as9100-series auditing and clarifications

AS9100-series Auditing and Clarifications

Buddy Cressionnie

AAQSC Chair

Americas Requirements & 9100 Leader

Registration Management Committee – July, 2019 - Torrance, CA 1

Discussion Topics

• Transition Audit Data Analysis

• Observations from Transition Audits

• Clarification Review


Transition Audit Data Analysis


Major Elements for Transition

• Standards – All Released• Training – Complete• ABs/CBs/OASIS -Complete• Auditors (as of 10/3/2018)

ISO 9001:2008

ISO 9001:2015

9100 1080 1316

9110 202 224

9120 354 367

More Auditors to ISO 9001:2015 than ISO 9001:2008

Standards

Training/ Auditor

Certification

Certification Scheme –ABs/CBs/OASIS

Org Implement

& Transition

99.1% or organizations transitioned by 9/15/2018



9100:2016-Series Data Summary

0

5000

10000

15000

20000

25000

30000

4 5 6 7 8 9 10

9100:2016-Series Transition NCRs

Minor Total

Major Total

Similar Distribution - Automotive

Based on 18,292 transition audits with a total of 55,194 nonconformities



0

1000

2000

3000

4000

5000

6000

7000

8000

9000

10000

9100:2016-Series Transition NCRs

Minor Total

Major Total


Top Drivers:• 8.4 Externally Provided• 8.5 Production & Service Provision• 7.1 Resources• 8.1 Operational Planning and Control• 10.2 Nonconformity & Corrective Action




Top Clauses

• 8.4 – Externally Provided Processes,

Products, & Services

• 8.5 – Production & Service

Provision

• 7.1 – Resources

• 8.1 – Operational Planning &

Control

• 10.2 Nonconformity & Corrective

Action

Driver

• 8.4.3 – Information for External

Provider

• 8.5.1 – Control of Production & Service

Provision

• 7.1.5.2 – Measurement Traceability

• 8.1.1 – Operational Risk Management

• 10.2.1 - Nonconformity & Corrective

Action



CB Auditor Transition NCs - International- October 2018 -

0

1000

2000

3000

4000

5000

6000

7000

major minor

Industry Identified Risk Areas

• Industry Risk Areas Embedded in broad Clause

• Need additional Drill Down to get proper value

Traditional High Volume NC

Areas




So What is the Transition Data Telling Us?

• Overall, AS&D organizations and CBs excellent job transitioning to plan

• Traditionally high NCR areas are driving nonconformities

• Maybe industry identified risk areas are not a big problem?

• Organizations prepared and are not struggling with new requirements

• Auditors need to ensure they are evaluating the effectiveness of the new requirements

Discussion Topics





Observations from Transition Audits

• Clause 4.3 Applicability

– Scope does not reflect the organization product and services

– Auditing the scope of certification

– Observed Issues:


Clause 4.3The organization shall determine the boundaries and applicability of the quality management system to establish its scope.

» Multiple site scopes that do not reflect work being performed at the site

» General Scopes: Aerospace manufacturing

» Scopes that do not reflect product and services• Example: Organization provides people to perform

aircraft maintenance. What is the best representative scope statement?a) Aircraft maintenance operations

b) Repair and maintenance operations

c) Provision of human resources for maintenance operations



– Organizations doing a good job justifying when a clause is not applicable

» Exception: Design & Development ≠ Engineering


Clause 4.3The scope of the organization’s quality management system shall be available and be maintained as documented information. The scope shall state the types of products and services covered, and provide justification for any requirement of this International Standard that the organization determines is not applicable to the scope of its quality management system.Conformity to this International Standard may only be claimed if the requirements determined as not being applicable do not affect the organization’s ability or responsibility to ensure the conformity of its products and services and the enhancement of customer satisfaction.

– Organizations not applying same diligence when a shall statement is not applicable (see Clause 4.3 Clarification)

» Justification is not required to be documented in Quality Manual

» Justification maintained as documented information

» Verbal justification is not acceptable



– ISO 9001:2015 and AS9100D focused on Products and Services

– Services were included in past versions as part of the definition of Products

» Not implemented by Organizations

» Not audited by Internal Audits or CBs


– Many organizations only considered product impacts

– Examples:

» Services delivered to the external customer

» Purchasing only considering product suppliers and not service providers that impact QMS scope

• Does Purchasing requirements in AS9100D include COTS parts?

YES!


• Clause 6.1 Actions to Address Risks and Opportunities

– Risk and opportunities associated with QMS, Context, Interested Parties, Processes

– Not Operational Risk identified in clause 8.1.1

– Clause 6.1.2 includes actions, integration, implementation, and evaluation of effectiveness

– Remember to audit 10.2.1e regarding update risks and opportunities as part of C/A if necessary


6.1.1 - When planning for the quality management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed to: a. give assurance that the quality management system can achieve its intended result(s); b. enhance desirable effects; c. prevent, or reduce, undesired effects; d. achieve improvement.


