dedication process.

In 2004, one nuclear licensee proposed an 

alternative process to use calibration laboratories 

that had been accredited by two accreditation 

bodies—the American Association for Laboratory 

Accreditation (A2LA)17 and the National Voluntary Laboratory 

Accreditation Program (NVLAP)18—in lieu of an Appendix B audit or 

 

17 A2LA is a nonprofit, nongovernmental, public service, membership society that provides 

comprehensive services in laboratory accreditation and laboratory-related training.

18 NVLAP is run by the National Institute of Standards and Technology. NVLAP provides third-party 

accreditation to testing and calibration laboratories.
Audit of NRC’s Vendor Inspection Program

34

commercial-grade dedication. In 2005, NRC issued a Safety Evaluation 

Report for this licensee approving the alternative process; however, in that 

report, NRC included some additional steps the utility would have to take 

in order to use the accredited calibration laboratories. Subsequent to the 

issuance of the Safety Evaluation Report, NRC has issued several letters 

expanding this recognition to include additional accreditation bodies in the 

United States. Also, NRC issued a letter clarifying that vendors could use 

calibration laboratories accredited by the recognized accreditation bodies, 

provided that vendors adhered to the additional steps stipulated in the 

Safety Evaluation Report.

Approving Accredited Commercial-Grade Calibration Laboratories Is 

Confusing 

Vendors are confused about how to adequately implement the process in 

which NRC allows vendors to approve accredited calibration laboratories 

in the United States for safety-related services. For example, one vendor 

quality assurance manager explained that his company developed a 

procedure for selecting calibration suppliers based on accreditation by 

A2LA because “A2LA” was the latest “buzz word.” However, the vendor 

had not adhered to the additional steps stipulated by NRC. Furthermore, 

OIG observed the inspection of another vendor trying to implement this 

process, and NRC issued a nonconformance to this vendor for approving 

an accredited calibration firm without performing a supplier audit, even 

though an audit may not have been necessary according to NRC’s own 

guidance.

Calibration Laboratories Approval Process Guidance Is Disparate

NRC guidance explaining the process to approve accredited calibration 

laboratories is disparate. In addition to issuing the Safety Evaluation 

Report and several additional letters expanding NRC’s recognition to 

additional accrediting bodies, NRC, in June 2006, issued a letter to NUPIC

clarifying that vendors could utilize the services of the calibration 

laboratories accredited by the recognized accrediting bodies. NRC also 

described this process in the Standard Review Plan (NUREG-0800). NRC 

has posted most of these documents on the section of its Web site

devoted to calibration services, yet the letter specifically directed at 

vendors—the June 2006 letter to NUPIC—is not. Having that vendorspecific letter listed with all the other correspondence explaining this 
Audit of NRC’s Vendor Inspection Program

35

process would make it easier for vendors to understand that they may use 

this process to approve calibration laboratories accredited by the 

recognized accreditation bodies.

Furthermore, some of these NRC documents have different lists of steps 

that are required for implementing the process, making it difficult for 

vendors to know how to implement the process in the manner NRC 

expects. One NRO manager said that NRO and NRR staff members are 

reevaluating the NRC position on allowing licensees and vendors to 

approve accredited calibration laboratories. NRC staff are considering 

whether to expand this recognition to include international calibration 

laboratories as well as testing laboratories in the United States and 

overseas. One senior NRO staff person noted that accreditation bodies, 

such as A2LA, are better at reviewing calibration laboratories than 

licensees or vendors because the accreditation body staff are experts in 

calibration.

Vendor Confusion Might Lead To Inadequate Implementation of 

Appendix B and Part 21 Requirements 

As a result of vendors’ confusion about NRC regulatory guidance and 

expectations for approving certain accredited calibration laboratories, (1) 

vendors might not be approving accredited calibration laboratories in the 

manner that NRC expects, (2) vendors could find themselves unknowingly 

in violation of NRC regulations, and (3) vendors could later determine that 

they used out-of-calibration measuring and test equipment during the 

manufacture and assembly of safety-related parts and components or 

during the dedication of commercial-grade items.

