QM-1 QUALITY MANAGEMENT SYSTEMS MANUAL. Revision 10

QM-1 QUALITY MANAGEMENT SYSTEMS MANUAL Revision 10 Page: 1 of 54

TABLE OF CONTENTS 1. DOCUMENT REVISION HISTORY... 5 2. INTRODUCTION... 6 2.1 Purpose... 6 2.2 Scope... 7 Figure 1: Sequence and Interaction of the QMS... 8 3. Terms and Definitions... 9 4. QUALITY MANAGEMENT SYSTEM... 10 4.1 General Requirements... 10 4.2 Documentation Requirements... 11 5. MANAGEMENT RESPONSIBILITY... 14 5.1 Management Commitment... 14 5.2 Customer Focus... 15 5.3 Quality Policy... 15 5.4 Quality Planning and Evaluation... 16 5.5 Responsibility, Authority and Communication... 16 5.6 Management Review... 18 6. Resource Management... 19 6.1 Provision of Resources... 19 6.2 Human Resources... 19 6.3 Infrastructure... 20 6.4 Work Environment... 20 7. Product Realization... 22 7.1 Planning of Product Realization... 22 7.2 Customer-related Processes... 24 7.3 Design... 26 7.4 Purchasing... 26 7.5 Production Provision... 31 7.6 Control of Monitoring and Measuring Devices... 36 8. MEASUREMENT, ANALYSIS AND IMPROVEMENT... 37 8.1 General... 37 8.2 Monitoring and Measurement... 37 8.3 Control of Nonconforming Product... 42 8.4 Analysis of Data... 44 8.5 Improvement... 44 Page: 3 of 54

APPENDIX A: QMS Support and Implementation... 48 APPENDIX B: Structure of Documentation Used in QMS... 49 APPENDIX C: Veridiam Organizational Chart... 50 APPENDIX D: Veridiam Functional Organization and Responsibilites 51 Page: 4 of 54

1 DOCUMENT REVISION HISTORY Paragraph Revisions: or Section: See historic files for revisions 1-7 1.1.2 Removed reference to Oceanside and Supplement 2 2.0 Updated job titles and responsibilities 7.1.1 Added description of project management 7.1.3 Added Configuration Management section 7.1.4 Added description of work transfers 7.4 Added section j regarding commercial grade dedication 7.5.1.1 Added Production Process Verification section 7.5.1.1 Renumbered section accordingly 7.5.1.6 7.5.1.4 Added Veridiam excludes section 7.5.1.4 Post- 8.2.2 Delivery Support for AS9100C. Added and consideration of customer contractual requirements. Appendix B Removed reference to CQP and QSP and Oceanside Appendix C Updated Org Chart, added reference to HR0030 Appendix D Updated titles 1.2.2e 1.2.2f 7.4.1j Changed NQA-1-2008 to NQA-1a-2009. Added section for NQA-1-1994. Corrected typo to read current ASL listing as nuclear safety-related or an approved commercial grade dedication process Appendix C Updated Veridiam Organizational chart Appendix D Added Director of Engineering and Director of Quality positions 2.2.2 e Corrected format reference to NQA-1 2008:2009a Updated signature page with current names and titles Appendix D 2.8 Updated references to Operations to Manufacturing Updated Quality Director position description to include responsibility as Veridiam s Management Representative Rev: Date: 8 12/7/2013 9 8/22/14 10 3/17/15 Page: 5 of 54

2 INTRODUCTION 2.1 Purpose 2.1.1 This document has been prepared to describe the Quality management system in place at Veridiam. It provides policy and guidelines for all processes related to product provided by Veridiam to its customers. 2.1.2 This Quality Management System Manual is the top level of a multi-tiered structure, and is organized along the lines of ISO 9001, AS9100, ISO 13485 and NQA-1. While this Quality Management Systems Manual is referred to as the Quality Manual, the details for implementation of policies and guidelines are provided in lower tiered documents such as procedures and work instructions. Separate document, QM-1 Supplement, list each lower tiered document associated with the applicable sections of this Quality Manual. The supplemental document may be revised independently of this Quality Manual. Page: 6 of 54

