aeo guide to authorisation - transport for nsw...sp v1.0, 08/05/2017 aeo guide to authorisation t mu...

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017

AEO Guide to Authorisation

T MU MD 00008 GU

Guide

Version 2.0

Issued Date: 01 December 2014

Effective Date: 05 January 2015

Important Warning This document is one of a set of standards developed solely and specifically for use on the rail network owned or managed by the NSW Government and its agencies. It is not suitable for any other purpose. You must not use or adapt it or rely upon it in any way unless you are authorised in writing to do so by a relevant NSW Government agency. If this document forms part of a contract with, or is a condition of approval by, a NSW Government agency, use of the document is subject to the terms of the contract or approval. This document may not be current. Current standards are available for download from the Asset Standards Authority website at www.asa.transport.nsw.gov.au. © State of NSW through Transport for NSW

T MU MD 00008 GU AEO Guide to Authorisation

Version 2.0 Effective Date: 05 January 2015

© State of NSW through Transport for NSW S

uper

sede

d by

T M

U M

D 0

0009

SP

v1.

0, 0

8/05

/201

7

Standard governance

Owner: Manager Authorisation, Asset Standards Authority

Authoriser: Principal Manager Authorisation and Audit, Asset Standards Authority

Approver: Director, Asset Standards Authority on behalf of ASA Configuration Control Board

Document history

Version Summary of change

1.0 First issue under standard number TS 10501

2.0 Second issue

For queries regarding this document, please email the ASA at

[email protected]

or visit www.asa.transport.nsw.gov.au



© State of NSW through Transport for NSW of 15

Preface

The Asset Standards Authority (ASA) is an independent unit within Transport for NSW (TfNSW)

and is the network design and standards authority for defined NSW transport assets.

The ASA is responsible for developing engineering governance frameworks to support industry

delivery in the assurance of design, safety, integrity, construction, and commissioning of

transport assets for the whole asset life cycle. In order to achieve this, the ASA effectively

discharges obligations as the authority for various technical, process, and planning matters

across the asset life cycle.

The ASA collaborates with industry using stakeholder engagement activities to assist in

achieving its mission. These activities help align the ASA to broader government expectations of

making it clearer, simpler, and more attractive to do business within the NSW transport industry,

allowing the supply chain to deliver safe, efficient, and competent transport services.

The ASA develops, maintains, controls, and publishes a suite of standards and other

documentation for transport assets of TfNSW. Further, the ASA ensures that these standards

are performance-based to create opportunities for innovation and improve access to a broader

competitive supply chain.

A principle function of the ASA is to set, maintain and administer the framework for assessment,

authorisation, surveillance, review and audit of organisations that provide engineering services

in relation to the asset life cycle of NSW transport assets.

This guide forms part of a suite of documents that describe the TfNSW management of

engineering authority and assurance for rail assets. The authorisation framework is described in

T MU MD 00007 ST AEO Authorisation Governance Framework, and requirements for

Authorised Engineering Organisations are defined in T MU MD 00009 ST AEO Authorisation

Requirements.

This is the second issue of this document. The changes to previous content include the

following:

removal of AEO quick reference assessment

addition of asset life cycle definition

update of authorisation process description

change number from TS 10501 to T MU MD 00008 GU

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




Table of contents

1. Introduction............................................................................................................................................5

2. Purpose...................................................................................................................................................5 2.1. Scope ..................................................................................................................................................................... 5 2.2. Application............................................................................................................................................................. 5

3. Reference documents ...........................................................................................................................5

4. Terms and definitions ...........................................................................................................................6

5. What is authorisation? ..........................................................................................................................7

6. Scope of authorisation..........................................................................................................................7

7. Supplier classification (maturity rating)..............................................................................................8

8. Authorisation process...........................................................................................................................9 8.1. Obtaining authorisation........................................................................................................................................ 9 8.2. Maintaining authorisation................................................................................................................................... 11 8.3. Withdrawal of authorisation ............................................................................................................................... 13

9. Authorisation records .........................................................................................................................14 9.1. AEO application form.......................................................................................................................................... 14 9.2. AEO letter of authorisation................................................................................................................................. 14 9.3. Self-assessment checklist.................................................................................................................................. 15 9.4. Assessment or audit plan................................................................................................................................... 15 9.5. Assessment and audit checklists ...................................................................................................................... 15 9.6. Assessment and audit report ............................................................................................................................. 15 9.7. Assessment or audit evidence........................................................................................................................... 15 9.8. Records management......................................................................................................................................... 15

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




1. Introduction

Transport for New South Wales (TfNSW) is collaborating with industry to improve the

engineering governance of TfNSW asset related projects and to use skilled resources from both

government and industry more effectively. A key initiative is authorisation of engineering

organisations to take responsibility, on behalf of TfNSW, for assuring their engineering services

or products.

