INTERNAL AUDIT QUALITY VERSION F

• Address & name of site

  Đồng Xoài

  434

  Thoại Sơn

  F5

  Hunex

• Assessement date

  Date

• Assessor name

• Production Leader name

• Is the production leader attended during assessment ?

  Yes

  No

• Names of the observers / referent

• Main people met at supplier side

• Main process steps assessed

• Process steps available in the factory

• Assessement type

  Select Internal audit ( done by Quality Auditor ) CAP Review ( done by Quality Auditor )

  • Internal audit ( done by Quality Auditor )
  • CAP Review ( done by Quality Auditor )

• Type of supplier

  A

  B

  C

  D

  E

• Supplier Status

  Opening Supplier

  Active Supplier

1. 1. Leadership of Quality -- The management creates the conditions for a self-improving system to delight sports users

• Level D

• The general management has defined a quality policy with clear axis, in a format adapted to the company.

• Axis of the quality policy are translated into concrete targets and measurable key performance indicators ("KPIs"), adapted to the stakes.

• The general management is responsible of quality: The general management (or a representative) is committed towards quality and is able to explain the organisation and main axis. General management gives adapted means to achieve the quality targets (e.g.: Human Resources).

• Minimum one skilled* person is responsible for the quality system and reports to the general management. *Skilled definition : > Academic or professional training AND/ OR experience in quality domain > Understand and explain the quality organisation > Explain the quality risks and stakes of the company

1. 1. Leadership of Quality -- The management creates the conditions for a self-improving system to delight sports users

• Level C

• Quality axis and targets are translated into concrete actions and measured by relevant KPIs adapted to the concerned level of the organisation.

• Quality policy, targets, axis and KPIs are communicated throughout the company. Quality KPIs are monitored in the company and are understood by employees in their scope of responsibilities. EXAMPLE : > Quality Axis: We want to improve customer delight > Quality target: We will reduce the customers returns : < 150 ppm > Quality Indicator (KPI) is return rate ("RPM") > Action : Each month we analyse RPM figures and Top 5 will be discussed with problem solving methodology

• A management review of the system is performed at least once a year to: 1. Determine and evaluate QMS's performance 2. Determine the need for change and improvement 3. Determine the suitability of the policies and the targets Frequency is respected by the company.

1.2. Internal quality management -- The supplier describes his way to manage internal quality

• Level D

• A Quality Management System is organized and formalized. It can be easily explained (e.g. standards, procedures, controls records) by people in charge of quality.

• Quality roles and responsibilities of the manager/responsible are defined and communicated (e.g. role sheet or job sheet or job description availables and known by relevant people).

• Roles and responsibilities of the quality manager/leader are defined including at least : - Management of quality routines - Management of QMS performances - Management of the corrective action plan ("CAP") - Management of control plan (supplier or Decathlon) - Skill management of the quality team (if any).

1.2. Internal quality management -- The supplier describes his way to manage internal quality

• Level C

• Procedure change management The company as identified the operational processes and who is responsible of the procedures/SOPs. A procedure review is regularly done by processes with person in charge of and with the quality manager. The review is done to evaluate the need of changes and improvement in order to adapt the documentation and the system to the risk and stakes. This review routine / frequency is defined and applied by the supplier.

• Internal quality assessment: Internal assessment are done to evaluate supplier compliance with the internal requirements describe in the QMS. Actions plans are formalized and set up accordingly to solve the gaps identified. Frequency of internal assessment is adapted to the stakes of company.

1.3. Document management -- The supplier ensure that technical documentation available on site is relevant and up to date

• Level D

• Quality documentation : Quality documentation is available on site (e.g. procedure, standard, control records). Documents are codified and have (at least) : - Name - Date of review - Version index

• For the operators, production line manager, chief of the line, ... an up to date version of the necessary documentation is available.

• Techinal documentation : The supplier's technical documents are consistent with Decathlon specifications : > Supplier's technical requirements are aligned with Decathlon TechPack. > Supplier's control plan is aligned with Decathlon control plan requirements. > Production SOP are aligned with Decathlon requirements (eg: DPR, DCS), if concerned.

1.3. Document management -- The supplier ensure that technical documentation available on site is relevant and up to date

• Level C

• A document management procedure to create, validate and communicate the documentation is implemented to ensure the follow-up and the update of the documentation available for the workers (printed or digitalized version).