2.2 Scope 2.2.1 The scope of the work performed at Veridiam is fabrication and assembly of specialty alloys that serve the medical, aerospace, commercial and nuclear industries. 2.2.2 Veridiam s Quality management system encompasses several regulatory requirements and standards that include: a. ISO 9001:2008: Quality Management System Requirements, b. CAN/CSA ISO 13485:2003: Medical Devices Quality Management Systems Requirements for Regulatory Purposes, c. AS 9100C: Quality Systems Aerospace Model for Quality Assurance in Design, Development, Production, Installation and Servicing. d. 10CFR 50, Appendix B: Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, e. ASME NQA-1 2008:2009a: Quality Assurance Requirements for Nuclear Facility Applications, f. ASME NQA-1-1994: Quality Assurance Requirements for Nuclear Facility Applications, g. 10CFR Part 21: Reporting of Defects and Noncompliance h. Ordinance No. 169, Ministerial Ordinance on Standards for Manufacturing Control and Quality Control for Medical Devices and In-vitro Diagnostic Reagents. 2.2.3 Exclusion: Veridiam s Quality Management System does not address the Design requirements (reference AS9100, ISO 9001, ISO 13485, 10CFR50 Appendix B and NQA-1). 2.2.4 Not Applicable: The following are not performed at Veridiam and are not applicable to the Quality management system: 2.2.4.1 Test Control 2.2.4.2 Installation and Servicing activities 2.2.4.3 Sterilization 2.2.4.4 Agents, distributor and consignee requirements 2.2.4.5 Control of service operations Page: 7 of 54

Figure 1: The Sequence and Interaction of the Quality Management System Processes Management Planning & Review 5.4; 5.6 Resource Management 6 Monitoring & Measuring 8.2 Data Analysis 8.4 *CAPA 8.5.1, 8.5.2, 8.5.3 *Complaint Handling 8.2.1, 8.5.1 Support Processes Customer Requirements Marketing & Sales 7.2 *Internal Audits 8.2.2 Planning of Product Realization 7.1 Documents & Records 4.2 Core Processes Purchasing 7.4 Monitoring & Measuring Devices 7.6 *Control of Nonconforming. Product 8.3 Customer Satisfaction *Production 7.5.2 *Verification 7.4.3; 8.2.4 Handling, Storage, & Shipping 7.5.5; 7.5.7 *Performance data maintained Page: 8 of 54

3 Terms and definitions 3.1 Throughout the text of this Quality Manual, terms and definitions given in ISO 9000 apply. 3.2 Special Requirements: those requirements identified by the customer or determined by the organization to have high risks to being achieved. Such requirements are typically subject to the risk management process. 3.3 Critical items: Items that have a significant effect on the product realization and use of the product, including safety, performance, fit, function, producibility, service life all which may require specific actions to ensure they are adequately managed. 3.4 Key Characteristic: An attribute or feature whose variation has a significant effort on product fit, form, function, performance, service life or producibility, that requires specific actions for the purpose of controlling variation. 3.5 Medical Device: Any instrument, apparatus, implement, machine, appliance, implant intended to be used alone or in combination, for human beings for one or more of the following purposes: a. diagnosis, prevention, monitoring, treatment or alleviation of disease, b. diagnosis, monitoring, treatment, alleviation of or compensation of an injury, c. investigation, replacement, modification, or support of the anatomy of a physiological process, d. supporting or sustaining life, e. control of conception, f. disinfection of medical devices, and, g. providing information for medical purposes by means of in vitro examination of specimens derived from the human body. 3.6 Advisory Notice: A notice issued by the organization subsequent to the delivery of a medical device. An advisory notice provides information regarding the use or modification of the medical device, the return of the medical device to the organization, or the destruction of the medical device. Page: 9 of 54

3.7 Marketing Authorization Holder: Also known as the Customer. 4 QUALITY MANAGEMENT SYSTEM 4.1 General Requirements 4.1.1 Veridiam has established, documented, implemented, and continues to maintain a Quality management system (QMS). The effectiveness of the QMS is maintained in accordance with International Standards and other documents that are shown in the Scope section of this Quality Manual. 4.1.2 Application and responsibility for QMS processes: The President and Chief Executive Office is responsible for overall implementation of the QMS at Veridiam. Responsibilities of individual managers and their departments for implementing and supporting QMS processes are shown in Appendix A, QMS Support and Implementation 4.1.3 Veridiam s quality management system also addresses customer and applicable regulatory quality management system requirements. Veridiam performs the following: a. determines the processes needed for the quality management system and their application throughout the organization, b. determines the sequence and interaction of these processes as seen in Figure 1, The Sequence and Interaction of the Quality Management System Processes, c. determines criteria and methods needed to ensure that both the operation and control of these processes are effective, d. ensures the availability of resources and information necessary to support the operation and monitoring of these processes, e. monitors, measures and analyzes these processes, f. implements actions necessary to achieve planned results, continual improvement, and maintain the effectiveness of these processes, Page: 10 of 54