Recommendation

OIG recommends that the Executive Director for Operations:

9. Develop guidance that clarifies the requirements for vendors on how to 

approve accredited commercial-grade calibration laboratories for 

safety-related applications.
Audit of NRC’s Vendor Inspection Program

36

E. NRC’s Approach to Counterfeit, Fraudulent, and Substandard Items Could 

Be Strengthened

NRC could strengthen its current approach to counterfeit, fraudulent, and 

substandard items (CFSI). Both the Federal Government and private 

sector have recognized the increasing prevalence of CFSI in nuclear and 

other industries. However, NRC’s approach has been primarily reactive 

and based largely on the abilities of one or two individuals to monitor and 

evaluate the threat. This is because NRC lacks a formal strategy and plan 

to monitor and evaluate potential CFSI, and consider program changes to 

address the CFSI issue. Consequently, the lack of any formal strategy or 

framework to address CFSI could result in reactor construction problems 

with major implications for public health and safety.

The Need To Address CFSI as a Serious Threat

Both the Federal Government and private sector have recognized the 

threat of CFSI and have taken steps to address it. At the Federal level, 

the Department of Commerce, the Government Accountability Office

(GAO), the Department of Defense (DOD), and the FAA have all 

determined that CFSI is a threat. NRC and the nuclear industry have also 

acknowledged the threat of CFSI. 

The defense industry has been particularly subject to the pitfalls of CFSI. 

The Department of Commerce’s Office of Technology Evaluation, in a 

2010 report, stated that 39 percent of companies and organizations 

working in the defense sector encountered counterfeit electronics during a 

4-year period. Moreover, the Office of Technology Evaluation found an 

increasing number of counterfeit incidents being detected, rising from 

3,868 incidents in 2005, to 9,356 incidents in 2008. These counterfeit 

incidents included multiple versions of parts and components that had 

been qualified by DOD. The GAO also identified a number of weaknesses 

in the DOD supply chain, noting in a 2010 report that DOD had a limited 

ability to determine the extent to which counterfeit parts exist in its supply 

chain. As a result of the GAO report, DOD agreed to improve its ability to 

prevent, detect, report, and dispose of counterfeit parts. 

For the civilian aviation industry, the FAA implemented a program in 1995

to address suspected unapproved parts. The FAA program’s purpose is 

to identify unapproved parts related to the aircraft industry and to remove 

them from the aviation system. According to the FAA, the program 
Audit of NRC’s Vendor Inspection Program

37

extends into the wider aviation community. FAA officials have stated that 

there are many parts suppliers, distributors, owners/operators, and legal 

enforcement authorities who do not understand the importance of 

installing only approved aircraft parts. To combat this, the FAA holds 

seminars with the aviation community and has a Web site and hotline to 

facilitate rapid receipt and analysis of complaints about suspected parts 

(see Figure 7). As a result of the increase of public awareness of the 

suspected unapproved parts program, the FAA has reported a significant 

increase in notifications and investigations. The FAA has asserted that 

the only way to keep CFSI out of aircraft is for the entire industry to 

proactively identify and ensure such items are removed from the supply 

chain. 

Figure 7: FAA Web Site for Reporting Suspected Unapproved Parts

Source: FAA Web site.

The nuclear industry has also reported concerns with the integrity of the 

nuclear supply chain. EPRI published a report in late 2009 that noted an 

increase in CFSI activity worldwide. The report further noted that there 
Audit of NRC’s Vendor Inspection Program

38

have been at least six separate instances of counterfeit parts getting into 

the nuclear industry supply chain, though as far as is known, none of them 

were safety-related.