1.4. Contract management -- The commitments between Decathlon and the supplier are clearly formalised

• Level D

• Document can be signed throught digital tools (DOCUSIGN, ...) approved by local legal team The documents to be checked on site are, at a minimum: > Decathlon RSL : [Q] PROC_020_W - Introduction RSL - Comment's page --> signature needed if comments mentionned - Scope Listing page --> Evaluate if the checked list is aligned with the supplier products scope and at minimum : > [Q] PROC_045_WW - M-RSL > [Q] PROC_046_WW - P-RSL > AFIRM document (only for textile and shoes) > ZDHC document (only for textile and shoes)

• - Signature page --> signature > [Q] TEMP_WW_042 - SVHC list -- > For one model code or [Q] TEMP_WW_069 - SVHC list for multiple model code --> list of all manufactured model must be linked to the declaration > General Terms of Delivery ("GTD") (applicable for tier 1 finished good suppliers or components delivered to Decathlon) > Manufacture and Supply Agreement ("MSA") and annexes (applicable for tier 1 finished good suppliers) > General Terms of Purchase (GTP) (applicable for tier 1 component suppliers) > TechPack > Code of Conduct > Master sample (mandatory to have physical signature) When applicable: > Subcontracting appendix (if applicable) > Raw materials certificate for specific legal claims on finished good (e.g. recycled, green, organic, bio, FSC, PEFC, etc.) > Traceability contract or SOP (to be check in advance with the concerned process) They are kept for a duration defined with Decathlon team.

1.4. Contract management -- The commitments between Decathlon and the supplier are clearly formalised

• Level C

• A management routine is implemented and respected to ensure updates and signatures of the concerned documentation.

• Deployment of the technical requirement to tier N suppliers. The supplier (tier 1) analyzes Decathlon's specifications (accessories, components, chemical products and semi-finished goods), translates them in its documentary system, completing them if necessary and communicates them to its own suppliers. e.g.: technicals sheets for: > accessories > components > chemicals > semi-finished products.

• The respect of tier 2 suppliers commitment can be assessed through: > A commitment certificate from tier 2 supplier. > Regular relevant tests reports of tier 2 supplier. > Relevant incoming controls of tier 1 supplier.

1.5. Product development capacity-- The supplier is mastering the product development process

• Level D

• The company has formalized and implemented a project development procedure to ensure the success of the projects.

• Product development is organized with ressources identified and adapted means.

• If this activity is OUTSOURCED : A formalize aggrement exist and at least one person in the company is in charge of the product development management.

1.5. Product development capacity-- The supplier is mastering the product development process

• Level C

• The company is equiped with dedicated Product development lab and team (prototyping, ...) : For both situations (INTERNAL or OUTSOURCED), Product development process is detailed and formalized. The product development procedure includes validation milestones which are defined, formalized and respected. As minimum : - OK legal - OK technical - OK industrial (or similar meaning)

• Product development project are conducted through adapted management tool (e.g.: Excel doc, IT integrated solution).

• The company has evidence of innovative developments: e.g.: - Patented process / products / materials / design - International or country innovative awards in the last two years

2.1. Skills management -- People have the right skills at each step of the process.

• Level D

• QUALITY skills ability There is an up to date list of trained and validated people for control activities (incoming, online, final and laboratory controls) and for quality management team, which includes: > Training date and validation status (e.g.: quiz, on site feedback formalized) > Trainer's name > Training content adapted to the topic

• Job sheet with necessary skills are defined for each quality teammate position.

• The quality manager is able to build and monitor quality competencies.

2.1. Skills management -- People have the right skills at each step of the process.

• Level C

• Job sheet with necessary skills are defined for each position in the company.

• PRODUCTION skills ability There is an up to date list of trained and validated people to perform the manufacturing operations, the maintenance and to monitor the production parameters.

• Training documents are available and up to date (including) > Training date and validation status (e.g.: quiz, on site feedback formalized) > Trainer's name > Training content adapted to the topic

• Formalisation of the training process There is a staff training procedure that specifies how, when and who to: > Train > Evaluate > Validate > Maintain competency over time

• The HR or team manager are able to build and monitor competencies.