g. when Veridiam chooses to outsource any process that affects product conformity to requirements, the organization ensures control over such processes, and h. the type and extent of control of outsourced processes are identified within the supplier management systems and contractual agreements. NOTE 1: Processes needed for the Quality management system referred to above include processes for management activities, provision of resources, product realization, measurement, analysis and improvement. NOTE 2: An outsourced process is a process that the organization needs for its quality management system and which the organization chooses to have performed by an external party. NOTE 3: Ensuring control over outsourced processes does not absolve Veridiam of the responsibility of conformity to all customer, statutory and regulatory requirements. The type and extent of control applied to outsourced processes can be influenced by factors such as: a. the potential impact of the outsourced process on the organization s capability to provide product that conforms to requirements, b. the degree to which the control for the processes is shared, c. the capability of achieving the necessary control through the application of purchasing processes. 4.2 Documentation Requirements 4.2.1 Activities affecting quality of product and compliance to the quality management system are prescribed by and performed in accordance with documents such as instructions, procedures, drawings, etc. These documents are commensurate in detail with the complexity of the activity and the degree of control required. and include: a. documented statements of a quality policy and quality objectives, Page: 11 of 54

b. a quality manual, c. documented procedures and records as required by International Standards and customer requirements, d. documents, including records determined by the organization to be necessary to ensure the effective planning, operation and control of its processes, e. quality system requirements imposed by applicable regulatory authorities, f. when International Standards, regulatory and customer requirements specifies that a requirement, procedure, activity or special arrangement be documented, it is implemented and maintained. g. for each type or model of medical device, Veridiam establishes and maintains a file either containing or identifying documents defining product specifications and Quality management system requirements. These documents define the complete manufacturing process. NOTE 1: Where the term documented procedure appears in this Quality Manual, the procedure is established, documented, implemented and maintained. NOTE 2: A single document may address the requirements for one or more procedures. A requirement for a documented procedure may be covered by more than one document. NOTE 3: Veridiam determines the form and medium best suited to documentation requirements. 4.2.2 Quality Manual: Veridiam has established and maintains a Quality Manual that includes: a. the scope of the Quality management system, including details of and justification for any exclusion and/or nonapplication, b. the documented procedures established for the Quality management system, or reference to them, and c. a description of the interaction between the processes of the Quality management system. This is accomplished within each section of this manual, Page: 12 of 54

4.2.2.1 Separate documents, QM-1 Supplement and QM-2 Supplement, list applicable procedures that support the Quality Manual and the quality management system processes. 4.2.3 Control of Documents: Documents required by the quality management system are controlled in the following manner: a. approve documents for adequacy prior to issue, b. review, update, and as necessary, re-approve documents, c. ensure that changes and the current revision status of documents are identified, d. ensure that relevant versions of applicable documents are available at points of use, e. ensure that documents remain legible and readily identifiable, f. ensure that documents of external origin determined by the organization to be necessary for the planning and operation of the quality management system are identified and their distribution controlled, g. identify and maintain status of controlled documents, to ensure that changes and the current revision status of documents are identified, h. prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose, i. ensure that changes to documents are reviewed and approved either by the original approving function or another designated function which has access to pertinent background information upon which to base its decisions, j. defines the period for which at least one copy of obsolete controlled documents is retained. This period ensures that documents to which medical devices have been manufactured and tested are available for at least the lifetime of the medical device as defined by Veridiam, but not less than the retention period of any resulting record, or as specified by relevant regulatory requirements, k. personnel have access to QMS documentation and are aware of relevant procedures, and Page: 13 of 54

l. customer and/or regulatory authority representatives have access to non-proprietary QMS documentation. NOTE: Records are a special type of document and are controlled in accordance with section 4.2.4. 4.2.4 Control of Records: Records established to provide evidence of conformity to requirements and of the effective operation of the quality management system are controlled. A documented procedure defines the controls needed for the identification, storage, protection, retrieval, retention and disposition of records. Controls include: a. records remain legible, readily identifiable and retrievable b. records are retained for a period of time at least equivalent to the lifetime of the medical device as defined by Veridiam, but not less than two years from the date of product release by Veridiam or as specified by relevant regulatory requirements, and c. records are available for review by customers and regulatory authorities in accordance with contract or regulatory requirements. 5 MANAGEMENT RESPONSIBILITY 5.1 Management Commitment 5.1.1 Top management provides evidence of its commitment to the development and implementation of the Quality management system and continually improving its effectiveness by: a. Communicating to Veridiam employees the importance of meeting customer as well as statutory and regulatory requirements, b. establishing the quality policy, c. establishing quality objectives, d. conducting management reviews, e. ensuring the availability of resources, and Page: 14 of 54

f. ensuring that those responsible for verifying quality have sufficient authority, direct access to management, organizational freedom, and the access to work to perform their function. Note: In some cases, the customer may be referred to as the marketing authorization holder and other bodies receiving the products. 5.1.2 A description of the functional organizations and their responsibilities are depicted in Appendix D. 5.2 Customer Focus 5.2.1 Top management ensures that customer requirements are determined and are met with a goal of enhancing customer satisfaction. 5.2.2 Top management ensures product conformity and on-time delivery performance are measured and that appropriate action is taken if planned results are not, or will not be achieved. 5.3 Quality Policy 5.3.1 Veridiam has an established Quality Policy. Top management ensures that the quality policy: a. is appropriate to the purpose of Veridiam, b. includes a commitment to comply with requirements, c. includes a commitment to continually improve and maintain the effectiveness of the quality management system, d. provides a framework for establishing and reviewing quality objectives, e. communicated and understood within Veridiam, f. is reviewed for continuing suitability, and g. is based on customer focus Page: 15 of 54

