(Office of Inspector General, Transportation)

https://www.oig.dot.gov/library-item/38302

"While FAA and Boeing followed the established certification process for the
737 MAX 8, we identified limitations in FAA's guidance and processes that
impacted certification and led to a significant misunderstanding of the
Maneuvering Characteristics Augmentation System (MCAS), the flight control
software identified as contributing to the two accidents. First, FAA's
certification guidance does not adequately address integrating new
technologies into existing aircraft models. Second, FAA did not have a
complete understanding of Boeing's safety assessments performed on MCAS
until after the first accident. Communication gaps further hindered the
effectiveness of the certification process. In addition, management and
oversight weaknesses limit FAA's ability to assess and mitigate risks with
the Boeing ODA. For example, FAA has not yet implemented a risk-based
approach to ODA oversight, and engineers in FAA's Boeing oversight office
continue to face challenges in balancing certification and oversight
responsibilities. Moreover, the Boeing ODA process and structure do not
ensure ODA personnel are adequately independent. While the Agency has taken
steps to develop a risk-based oversight model and address concerns of undue
pressure at the Boeing ODA, it is not clear that FAA's current oversight
structure and processes can effectively identify future high-risk safety
concerns at the ODA."

ODA == Organization Designation Authorization is the FAA designation for
delegated certification authority of 737-MAX certifications to Boeing.  See
page 29 of this report for percent of delegation for certified flight
systems on the 737-MAX: Boeing performed ~30% certifications
(self-certifications) in JAN2014 to ~100% by JAN2017.

The OIG's report raises troubling questions about self-certification of
737-MAX flight systems by Boeing. Government delegation of certification
authority to industry indicates policy review is essential, and revisions to
delegation practices, are urgently required.

Risk: Self-certification authority without independent enforcement oversight