2. Purpose

This AEO Guide to Authorisation provides guidance to engineering organisations on the

process of assessment and authorisation to become an authorised engineering organisation

(AEO) to TfNSW, and provides guidance to existing AEOs who are subject to ongoing

surveillance audits.

2.1. Scope

This document includes guidance on the authorisation and surveillance processes along with

the associated deliverables needed from suppliers of engineering services who wish to obtain

AEO status.

This guide is not a requirements document. Requirements for AEOs are defined in

T MU MD 00009 ST AEO Authorisation Requirements.

2.2. Application

This guide is to be used by organisations that intend to provide engineering services to TfNSW

as well as organisations that have gained AEO status.

This guide is also designed to inform TfNSW personnel of the authorisation processes.

3. Reference documents

International standards

ISO 9001: 2008 Quality Management System

TfNSW standards

T MU MD 00007 ST AEO Authorisation Governance Framework

T MU MD 00009 ST AEO Authorisation Requirements

T MU MD 00009 F1 AEO Engineering Services Scoping Matrix Template

TS 10511 AEO Self Assessment Checklist

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




4. Terms and definitions

The following terms and definitions apply in this document:

accountable the obligation of an individual or organisation to account for its activities, accept

responsibility for them, and to disclose the results in a transparent manner. The job role that is

ultimately responsible for the engineering service. Accountability cannot be delegated

accountable person the person who is accountable for the activity

AEO Authorised Engineering Organisation

applicant an organisation that has applied to the ASA for consideration for AEO status

ASA Asset Standards Authority

asset life cycle the stages involved in the management of the asset

assurance a positive declaration intended to give confidence

auditor the ASA representative that performs ongoing surveillance audits of the AEO

authorisation the conferring of authority, by means of an official instruction and supported by

assessment and audit, to a supplier, to self-perform assurance of its competence and systems

to provide services

authorised engineering organisation a supplier of a defined engineering service or product

that has been assessed and granted AEO status by TfNSW

compliance the state or fact of according with, or meeting, rules, requirements or standards

conformance compliance with a requirement, standard or procedure

corrective action an action placed by the ASA on an AEO as a result of a non-conformance to

implement improvements to its system, processes or procedures to achieve conformance

facilitator the ASA representative that performs the initial assessment of the supplier

framework a basic structure underlying a system, concept, or text

governance the rules, processes, or laws by which the authorisation framework is operated,

regulated, and controlled. The exercise of authority and control between the accountable and

responsible entities within TfNSW and the AEOs such that planned outcomes are achieved.

non-compliance not having the ability to operate in accordance with the AEO authorisation

requirements

non-conformance non-fulfilment of a requirement

responsible a duty or obligation to satisfactorily perform or complete a task (assigned by

someone, or created by one's own promise or circumstances) that one must fulfil. The job role

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




that is responsible for producing the service or product but not ultimately accountable.

Responsibility can be delegated.

review a method to provide assurance by a competent person that an engineering output

complies with relevant standards and specific requirements, is safe, and fit for purpose

TfNSW Transport for New South Wales

5. What is authorisation?

Authorisation is a process of evaluating a supplier's engineering product and or assurance

arrangements with the objective of granting that supplier AEO status.

An assessment by the ASA determines if a supplier organisation can demonstrate the

competence and capability necessary to deliver engineering services for NSW transport

infrastructure and assets, and to provide assurance that it performs those services at the

necessary level of capability.

Initial granting of AEO status is followed by periodic surveillance of the engineering services

provided by an authorised organisation. The initial level of surveillance is based on the risk

identified in the assessment. This will be adjusted depending upon further risks and issues

identified as part of service delivery.

The process is a risk-based assurance approach between TfNSW and its suppliers that builds

on increased self assurance and continual improvement by the suppliers. This allows the ASA

to ensure that surveillance levels remain appropriate to the level of demonstrated self assurance

by the AEO, along with the associated risk. As the assessed risk level reduces and confidence

in the supplier increases, the frequency and depth of surveillance will reduce.