5.3.2 The Veridiam Quality Policy is as follows: We are committed to total customer satisfaction through compliance to requirements, maintenance of the quality management system and continuous improvement of our processes, products and services. 5.4 Quality Planning and Evaluation 5.4.1 Quality Objectives: Top management ensures that quality objectives, including those needed to meet requirements for product, are established at relevant functions and levels within Veridiam. The quality objectives are measurable and consistent with the quality policy. 5.4.2 Quality Management System Planning: Top management ensures that: a. planning of the quality management system is carried out to meet the requirements of the quality objectives and the general requirements to establish, document and maintain the quality management system, b. the integrity of the quality management system is maintained when changes to the quality management system are planned and implemented, and c. actions are taken to implement improvements to the quality management system as soon as practical. 5.5 Responsibility, Authority and Communication 5.5.1 Responsibility and authority: Top management ensures that responsibilities and authorities are defined, documented and communicated within the organization. 5.5.1.1 Top management establishes the interrelation of all personnel who manage, perform and verify work affecting quality, and ensures the independence and authority necessary to perform these tasks. Page: 16 of 54

5.5.2 Management representative: Top management appoints a member of the organization s management who, irrespective of other responsibilities has the responsibility and authority that includes: a. ensuring that processes needed for the quality management system are established implemented and maintained, b. reporting to top management on the performance of the Quality management system and any need for improvement, c. ensuring the promotion of awareness of regulatory and customer requirements throughout Veridiam, d. promoting awareness among Veridiam employees of the Quality Policy and the requirement for customer focus in all activities, e. has organizational freedom and unrestrictive access to top management to resolve matters pertaining to quality management, and f. serves as the Veridiam point of contact when liaison with external parties on matters relating to the quality management system is required. 5.5.3 Internal communication: Management ensures that appropriate communication processes are established. The organization ensures that communication takes place regarding the effectiveness of the quality management system by one or more of the following means: a. formal periodic reviews of the quality management system, b. communication of quality objectives and the status of their implementation in distributed reports, c. periodic all-employee meetings held by top management, and d. periodic meetings between department managers and the employees in their departments. Page: 17 of 54

5.6 Management Review 5.6.1 General: Top management reviews Veridiam s quality management system in accordance with documented procedures. Management reviews: a. are performed at planned intervals to ensure its continuing suitability, adequacy and effectiveness, b. assess opportunities for improvement and the need for changes to the quality management system, including the quality policy and quality objectives, and. c. are documented in management review presentations and minutes, including actions to be taken. 5.6.2 Review input to management review includes information from: a. results of audits, b. customer feedback, c. process performance and product conformity, d. status of preventive and corrective actions, e. follow-up actions from previous management reviews, f. changes that could affect the quality management system, g. recommendations for improvement, and h. new or revised regulatory requirements. 5.6.3 Review output from the management review includes any decision and actions related to: a. improvements needed to maintain the effectiveness of the quality management system and its processes, b. improvement of product related to customer requirements, and, c. resource needs. Page: 18 of 54

6 RESOURCE MANAGEMENT 6.1 Provision of Resources 6.1.1 Management determines and provides the resources needed: a. to implement the Quality management system and to continually improve and maintain its effectiveness, b. to meet regulatory and customer requirements, c. to achieve Veridiam business and quality objectives, and d. to enhance customer satisfaction by meeting or exceeding customer expectations. 6.2 Human Resources 6.2.1 General: Personnel who perform work affecting conformity to product requirements are competent on the basis of appropriate education, training, skills and experience. NOTE: Conformity to product requirements can be affected directly or indirectly by personnel performing any task within the quality management system. 6.2.2 Competence, Training and Awareness. The organization: a. determines the necessary competence for personnel performing work affecting conformity to product quality, b. where applicable, assesses the competence of employees and provides training or other takes other actions to achieve the necessary competence, c. evaluates the effectiveness of the actions taken to establish and maintain employee competence, d. ensures that personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives, e. generates and maintains appropriate records of education, training, skills and experience, and f. establishes documented procedures for identifying training needs based on regional or national regulations if required. Page: 19 of 54