Given the global nature of the nuclear supply chain, some agency 

Commission members have also spotlighted CFSI in public speeches. In 

2007, NRC’s then-Chairman expressed concerns that the close scrutiny 

that regulatory agencies can bring to bear on major manufacturers to 

assure that quality components are produced does not always apply with 

the same intensity to the sub-vendors that supply parts and materials to 

the manufacturers. The Chairman stated that it was of great concern that 

substandard or counterfeit components could find their way into a 

commercial nuclear reactor. The Chairman returned to the issue of CFSI 

in 2008, and proposed that foreign regulatory counterparts set up a formal 

system of sharing data about CFSI. One of NRC’s previous 

Commissioners also emphasized the issue of CFSI, declaring that 

concerns were neither academic nor hypothetical and that NRC has 

previously identified counterfeit and deficient parts and continues to seek 

better ways of monitoring the increasing globalization of the nuclear 

supply chain through international collaborations. 

Emphasizing the threat of CFSI to the nuclear industry, NRC published an 

information notice in 2008 that provided specific examples of CFSI that 

had gotten into the nuclear industry’s supply chain. This included some 

counterfeit valves that were discovered in 2007 in systems that were not 

safety-related, but provided cooling to the main electric generator at a 

boiling water reactor plant. Another example showed how the Consumer 

Product Safety Commission issued a recall of counterfeit Square D circuit 

breakers that had been manufactured overseas (see Figure 8). The 

breakers had been purchased for use by three licensees, one of whom 

discovered that the breakers were counterfeit. 
Audit of NRC’s Vendor Inspection Program

39

Figure 8: A Counterfeit Square D Circuit Breaker

Sources: NRC and Consumer Product Safety Commission.

Ultimately, the threat posed by CFSI to the nuclear industry is that of a 

faulty component being installed in a safety-related system. The failure of 

safety-related components could affect a reactor’s operations, reducing 

the margin of safety and resulting in operating conditions of degraded 

safety and quality.

NRC’s Overall Approach to CFSI Is Largely Reactive

NRC’s overall approach to CFSI appears not to match the significance of 

the potential threat and is primarily reactive in nature. Despite concerns 

with CFSI in other industries dating back to the mid-1990s, NRC’s 

attention was not significantly drawn towards CFSI until relatively recently. 

NRC and EPRI staff members said that there had not been substantive 

concerns regarding CFSI activity at NRC for nearly 20 years until spurred 

by the former Chairman’s 2007 speech. One senior program manager 

stated that the industry was “taken by surprise” by the Chairman’s speech, 

as CFSI had not been thought to have been much of a problem since 

NRC last addressed it in the late 1980s with a generic communication sent 

to licensees. 

Since NRC’s renewed interest, the agency’s approach to combating CFSI 

has been based largely on the abilities of a few individuals in NRR and 

NRO to monitor and evaluate the threat. NRC managers stated that staff 

members addressing CFSI are doing so on an informal basis as their 
Audit of NRC’s Vendor Inspection Program

40

other duties allowed and, at present, only about 15 percent of one full-time 

equivalent staff member is being dedicated to addressing CFSI issues. To 

NRR’s and NRO’s credit, these staff members are evaluating component 

defect reports for CFSI-related items. However, these staff members also 

acknowledged that there are no clear procedures for whom to contact in 

the event potential CFSI was uncovered at a vendor. Moreover, when 

asked if current inspection procedures included criteria for identifying 

CFSI, a senior inspector said that it probably would not.

Outside of the NRO- and NRR-designated staff members for CFSI, other 

staff members are generally not involved in CFSI monitoring and 

evaluation. For example, Vendor Inspection Program staff members are 

either unaware of the agency’s CFSI efforts or have varying interpretations 

of where CFSI fits into vendor inspections. Some NRO inspectors felt that 

identifying and evaluating CFSI-related issues was outside their area of 

responsibility. Other inspectors said that overall direction from managers 

was unclear and staff members were using their own judgment to 

informally evaluate potential CFSI. Nonetheless, one NRC executive 

expressed belief that the vendor inspections as carried out will identify 

potential CFSI. During the eight vendor inspections that OIG attended, 

auditors observed only one inspector informally reviewing a vendor’s 

facilities for conditions that may contribute to future CFSI. Furthermore, 

when asked if the current inspection process would catch CFSI, a senior 

inspector stated that it probably would not.