A supplier that plans to provide engineering services that affect TfNSW rail operations or the

integrity of its assets over the asset life cycle will need to provide evidence to the ASA of its

capability to provide and assure those engineering services.

6. Scope of authorisation

Authorisation can be granted for a range of engineering services over the full asset life cycle.

These can be specific to a particular stage of the asset life cycle, or multi-stage services such

as systems engineering. Types of engineering services include, but are not necessarily limited

to, the following areas:

design

manufacturing and fabrication

construction and installation

inspection, testing and commissioning

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




asset maintenance and management

decommissioning and disposal

engineering assurance

specialist engineering or technical consultancy

whole of life cycle systems engineering, integration and asset management

engineering training and assessment

The ASA will require evidence from the AEO of its service supply chain assurance management

arrangements, but, as part of this, does not intend to carry out assessment or surveillance on

AEO sub-contracted suppliers. This does not absolve an organisation from supply chain

assurance obligations managed under normal procurement and project commercial

management arrangements defined in its TfNSW contracts.

7. Supplier classification (maturity rating)

The ASA undertakes initial assessment and subsequent surveillance activities to classify

engineering organisations according to the level of confidence that the ASA has in the

organisation's ability to provide sufficient and measurable assurance of its engineering services.

Classification maturity rating levels range from a rating of one, which demonstrate no evidence

of control through; to a maturity rating of five, which demonstrate evidence of full control

(including certification to ISO 9001) and continuous improvement.

The classification level determines the frequency of surveillance audits. An organisation that

demonstrates a high level of certification and compliance to appropriate standards will have a

less frequent surveillance period than an organisation that does not demonstrate certification.

For example; averaged four and five classifications will lead to a surveillance audit frequency of

once every three years, while a maturity rating of three would require an audit frequency of two

years, and a maturity rating of two would require an audit frequency of once a year.

Note: A minimum maturity rating of two is required for AEO authorisation to be

granted.

Surveillance frequency may increase due to unusual events such as an organisation's

introduction of new technology, significant organisation changes, new working methods, a

serious non-conformance or incident, risk profile of the organisation or its contracted works.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




8. Authorisation process

The authorisation process can be summarised into two distinct phases:

assessment for obtaining AEO status

surveillance for maintaining AEO status

When an AEO undergoes a material change, further assessment and audit may be required.

These material changes may include, but are not necessarily limited to the following:

changes to AEO ownership

changes to scope and type of engineering services offered

changes to AEO organisation, including roles, responsibilities and reporting lines

changes to AEO engineering plans, processes and procedures

8.1. Obtaining authorisation

An organisation gains AEO status through an assessment.

During this assessment, the ASA assesses completeness and effectiveness of the systems that

support the engineering services the applicant intends to provide to TfNSW.

The assessment is based on how an applicant organisation deploys the core engineering

management requirements, to all relevant engineering management requirements either on a

project, or as ongoing maintenance of transport assets.

Assessment applications can be made for the following:

new applications from suppliers wishing to become AEOs for the first time

renewal applications after expiry or withdrawal of AEO status

change applications to add, remove or change service areas and disciplines

The assessment phase consists of three key steps:

initial contact between the supplier and the ASA facilitator

preparation for authorisation assessment, including scoping and provision of evidence

authorisation assessment of system documents and evidence of their actual deployment in

delivering declared engineering services

Successful completion of the assessment phase leads to an AEO letter of authorisation. Refer

to Section 9.2.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




8.1.1. Initial engagement

An applicant organisation initiates the assessment process by contacting the ASA through the

contacts available on ASA website, and requesting to be authorised to provide engineering

services.

The ASA assigns a facilitator to guide the applicant through the assessment process. The

facilitator arranges an initial meeting where the AEO process is explained in detail.

The applicant completes a 'self-assessment checklist' and an 'engineering scoping matrix'.

TS 10511 AEO Self Assessment Checklist requires the applicant to rate itself against every

AEO requirement and also list supporting evidence and rationale for the rating.

T MU MD 00009 F1 AEO Engineering Services Scoping Matrix Template allows the applicant to

specify the engineering services it is intending to provide to TfNSW.