6.2.3 Veridiam ensures that all employees receive initial and periodic training in quality management system procedures applicable to their job function. 6.3 Infrastructure 6.3.1 Veridiam determines, provides, and maintains the infrastructure needed to achieve conformity to product requirements. Infrastructure includes, as applicable: a. buildings, workspace and associated utilities, b. process equipment (both hardware and software), c. supporting services (such as transport, communication or information systems), and d. pest control (such as insects or rodents) is provided on an as-needed basis in manufacturing and administrative areas. 6.3.2 Documented procedures outline requirements for maintenance activities, including their frequency, when such activities or lack thereof can affect product quality. 6.3.3 Hardware and software suitable for minimizing variation while ensuring product conformity is provided and maintained. A preventive maintenance program is implemented to assure that equipment performs reliably within design parameters. Software quality assurance procedures ensure that software is protected from modification without proper authorization and testing. 6.3.4 Records of maintenance activities and results are maintained. 6.4 Work Environment 6.4.2 Veridiam determines the requirements for, and manages the work environment needed to achieve conformity to product requirements. 6.4.3 Veridiam maintains a safe and efficient work environment for its employees. The following requirements apply: Page: 20 of 54

a. documented requirements for health, cleanliness and clothing of personnel if contact between such personnel and the product or work environment could adversely affect the quality of the product, b. where the work environment conditions can have an adverse effect on product quality, Veridiam has established documented requirements for the work environment conditions and documented procedures or work instructions to monitor and control these work environment conditions. Factors to be considered include temperature, humidity, lighting, cleanliness, protection from electrostatic discharge, etc., c. all personnel who are required to work temporarily under special environmental conditions within the work environment are appropriately trained or supervised by a trained person, d. if appropriate, special arrangements are established and documented for the control of contaminated or potentially contaminated product in order to prevent contamination of other product, the work environment, or personnel, and e. all necessary actions are taken to minimize the use and generation of hazardous materials and to ensure full compliance with applicable environmental regulations. NOTE: The term work environment relates to those conditions under which work is performed including physical, environmental and other factors such as noise, temperature, humidity, lighting or weather. 6.4.4 Safety Program. Veridiam has made appropriate provisions for the safety of its employees through: a. actively managing the work environment in order to provide a safe, efficient work place that maximizes employee effectiveness, and b. a plant-wide safety program that focuses on such factors as safety guarding, fire hazards, trip hazards, and electrical safety has been established. When required, special safety programs (e.g., overhead lifting safety and forklift safety) are implemented and managed. Page: 21 of 54

7 Product Realization 7.1 Planning of Product Realization: Veridiam plans and develops the processes needed for the manufacture of product in accordance with documented procedures. Planning of product realization is consistent with the requirements of the other processes of the quality management system. The organization determines as appropriate: a. quality objectives and requirements for the product (see Note 1), b. the need to establish processes, documents, and provide resources specific to the product, c. required verification, validation, monitoring, inspection and test activities specific to the product and the criteria for product acceptance, d. records needed to provide evidence that the realization processes and resulting product meet requirements, e. configuration management appropriate to the product, f. resources to support the use and maintenance of the product (as applicable), g. cleanliness to specified levels and the removal of process agents, and, h. regulatory requirements for the product (as applicable). NOTE 1: Quality objectives and requirements for the product include consideration of aspects such as: product and personnel safety reliability, availability and maintainability producibility and inspectability suitability of parts and materials used in the product selection and development of embedded software, and recycling or final disposal of the product at the end of its life NOTE 2: A document specifying the processes of the quality management system (including the product realization processes) and the resources to be applied to a specific product, project or contract can be referred to as a quality plan. Page: 22 of 54

7.1.1 Project Management: As appropriate to the organization and the product, Veridiam plans and manages product realization in a structured and controlled manner to meet requirements at acceptable risk. This is accomplished within known resource and schedule constraints. 7.1.2 Risk Management: Veridiam has established processes for managing risk to the achievement of applicable requirements. Risk management includes: a. assignment of responsibilities for risk management, b. definition of risk criteria (e.g., likelihood, consequences, risk acceptance), c. identification, assessment and communication of risks throughout product realization, d. identification, implementation and management of actions to mitigate risks that exceed the defined risk acceptance criteria, e. acceptance of risks remaining after implementation of mitigating actions, f. additional assessments when requirements change, and g. documentation of assessments NOTE: Documented risk analyses are performed for product as required by International Standards or specific customer requirements. 7.1.3 Configuration Management: Veridiam has an established process for establishing, implementing and maintaining configuration management. Configuration management includes: a. configuration management planning b. configuration identification c. change control d. configuration status accounting, and e. configuration auditing 7.1.4 Work Transfer: Veridiam has an established process for issuing purchase orders for transferring work to a supplier and transferring work from one supplier to another supplier. Page: 23 of 54