3.1. Stock management and packaging (accessories, components, raw materials, semi-finished goods and finished products) -- The stock is accurate and well organised

• Level D

• ALL STORAGES (internal, outsourced and long term - like Make To Stock MTS) areas, including chemicals products and laboratory product storage, are: > Defined and organized > Clean > Identified > Respected. e.g. The supplier has defined storage areas by product, by reference and by status (OK/to control/NOK). They are clearly identified and respected all over the storage areas.

• If concerned for outsourced storage, a contract is formalized between the supplier and the storage service provider.

• Transportation and handling are adapted and secured to avoid cross contamination and/ or damage as per product specificity.

• If necessary (e.g.: Long term storage (MTS), food, medical device, chemicals), a policy of stocks rotation exist and is applied.

3.1. Stock management and packaging (accessories, components, raw materials, semi-finished goods and finished products) -- The stock is accurate and well organised

• Level C

• For all storage areas - Specific storage conditions are defined and applied (e.g.: temperature, humidity, stability control) Definition of the storage condition can be done according to: > Risk analysis > Storage DPR/DCS > Safety data sheet information > MTS requirements > Long term storage requirements

• Packaging are adapted to the risks linked to storage, handling and transportation.

• Supplier is able to give a reliable storage state of raw materials and products ready to ship. The informations reconciles between the theoretical stock and the physical stock. In case of differences, the supplier has a process in place to adjust the stock regularly.

3.2. Workstations -- Workstations are designed to create the best conditions to produce. The right informations are availables.

• Level D

• The supplier knows the key (critical & major) workstations based on critical and majors points identified for the product.

• For these Key workstations : > Method to make the products is known and applied by operators.

• > Standard Operational Procedures (SOP) are formalized and available, including what and how to do (e.g.: tools, chronology). If a Decathlon production requirements (DPR) is available, this is integrated into the SOP or available at the concerned workstation.

• > The workstation is organized and adapted to the operations (e.g.: clean, light)

• > Every specific equipment to a model / product (e.g.: die cutting tools, injections molds) is identified and can be linked to this model / product.

3.2. Workstations -- Workstations are designed to create the best conditions to produce. The right informations are availables.

• Level C

• For Key (critical & major) workstation: Key workstation are clearly identified in the workshop.

• For all workstations: > Method to make the products is known and applied by operators.

• > SOPs are formalized and available for each step, including what and how to do (e.g.: tools, chronology). If a Decathlon production requirements (DPR) is available, this is integrated into the SOP or available at the concerned workstation.

• > The workstation is organized and adapted to the operations (e.g.: clean, light)

• > Every specific equipment to a model / product (e.g.: die cutting tools, injections molds) is identified and can be linked to this model / product.

• > The supplier has identified, assessed and controlled parameters that may have an impact on the presence of hazardous substances (e.g. : temperature, time, cleaning equipments, cleanliness of the workstation)

3.3. Identification and traceability -- Be able everytime and everywhere to find our products in case of problem to protect users

• Level D

• Identification: At each stage of the production, raw materials (RM), components (CPT), semi finished or finished products(FG) are identified, at least, by name and reference.

• Traceability: 1- Supplier is able to link Decathlon purchase order to is own production order including at least : quantity, date & place of FG/CPT production 2- Supplier is able to link the production order to the FG/CPT batch number 3- The supplier is able to link the FG batch number to the defined* CPT/RM batch number with at least : quantity, date & place of CPT/RM production + other defined attributes** This traceability can be consolidated on site in less than 24 hours. Documents that prove the traceability of the defined* CPT/ RM (at minimum one of the following: invoice, certificate, delivery note) are archived during 6 years*** at least in order to comply with the general EU legal requirement. *Defined in one of the below: - TechPack or MSA (traceability annex) - Traceability contract/SOP defined by each industrial process. ** Attributes are defined in attribute's list by Decathlon for each industrial process, if available *** 6 years definition is link to EU regulation and starting point is after delivering to Decathlon

3.3. Identification and traceability -- Be able everytime and everywhere to find our products in case of problem to protect users

• Level C

• Traceability data Supplier are able to send traceability data**** through digitalized tools to Decathlon according to Decathlon's requirement. > For Finished Good : supplier must link each FG Purchase Order to the RFID and SHU numbers. > For Component/raw material : supplier must link the Decathlon Purchase Order of defined* CPT/RM to traceability data****

• The supplier tests his traceability system including documentation management at a defined frequency to ensure it works properly. Reports are available. **** traceability data = The minimum information defined at level D to C for each defined* components / raw material required for the finished good

3.4. Control plan: product and process parameters -- I master all the steps of the process through checks/controls and react in a proper way to produce every time the same compliant products

• Level E

• For supplier's control plan (Incoming / Online / Final control - Including Lab & Toxicology) The critical and majors* control, points & methods are defined, formalized, known and applied at each step of the process.