The facilitator guides the applicant through the process and determines whether they actually

need to become an AEO or not. If the decision is to proceed with AEO authorisation, the

applicant and the ASA facilitator will meet to commence planning for scoping and assessment.

8.1.2. Scoping meeting

The ASA facilitator meets with the applicant to clarify and confirm the scope of engineering

services to be offered, the scope of the assessment, and the required evidence collected so far

and to be presented. The supplier's representative at this meeting should be a person of

sufficient authority to represent the supplier organisation on all authorisation matters.

8.1.3. Preparing for the assessment

Following the scoping meeting, the applicant will review a detailed self-assessment checklist to

confirm the state of readiness of the applicant to proceed to the full assessment. This checklist

is identical to the assessment checklist and is available on the ASA website.

If the applicant organisation is confident that it is ready to proceed with the assessment, it may

gather the remaining evidence required for the agreed scope of assessment, and submit this

material to the ASA for evidence validation prior to the assessment. The evidence required for

an assessment includes both system documentation as well as exemplar evidence of its actual

prior deployment as part of the applicant's service.

The preparation period will depend on the range of engineering services offered, scope of

authorisation requested and ability of the applicant to prepare. During the preparation period,

the applicant may seek assistance or advice from the ASA facilitator.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




8.1.4. Conducting the assessment

The ASA facilitator, supported by subject matter experts drawn from the ASA, will conduct the

assessment. If the size and organisational complexity of the applicant seeking is such that a

single assessment is impractical, then the assessment may be divided into specific engineering

service areas and disciplines.

The ASA facilitator will collate the supporting evidence and score the assessment checklist. The

facilitator may raise clarification queries to the applicant to assist the assessment.

The facilitator will prepare a draft summary report of assessment activities and evidence

evaluated, along with a draft letter of authorisation with any actions required of the applicant.

The draft summary assessment report is circulated to relevant ASA assessment staff, including

subject matter experts where necessary, for peer review.

After the report is reviewed internally within ASA, it is discussed with the applicant in order to

agree on the required corrective or improvement actions if necessary.

Where the assessment identifies results in partial or full non-compliance against AEO

authorisation requirements – this does not necessarily lead to an outright denial of authorisation

of the supplier, but may place conditions on the AEO status if ASA agrees that identified

non-compliance is not of high risk and could be eliminated within the reasonable period of time

through the agreed actions. The facilitator will discuss, agree and record any actions the

applicant needs to perform to achieve compliance.

8.1.5. Issue authorisation letter

After the facilitator is satisfied with the assessment, a final AEO letter of authorisation, AEO

certificate, signed and approved AEO assessment summary report and signed engineering

scoping matrix will be sent to the applicant. This documents pack defines authorised

engineering service areas and disciplines, any caveat conditions on the authorisation, and any

required corrective actions. The documents are normally signed by the Director ASA.

The ASA will request an applicant to provide a corrective action plan to address any findings.

The applicant may consult with the ASA on the nature of these actions.

8.2. Maintaining authorisation

An AEO maintains its authorisation status and classification through ongoing surveillance by the

ASA.

The 'surveillance' phase is performed through on-going surveillance audits of an AEO activities

and outputs. During this phase, the ASA will assess samples of AEO assurance evidence, and

will continue to monitor systems, processes, procedures, tools and deliverables by means of

audits. Agreed corrective and improvement actions follow-up is also part of the surveillance.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




The initial frequency of surveillance audits is based on the level of risk associated with the

AEO's capability maturity that was assessed during the authorisation phase and the results of

ad-hoc audits triggered by an incident, risk or non-conformance raised by a TfNSW stakeholder.

The output of this ongoing surveillance is used to adjust classification levels, and therefore the

frequency, depth and focus of subsequent surveillance audits.

8.2.1. Planning surveillance audits

The ASA auditor will prepare a program for ongoing surveillance audits, based on:

maturity levels and corrective actions from the initial assessment

previous surveillance audits findings

scope of services and disciplines offered by the AEO

risks associated with the particular AEO services, especially safety risks

availability of ASA subject matter experts to support the surveillance audits

The auditor will communicate this program to the AEO, and will develop a plan for each

surveillance audit to be carried out.

8.2.2. Conducting the surveillance

The ASA will conduct surveillance (including audit) of the AEO systems, tools, processes,

deliverables, and progress of any corrective actions, in accordance with the surveillance audit

plan.