7.1.5 The output of planning for product realization are in a form suitable for Veridiam s method of operations, as applicable: f. sequence of manufacturing operations (traveler), g. a bill of material, c. the establishment of process controls and development of control plans where key characteristics have been identified by the customer, d. the identification of in-process verification points when adequate verification of conformance cannot be performed at a later stage of realization, e. the provision for tooling and measuring equipment so that variable measurements can be taken whenever possible, (particularly for key characteristics identified by the customer), f. identification of special processes and related qualification requirements, g. a means to record completion of manufacturing operations, and to collect data, and, h. requirements for product certification. 7.2 Customer-Related Processes 7.2.1 Determination of requirements related to the product: Veridiam reviews the requirements related to the product in accordance with documented procedures. These reviews are conducted prior to the commitment to supply a product to the customer, including: a. requirements specified by the customer, including product requirements and the requirements for delivery, and postdelivery activities, b. requirements not stated by the customer but necessary for specified or intended use (where known), c. statutory and regulatory requirements applicable to the product, d. any additional requirements considered necessary, and e. internally-generated requirements are determined and can be met. NOTE: Post delivery activities include actions under warranty provisions or contractual obligations. Page: 24 of 54

7.2.2 Review of requirements related to the product: Veridiam performs reviews prior to the commitment to supply a product to the customer (e.g. acceptance of contracts or orders, acceptance of changes to contracts or orders) and ensures that: a. product requirements are defined and documented, b. contract or order requirements differing from those previously expressed are resolved, c. the organization has the ability to meet the defined requirements, d. special requirements of the product are determined, and e. risks (e.g., new technology, short delivery time scale) have been identified and evaluated. 7.2.3 Where the customer provides no documented statement of requirement, the customer requirements are confirmed by Veridiam before acceptance. 7.2.4 Where product requirements are changed, Veridiam ensures that relevant documents are amended and that relevant personnel are made aware of the changed requirements. 7.2.4.1 Records of the results of the review and actions arising from the review are documented and maintained. NOTE: In some situations such as Internet sales, a formal review is impractical for each order. The review may cover relevant product information such as catalogs or advertising material. Page: 25 of 54

7.2.5 Customer Communication and Satisfaction: Veridiam determines and implements effective arrangements for communicating with customers. These activities include: a product information, b inquiries, contracts or order handling, including amendments, c customer feedback, including customer complaints, and d. advisory notices. 7.2.6 As one of the measurements of the performance of the Quality management system, the organization monitors and reports information relating to customer perception as to whether Veridiam has met customer requirements, and has taken appropriate actions. 7.3 Design and Development This section is excluded as Veridiam neither designs nor develops products as defined in International Standards or customer requirements. All product manufactured by Veridiam is to customer design and specifications. 7.4 Purchasing 7.4.1 Purchasing process: Veridiam has established documented procedures to ensure that purchased product conform to specified purchase requirements. The type and extent of control applied to the supplier and the purchased product is dependant upon the effect of the purchased product on subsequent product realization or the final product. Supplier controls include: a. evaluation and selection of suppliers in accordance with their ability to supply product or meet requirements. In some cases, suppliers must meet specific quality management system requirements, b. criteria for selection, evaluation and re-evaluation of suppliers is established in documented procedures. c. the maintenance of an Approved Supplier List (ASL) that includes approval status and the scope of the approval (typically by commodity or service), Page: 26 of 54

d. the periodic review of supplier performance. The results of these reviews are used as a basis for establishing the levels of control needed to ensure conformity to product or service requirements, e. necessary actions to be taken when dealing with suppliers who do not meet requirements is defined, f. when required, Veridiam and its suppliers use customerapproved special process sources, g. the process, responsibilities and authority for supplier evaluation and approval, changes of approval, and the status and conditions for controlled use of suppliers is defined, h. the risk and mitigation actions for use of suppliers are determined, and i. records of the results of supplier selection and evaluation are documented as well as any necessary actions arising from the evaluations. j. when the item being purchased has been identified as nuclear safety-related, the suppler selected must have a current ASL listing as nuclear safety-related or an approved commercial grade dedication process shall be used. NOTE 1: Veridiam is responsible for the conformity of all products purchased from suppliers, including product from sources directed by the customer. NOTE 2: One factor that can be used during supplier selection and evaluation is supplier quality data obtained from objective and reliable external sources (such as an accredited quality management system, certification bodies or government or customer approvals). Use of this data represents one component of Veridiam s supplier control process. The organization remains responsible for the verification of purchased product to ensure that it meets specified purchase requirements 7.4.2 Purchasing information: purchasing information describes the product or service to be purchased, including where appropriate: Page: 27 of 54