NRC’s CFSI Approach Lacks a Formal Strategy and Plan 

NRC’s approach to CFSI appears to be largely reactive because the 

agency does not have a formal strategy and plan to monitor and evaluate 

potential CFSI, and consider program changes to address the CFSI issue. 

NRC managers acknowledged that they could not provide many details 

about the agency’s approach to CFSI issues. NRC also does not have a 

standing working group or other centralized body to address CFSI issues, 

although it does have a largely-incomplete draft CFSI charter for such a 

group. This document is very preliminary and currently provides no details 

beyond a statement establishing the intent to create mechanisms for 

notification and coordination across NRC program offices. However, there 

is no specific plan or strategy for communicating CFSI issues. 
Audit of NRC’s Vendor Inspection Program

41

NRC Might Be Missing Opportunities To Identify CFSI Early 

NRC might be missing opportunities to identify CFSI in a less reactive and 

more proactive manner. CFSI is an evolving threat that poses serious 

potential risks to the nuclear industry. Without a formal strategy or 

framework to address CFSI, NRC could fail to identify CFSI issues in a 

timely fashion, with the potential for counterfeit or fraudulent components 

being installed in safety-related reactor systems. Additionally, a lack of a 

formal strategy hampers NRC’s ability to identify resource needs and 

allocations to address CFSI and impairs agency knowledge management 

efforts to address it. Furthermore, if CFSI were to make it into a safetyrelated system in a nuclear power plant, it could degrade the ability of the 

system to perform its safety function, which could reduce the protection of 

public health and safety.

Recommendation

OIG recommends that the Executive Director for Operations: 

10. Develop and implement a formal agencywide strategy and plan in 

order to monitor and evaluate CFSI.
Audit of NRC’s Vendor Inspection Program

42

IV. CONSOLIDATED LIST OF RECOMMENDATIONS

` OIG recommends that the Executive Director for Operations:

1. Develop an NRO Vendor Inspection Program planning document that:

a. Articulates a clear purpose for the Vendor Inspection Program.

b. Establishes metrics to evaluate the success of the Vendor 

Inspection Program.

2. Develop and document a methodology to identify vendors that supply 

safety-related parts and services to the nuclear industry with Appendix 

B quality assurance programs.

3. Develop and document a risk-informed methodology to select vendors 

for inspection.

4. Develop and use a vendor outreach/communications plan.

5. Align NRC guidance and regulations to clarify acceptance methods for 

commercial-grade dedication.

6. Issue regulatory guidance to clarify sampling expectations for 

commercial-grade dedication.

7. Issue regulatory guidance describing a process that NRC considers 

acceptable for compliance with Part 21.

8. Clearly indicate via the NRC public Web site how and when Part 21 

has changed.

9. Develop guidance that clarifies the requirements for vendors on how 

to approve accredited commercial-grade calibration laboratories for 

safety-related applications.

10. Develop and implement a formal agencywide strategy and plan in 

order to monitor and evaluate CFSI. 
Audit of NRC’s Vendor Inspection Program

43

V. AGENCY COMMENTS

On August 17, 2010, OIG provided a draft report to the Executive Director 

for Operations. OIG held an exit conference with the agency on 

August 31, 2010. During that meeting agency management provided 

informal comments to the draft report. Also, on September 10, 2010, OIG 

held an additional meeting with NRC staff to discuss the agency’s informal 

comments to the draft report. On September 14, 2010, OIG provided the 

agency a revised draft report, and on September 17, 2010, the agency 

declined to provide any formal comments. The final report incorporates 

revisions made, where applicable, as a result of meetings with NRC staff.
Audit of NRC’s Vendor Inspection Program