• Critical and majors controls are recorded and available. Archiving duration is defined according to product risk, product lifetime or contractual commitment.

• Controler is able to take a decision on product conformity (tools adapted and calibrated, targets and tolerances defined). Reaction mode is clearly defined & applied by the controler

• If a major or critical control deficiency is identified, there is, at a later stage in the process, a control which allows to detect and control the critical or major point missin, before the product is shipped to Decathlon. *Critical and major controls are defined by Decathlon in contractual documents (Tech Pack, DPRs) or by supplier in his control plan according to the risk analysis / experience/ quality history on products (risk examples: legal, image, safety, functional). > Critical: non-conformity that impacts user’s safety in reasonable use of the product or that represents a legal risk. > Major: non-conformity that impacts or forbid the sale, the use or the assembly of the product. IMPORTANT : E point is detected if a non-compliance is detected at a critical/major point and if there is no other subsequent, compliant control point, making it possible to detect the non-compliance relating to the faulty control point.

3.4. Control plan: product and process parameters -- I master all the steps of the process through checks/controls and react in a proper way to produce every time the same compliant products

• Level D

• For supplier's control plan: incoming / online / final control (including laboratory & toxicology) Control points & methods are defined, formalized, known and applied at each step of the process.

• Controls are recorded and available. Archiving duration is defined according to product risk, product lifetime or contractual commitment.

• Controler is able to take a decision on product conformity (tools, targets and tolerances) and reaction mode is clearly defined & applied

• Control methods and frequencies are consistent and updated with requirements defined in the TechPack, DPRs and/ or supplier's know how (see chapter 1.4. Contract Management).

3.4. Control plan: product and process parameters -- I master all the steps of the process through checks/controls and react in a proper way to produce every time the same compliant products

• Level C

• Based on experience, industrialisation, historical data and/ or risks analysis, the control plan is optimized on a regular basis. e.g.: control frequency is reviewed according to the performance analysis (main defects).

• Capitalization The controls plan is updated according to the identified risks on similar products (good practices generalisation) and based on history of controls.

3.5. Calibration of tools used for conformity inspection -- Calibrated tools gives you a relevant measure of your process / product.

• Level D

• Calibration and identification (I know my tool and its limits for incoming / online / final control and laboratory equipment) Tools in use have unique identification, including at least tool number and expiration date.

• Calibration of tool in use is up to date (calibration report and/or record available for each tool). When calibration is outdated or tool is damaged, the tool is clearly identified and isolated.

• Tool's tolerance is aligned to the measurement range specified.

• Internal calibration can be done if: > Person in charge knows the calibration methodology. > Tools used as calibration reference are externally calibrated by an accredited company.

3.5. Calibration of tools used for conformity inspection -- Calibrated tools gives you a relevant measure of your process / product.

• Level C

• Formalization There is a list of tools to be calibrated which mentions: > Tool identification number > Responsible for calibration (internal or external) > Tool tolerance > Date of calibration and date of validity.

• Calibration procedures are formalized, up to date, respected and applied. They define: > Person in charge of calibration > What tools to calibrate > When to calibrate > How to calibrate (for internal calibration).

3.6. Maintenance -- I maintain my equipments to ensure the ability to produce.

• Level D

• Know how In case of breakdown, production operator and maintenance operator know what to do and apply it. e.g. : person to inform, person responsible for maintenance operations, specific identification, isolation / machine stop.

• Ability and recording Pre operational controls are made to ensure the production start in good conditions.

• In case of maintenance intervention or machine replacement, only authorized person validates restart (stabilized process which guarantees product conformity).

• Curative maintenance interventions are recorded and available (date, type of maintenance, person in charge of the operation, person who has validated restart).

3.6. Maintenance -- I maintain my equipments to ensure the ability to produce.

• Level C

• Formalization and prevention Supplier formalizes and communicates in proximity of workstation, easily accessible for operators, actions to take in case of breakdown (specific identification, isolation/stop of the machine, recording, restart conditions).