a. requirements for approval of product, procedures, processes and equipment, b. requirements for qualification of personnel, c. quality management system requirements, d. the identification and revision status of specifications, drawings, process requirements, inspection/verification instructions and other relevant data, e. requirements for test, inspection, verification (including production process verification), f. use of statistical techniques for product acceptance, related instructions for acceptance by the organization and applicable critical items including key characteristics, g. requirements for test specimens for inspection/verification, investigation or auditing, h. requirements for the need of the supplier to: notify Veridiam of nonconforming product, obtain approval of nonconforming product disposition notify Veridiam of organizational changes such as product/process changes, changes of suppliers, changes of manufacturing facility move, and flow down to the supply chain applicable requirements including customer requirements, i. record retention requirements, and j. the right of access by Veridiam, its customers and regulatory agencies to applicable areas of all facilities, at any level of the supply chain involved in the order and to all applicable records. 7.4.3 Verification of purchased product: Veridiam has established and implemented systems for inspection and/or other activities necessary to ensure that product meets specified requirements These systems include as applicable: a. obtaining objective evidence of the quality of the material from suppliers (e.g., accompanying documentation, certification of conformity, test reports, statistical records, process control data), b. inspection and/or audit at supplier's premises, c. review of the required documentation, d. inspection of materials upon receipt, Page: 28 of 54

e. delegation of verification to the supplier, or supplier certification, f. purchased material is not used or processed until it has been verified as conforming to specified requirements unless it is conditionally released under positive recall procedures, g. where Veridiam utilizes test reports to verify purchased material, the data in those reports is acceptable per applicable specifications. Veridiam periodically validates test reports for raw material, h. where Veridiam delegates verification activities to a supplier, the requirements for delegation are defined and a register of delegations maintained, i. where Veridiam or its customer intends to perform verification at the supplier's premises, Veridiam states the intended verification arrangements and method of product release in the purchasing information, j. where specified in the contract, the customer or the customer's representative is afforded the right to verify at the supplier's premises and Veridiam s premises that subcontracted product conforms to specified requirements, k. verification by the customer is not used by Veridiam as evidence of effective control of quality by the supplier and does not absolve Veridiam or the supplier of the responsibility to provide acceptable product, nor does it preclude subsequent rejection by the customer, l. where purchased product is released for production use pending completion of all required verification activities, the product is identified and recorded to allow recall and replacement if the product is later found nonconforming, and m. records of all verification activities are maintained. 7.4.4 Veridiam ensures the adequacy of specified purchase requirements prior to their communication to the supplier. 7.4.5 To the extent required for traceability, Veridiam maintains relevant purchasing information and records. Page: 29 of 54

7.5 Production Provision 7.5.1 Control of production provision: Veridiam plans and carries out production provision under controlled conditions. Processes are performed under controlled conditions, so that quality is achieved and maintained by those responsible for performing work. Controlled conditions include, as applicable: a. the availability of information that describes the characteristics of the product, b. the availability of documented procedures, documented requirements, written work instructions and reference materials and reference measurement procedures as necessary, c. the use of approved processes, equipment, tools, programs, and materials, d. the availability of monitoring and measuring devices or equipment, e. the implementation of monitoring and measurement plans, f. the implementation of product release, delivery and postdelivery activities, g. the implementation of defined operations for labeling and packaging, h. accountability for all product during manufacture (e.g., parts quantities, split orders, nonconforming product), i. evidence that all fabrication and inspection operations have been completed as planned or as otherwise documented and authorized, j. provision for the prevention, detection, and removal of foreign material, k. monitoring and control of utilities and supplies such as water, compressed air, electricity and chemical products to the extent they affect product quality, l. criteria for workmanship, which shall be stipulated in the clearest practical manner (e.g., written standards, representative samples or illustrations), and m. assignment of fabrication and inspection duties to qualified individuals. Page: 30 of 54

7.5.1.1 Production Process Verification is handled as a first article inspection. First article inspections are repeated when changes occur that invalidate the original results including: a. engineering changes b. manufacturing process changes, and c. tooling changes. 7.5.1.2 Control of Manufacturing Process Changes are handled as follows: a. the organization identifies and obtains acceptance of changes that require customer and/or regulatory authority approval in accordance with contract or regulatory requirements, b. changes affecting processes, manufacturing equipment, tools and programs are documented. Procedures are available to control their implementation, c. Persons authorized to approve changes to manufacturing processes are identified, and d. the results of changes to manufacturing processes are assessed to confirm that the desired effect has been achieved without adverse effects to product quality. 7.5.1.3 Control of Manufacturing Equipment, Tools and Computer programs is handled as follows: a. validation prior to manufacturing use includes verification of the first article produced to the design data/specification, and b. manufacturing equipment, tools and programs is safeguarded from deterioration at all times, validated prior to use, and maintained and inspected periodically according to documented procedures. Page: 31 of 54