44

Appendix

SCOPE AND METHODOLOGY

The audit objective was to assess NRC’s regulatory approach for ensuring 

the integrity of domestic and global parts and services supplied to nuclear 

power reactors. To address the audit objective, OIG observed eight

vendor quality assurance inspections, which include NRC’s review of 

vendor’s compliance with both Part 21 and Appendix B criteria; attended 

one NUPIC vendor audit; observed industry training courses for vendor 

quality assurance; and attended several industry meetings and two NRC 

vendor workshops. OIG discussed vendor issues with applicable vendor 

managers or consultants at each of the eight vendor inspections, and at all 

of the industry meetings and training courses attended. OIG also 

reviewed NRC regulations and guidance, and interviewed NRC staff 

members and industry officials. Additionally, OIG identified and reviewed 

vendor quality assurance inspection-related reports and memoranda, 

reviewed nuclear industry vendor standards and guidance, and analyzed 

NRC vendor quality assurance inspection reports dating back to 2006. 

Key documents reviewed include:

 Energy Reorganization Act of 1974, Section 206.

 10 CFR Part 21, Reporting of Defects and Noncompliance.

 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear 

Power Plants and Fuel Reprocessing Plants.

 NUREG-0302, Rev 1, Remarks Presented (Questions/Answers 

Discussed) at Public Regional Meetings to Discuss Regulations (10 

CFR Part 21) for Reporting of Defects and Noncompliance.

 NUREG-1055, Improving Quality and the Assurance of Quality in the 

Design and Construction of Nuclear Power Plants: A Report to 

Congress.

 Inspection Manual Chapter 2507, Construction Inspection Program:

Vendor Inspections.

 Inspection Manual Chapter 0614, Documenting 10 CFR 52 

Construction Audit Activities.
Audit of NRC’s Vendor Inspection Program

45

 Inspection Manual Chapter 0617, Vendor and Quality Assurance 

Implementation Inspection Reports.

 Inspection Procedure 36100, Inspection of 10 CFR Part 21 and 10 

CFR 50.55(e) Programs for Reporting Defects and Noncompliance.

 Inspection Procedure 38703, Commercial Grade Dedication Programs.

 Inspection Procedure 43002, Routine Inspections of Nuclear Vendors.

 Inspection Procedure 43003, Reactive Inspections of Nuclear Vendors.

 Inspection Procedure 43004, Inspection of Commercial Grade 

Dedication Programs.

 Inspection Procedure 43005, NRC Oversight of Third-Party 

Organizations Implementing Quality Assurance Requirements.

 Management Directive 8.18, NRC Generic Communications Program.

 NRC information notices.

 NRC generic letters.

 Agency office instructions.

 Vendor QA inspection plans and reports.

 SECY papers.

 NRC vendor presentations.

 Commissioners’ speeches and NRC press releases.

 Nuclear industry vendor guidance documents.

 GAO reports.

 Academic management publications.
Audit of NRC’s Vendor Inspection Program

46

Auditors conducted 46 interviews with agency and industry employees, 

including NRC managers and staff members at headquarters, and 

members of the nuclear industry. OIG conducted this audit at NRC 

headquarters, and selected licensee and vendor locations in the United 

States, France, and Japan. 

We conducted this performance audit, from October 2009 through August 

2010, in accordance with generally accepted Government auditing 

standards. Those standards require that the audit is planned and 

performed with the objective of obtaining sufficient, appropriate evidence 

to provide a reasonable basis for any findings and conclusions based on 

the stated audit objective. OIG believes that the evidence obtained 

provides a reasonable basis for the report findings and conclusions based 

on the audit objectives. Internal controls related to the audit objective 

were reviewed and analyzed. Throughout the audit, auditors were aware 

of the possibility or existence of fraud, waste, or misuse in the program.

Major contributors to this report were Sherri Miotla, Team Leader; 

R.K. Wild, Team Leader; Kevin Nietmann, Senior Technical Advisor; 

Michael Zeitler, Audit Manager; Timothy Wilson, Senior Management 

Analyst; Levar S. Cole, Senior Management Analyst; 

Vidya Sathyamoorthy, Student Management Analyst; and 

Diane Furstenau, Student Management Analyst.