The surveillance audit will focus on areas where prior 'opportunities for improvement' and 'areas

of concern' have been raised and corrective actions initiated, but may cover the full range of

authorisation requirements. The ASA compares the results of the surveillance audit with those

obtained during the AEO authorisation assessment to determine changes in classification

levels.

The auditor may interview the AEO representative in order to clarify details in the evidence.

Where an opportunity for improvement or an area of concern is detected, the auditor will

discuss, agree and record corrective actions the AEO needs to perform to achieve compliance.

These actions may not necessarily lead to withdrawal of AEO status, but may place conditions

for improvement on the AEO status.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




8.2.3. Updating AEO authorisation status

Outputs from the ongoing surveillance of the AEO systems, processes and deliverables are

used to confirm an organisation's AEO status and associated conditions, and issue an updated

letter of authorisation. The ASA auditor updates the AEO register and includes any changes to

maturity levels, caveat conditions and corrective actions.

8.3. Withdrawal of authorisation

AEO status may be either partially or completely withdrawn under the following conditions:

serious non-conformance affecting potential safety or integrity of TfNSW assets

serious incident affecting TfNSW staff, contractor, passenger or general public safety

at the voluntary request of the AEO due to withdrawal of engineering services or

organisational change

The first two conditions would normally be reported to the ASA by means of existing TfNSW

contracting arrangements with the AEO.

8.3.1. Serious incident or serious non-conformance actions

In the event of a serious non-conformance or incident that raises an area of concern, the ASA

may conduct an extraordinary audit of the AEO's engineering management and assurance

arrangements, focusing on areas that could be the root cause of the incident or non-

conformance. The ASA will consult with the AEO and any affected TfNSW stakeholders on the

audit findings to determine the appropriate actions. Actions can include the following:

require corrective actions with defined implementation timescales

require immediate corrective action

withdraw selected engineering service areas or disciplines from the AEO status

withdraw the entire AEO status pending successful completion of appropriate corrective

actions

withdraw the entire AEO status on a permanent basis

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




9. Authorisation records

The following suite of documents form part of the authorisation records:

AEO application form

AEO letter of authorisation

self-assessment checklist

assessment or audit plan

assessment and audit checklists

assessment and audit report

assessment or audit evidence

records management

9.1. AEO application form

The AEO application form provides the ASA with information about the supplier organisation

and the scope of relevant engineering services it intends to offer.

The authorisation application form becomes the first record associated with the AEO

authorisation process.

The AEO application form is available through the ASA facilitator.

9.2. AEO letter of authorisation

The letter of authorisation granting a supplier AEO status provides the following information:

scope of the supplier authorisation

classification level of the supplier organisation in terms of ASA confidence

the level of confidence in systems integration where more than one service or discipline is

authorised

names of accountable persons for each sub-division or service area

corrective actions on the AEO to increase TfNSW level of confidence

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017




9.3. Self-assessment checklist

The applicant uses a detailed self-assessment checklist at the scoping meeting to confirm that it

will be in a position to present all system documentation and any output evidence required to

proceed with the authorisation assessment.

A self assessment checklist template is available on the ASA website.

9.4. Assessment or audit plan

The scope, behaviours, protocols, timescales and staff involved in the initial assessment or the

subsequent surveillance audits are set out in the assessment plan or the audit plan.

9.5. Assessment and audit checklists

The assessment or audit is recorded against a checklist that is based on core mandatory

engineering management requirements defined in the AEO Authorisation Requirements.

The Asset Standards Authority facilitator or auditor will review and record all evidence provided

by the applicant against each requirement in the checklist, with an indication of the level of

compliance achieved by the engineering organisation.

9.6. Assessment and audit report

The assessment and audit report summarises findings of the assessment or audit, along with

any agreed actions on the part of the supplier as part of the authorisation or surveillance audit

report.

9.7. Assessment or audit evidence

The ASA retains all evidence material in a secure location along with the related assessment or

audit records.

9.8. Records management

The ASA records the results of the authorisation process and provides information regarding a

supplier’s engineering services, disciplines, accountable persons, classification levels, and

details of any corrective actions.

Sup

erse

ded

by T

MU

MD

000

09 S

P v

1.0,

08/

05/2

017

aeo guide to authorisation - transport for nsw...sp v1.0, 08/05/2017 aeo guide to authorisation t mu...

Documents