7.5.1.4 Post-Delivery Support: Installation, servicing and particular requirements for sterile medical devices per ISO 13485 are not applicable, as Veridiam does not produce product requiring installation, servicing or sterilization. Veridiam excludes section 7.5.1.4 for AS9100C. 7.5.1.5 The organization establishes and maintains a record for each batch of medical devices that provides traceability and identifies the amount manufactured and amount approved for distribution. Batch or lot records are verified and approved. A batch can be a single medical device. 7.5.1.6 Control of Production specific requirements for cleanliness and contamination control--veridiam establishes documented requirements for cleanliness of product if: a. product is cleaned by the organization prior to sterilization and/or its use, or, b. product is supplied non-sterile to be subjected to a cleaning process prior to sterilization and/or its use, or, c. product is supplied to be used non-sterile and its cleanliness is of significance in use, or, d. process agents are to be removed from product during manufacture 7.5.2 Validation of processes for production: Veridiam validates processes for production where the resulting output cannot be verified through subsequent monitoring and measurement, and as a consequence, deficiencies become apparent only after the product is in use. These processes are often referred to as special processes. Validation demonstrates the ability of these processes to achieve planned results by: Page: 32 of 54

a. defined criteria for review and approval of processes, b. approval of equipment and qualification of personnel, c. use of specified methods and procedures, d. requirements for records, and e. revalidation as needed. 7.5.3 Identification and Traceability: As appropriate, the organization identifies product status by suitable methods throughout product realization. The organization has established procedures for product identification that includes: a. travelers, tags or other documents are maintained to ensure product status through manufacture, inspection and other measuring and monitoring activities, b. status identification of product is maintained throughout product realization and storage of the product to ensure that only product that has passed the required inspections and test (or released under an authorized concession) is dispatched and used, c. controls for the identification is maintained throughout the product life, d. the establishment of documented procedures to ensure that medical devices and other products returned to Veridiam are identified and distinguished from conforming product, e. the establishment of documented procedures for traceability. Such procedures define the extent of product traceability and the records required, f. for a given product, a sequential record of its manufacturing is retrievable, g. for an assembly, the identity of its components and those of the next higher assembly to be traced, h. provisions for the recording of the unique identification of the product including heat lot and other lot numbers, and i. identify the amount manufactured and approved for distribution or sale. NOTE: Configuration management at Veridiam is a means by which identification and traceability can be maintained. Page: 33 of 54

7.5.3.1 Particular requirements for active implantable medical devices and implantable medical devices are: a. in defining the records required for traceability, Veridiam includes records of all components, materials and work environment conditions, if these could cause the medical device not to satisfy its specified requirements, and b. requirements in ISO 13485 pertaining to agents and distributors and consignees do not apply, as Veridiam does not have agents, distributors or consignees for implantable medical devices. 7.5.4 Customer property: Veridiam exercises care with customer property while it is under the organization s control or being used by the organization. Veridiam: a. identifies, verifies, protects and safeguards customer property provided for use or incorporation into the product. b. if any customer property is lost, damaged or otherwise found to be unsuitable for use, the organization reports the conditions to the customer, and records are maintained. NOTE: Customer property can include intellectual property and personal data. 7.5.5 Preservation of product: Veridiam has controls in place to ensure that product is preserved during internal processing and delivery to the intended destination in order to maintain conformity to requirements. As applicable, preservation includes: a. identification, cleaning, handling, packaging, storage and protection. Preservation also applies to the constituent parts of a product, b. controls for the prevention, detection and removal of foreign objects, c. special handling of sensitive products, d. marking and labeling including safety warnings, Page: 34 of 54

e. documented procedures or documented work instructions for the control of product with a limited shelf life or requiring special storage conditions. Such special storage conditions also include stock rotation, f. where applicable, special handling for sensitive products and hazardous materials, and g. where applicable, special handling tools and equipment (e.g. lifting equipment) are utilized and controlled where necessary to ensure safe and adequate handling. This tooling and equipment is inspected and tested periodically or prior to use as necessary to ensure satisfactory performance. Page: 35 of 54

7.6 Control of Monitoring and Measuring Devices 7.6.1 The organization determines the monitoring and measurement to be undertaken and the monitoring and measuring devices needed to provide evidence of conformity of product to determined requirements. 7.6.2 Documented procedures establish controls for monitoring and measurement to ensure that such activities are carried out in a manner that is consistent with the monitoring and measurement requirements. 7.6.3 Where necessary to ensure valid results, measuring equipment is: a. calibrated or verified (or both) at specific intervals, whenever the accuracy of the equipment is suspect, or prior to use against measurement standards traceable to international or national measurement standards. Where no such standards exist, the basis used for calibration or verification is recorded, b. adjusted or re-adjusted as necessary, c. has unique identification in order to determine its calibration status, d. is safeguarded from adjustments that would invalidate the measurement result, e. protected from damage and deterioration during handling, maintenance and storage, f. registered in a system for controlling monitoring and measurement devices, and g. has assigned specific requirements for calibration, including details of equipment type, unique identification, location, frequency of checks, check method and acceptance criteria, 7.6.4 Veridiam assesses and records the validity of the previous measuring results when the equipment is found not to conform to requirements. The organization takes appropriate action for the equipment and any product affected. 7.6.5 A documented process is in place for the recall of monitoring and measuring equipment requiring calibration or verification. Page: 36 of 54