  Select Internal audit ( done by Quality Auditor ) CAP Review ( done by Quality Auditor )

  • Internal audit ( done by Quality Auditor )
  • CAP Review ( done by Quality Auditor )

• There is a maintenance planning available (with frequency and operations to do) and an up to date state of the machines.

  Select Internal audit ( done by Quality Auditor ) CAP Review ( done by Quality Auditor )

  • Internal audit ( done by Quality Auditor )
  • CAP Review ( done by Quality Auditor )

• Preventive maintenance operations are recorded and available per machine (date, type of maintenance, person in charge of operation).

  Select Internal audit ( done by Quality Auditor ) CAP Review ( done by Quality Auditor )

  • Internal audit ( done by Quality Auditor )
  • CAP Review ( done by Quality Auditor )
3.7. Suppliers management -- Suppliers are managed to ensure the quality of my components and raw materials.

• Level D

• Referencing An up to date list of component, accessory and raw material suppliers is available.

• The approved suppliers are in coherence with Decathlon contractual documents signed (e.g.: BOM in the TechPack).

• In case of change of component/raw material supplier, Decathlon is informed before implementation if there is an impact on the specifications of the finish products.

3.7. Suppliers management -- Suppliers are managed to ensure the quality of my components and raw materials.

• Level C

• A new supplier's validation procedure is available and applied (e.g. new component validation / supplier evaluation)

• Performance management Internal quality indicators are defined and followed to monitor tier n suppliers [nominated or non-nominated by Decathlon] (e.g.: non conform product rate) and manage them accordingly (clear target, action plan, person in charge, deadline, actions efficiency follow-up).

• Chemical risk management Chemical screening RSL is filed and completed by the supplier. If any NOK RSL, supplier has implemented corrective action and chemicals testing to ensure compliance of the finished goods/ component / raw materials

• RSL requirements are communicated to all TIER N suppliers, with evidence of the acknowledgment (exception for finished good cosmetics & chemicals suppliers, requirement already covered by substances regulation and M/P-RSL of the tier 1).

3.8. ZDHC management -- Suppliers are managing chemicals to ensure compliance regarding ZDHC requirements

• Level D

• Supplier has an account on the GATEWAY and is connected with DECATHLON account.

• Supplier has a formalized chemical procurement policy to ensure MRSL conformance (ZDHC Level 1 at minimum)

• For Component suppliers ONLY : Supplier uploads his INCHECK Report (Chemical Inventory) on the GATEWAY at minimum QUARTERLY (by using an approved ZDHC solution provider such as : BHIVE App)

3.8. ZDHC management -- Suppliers are managing chemicals to ensure compliance regarding ZDHC requirements

• Level C

• The supplier has implemented a proactive policy to identified, replace or remove non-conform chemicals through a formalize roadmap. Pro-active policy : analysis of the chemicals present in the factory. Evaluation of the conformance regarding ZDHC MRSL. prioritization for replacement or removal

• For Component suppliers ONLY : Supplier works constantly on his chemicals conformance (INCHECK Report results) to improve performance towards Decathlon ZDHC MRSL

4.1. Management of non conform products -- I master any non conformity to protect our users.

• Level E

• At each critical and major control point, reaction mode in case of non conform products is known and applied with at least: > A clear identification, different from the one for a conform product.

• > A physical isolation with clear boundaries or digital blocking in an identified and dedicated area.

• > In case of rework: reworked products are 100% rechecked.

4.1. Management of non conform products -- I master any non conformity to protect our users.

• Level D

• There is a procedure defined and applied to manage nonconform product in the factory and to protect the users including: > Detection and isolation > Actions to address the defects (rework or destruction) > Inform Decathlon when product is different from TeckPack and/or master sample. > Derogation procedure : exemption forms are available, signed by supplier and Decathlon, limited in time and quantity defined with appropriate Corrective Actions Plan.

• There is at least one person responsible and trained for the management of non conformity.

4.1. Management of non conform products -- I master any non conformity to protect our users.

• Level C

• Supplier monitors its non conform products performance through relevant KPIs with clear target (e.g.: defect rate, right first time rate).

• At each control step, he is able to provide non conforms rates.

• Conformity rate is monitored at a relevant frequency (e.g.: pareto, top 3). When needed, actions, dead line and responsible peoples are defined.

• There is a capitalization system in place to avoid recurrence of non conformances (creation/update of procedures, standards, control plans). People involved in the problems solving are trained to the methodology.