• Clause 7.1.5 Monitoring & Measurement Resources

– Not just “Calibration”

– Resources available for Monitoring & Measurement


– Applicable Monitoring & Measurement References

» Clause 4.4 QMS & its Processesc. determine and apply the criteria and methods (including monitoring, measurements and related performance indicators) needed to ensure the effective operation and control of these processes;

» Clause 9.1.1 Monitoring, Measurement, Analysis, and Evaluation General

» Clause 9.1.3 Analysis and Evaluation


• Clause 8.1 – Escape Prevention

– Why was requirement added:

» IAQG Leadership Focus Item

» Industry Focus Item

– Auditor Questioning

» What actions is the organization taking to prevent escapes?

» What actions are being taken when escapes occur?


8.1.1j. establishing the controls needed to prevent the delivery of nonconforming products and services to the customer.


• Clause 8.1.4 Prevention of Counterfeit Parts

– Requirement is not solely:

» Applicable to EEE parts

» AS5553 compliance

» Supplier flowdown

– AS9100D Hints Provided in NOTE


NOTE: Counterfeit part prevention processes should consider:• training of appropriate persons in the awareness and prevention of

counterfeit parts;• application of a parts obsolescence monitoring program;• controls for acquiring externally provided product from original or authorized

manufacturers, authorized distributors, or other approved sources;• requirements for assuring traceability of parts and components to their

original or authorized manufacturers;• verification and test methodologies to detect counterfeit parts;• monitoring of counterfeit parts reporting from external sources;• quarantine and reporting of suspect or detected counterfeit parts.


• Clause 8.4.2 Test Report Verification


» Organizations requiring suppliers to submit test reports as part of supplier part verification

» Organizations not verifying test reports and just filing reports


8.4.2 When external provider test reports are utilized to verify externally provided products, the organization shall implement a process to evaluate the data in the test reports to confirm that the product meets requirements.


» What is your process to evaluate test report to confirm products meet requirement?

» Verify the process is implemented and effective.


• Clause 8.4.2 Raw Material Testing


» Raw materials not meeting requirements

» Fraudulent certifications

» Key interested party concerns

» AS9100B requirement misunderstood and misapplied

» AS9100C requirement for product risk not applied


8.4.2 When a customer or organization has identified raw material as a significant operational risk (e.g., critical items), the organization shall implement a process to validate the accuracy of test reports.


» Raw material that has significant operations risk?

» Raw material test report validation requirements? Customer flowdown requirement?


• Change Management

– QMS heightened risk when changes occur

– Changes are expected and encouraged for continual improvement

– Audit potential risk and focus area

– Change Clauses:

» 6.3 Planning of Changes

» 7.1.6 Organizational Knowledge

» 7.3 Awareness – Documented information changes

» 7.5.3 Control of Documented Information

» 8.1 Operational Planning and Control (including 8.1.2 Config Mgmt)

» 8.2 Requirements for Products and Services

» 8.3 Design and Development (including 8.3.6 D&D Changes)

» 8.4 Control of Externally Provided Processes, Products and Services (Org to Supplier and Supplier to Org)

» 8.5 Prod and Service Provision (including 8.5.6 Control of Changes)

» 9.3 Management Review


Discussion Topics





Clarification Review


IAQG Procedure 105.2, paragraph 3 Clarification Requirements

• Applies to all IAQG Standards

• Purpose to receive clarifications regarding requirements

• NOT intended to mediate disputes between organizations and

Certification Bodies (CBs)…Use CB Dispute Process!

• NOT intended for OASIS functionality issues…Use OASIS Help

Screens (Help Support – Contact Us)

• Clarification method of communication

o Next Gen OASIS

o E-mail – SDR names on IAQG Standards Register

• SDR will respond and publish when profound impact or

significant dispute exist



www.iaqg.org



• Modified for applicability to 9100/9110/9120

• Routing and Coordination with Standard IDR/SDRs

• Published May 2019• Notification of

Stakeholders

Three New Clarifications Added to the File

New Clarification Review #1

• Clarification

– The IAQG 9100-series Teams expectation is that some level of operational risk management, configuration management, product safety, and preventing counterfeit parts would occur in every aviation, space and defense organization in the 9100-series standards.

– It would be rare but possible to take a permissible non-applicability to clauses 8.1.X as long as the requirements in clause 4.3 have been satisfied.


• Clarification Request 4.3

– Can the 9100-series clause 8.1.X requirements be excluded?


• Clarification Request 8.4.3

– Please provide clarity of the requirement in clause 8.4.3e…”The organization shall communicate to external providers its requirements for:

e. control and monitoring of the external providers’ performance to be applied by the organization;”

• Clarification

– ISO/TS 9002: The performance of external providers needs to be monitored. The type and frequency of the monitoring that the organization will use should be included in the information. This could specify the level of performance that the external provider has to meet, or provide information relating to how the results of the organization’s performance evaluations will be communicated.



• Clarification Request 9.3.2

– Provide clarity on management review input requirements as to what should be addressed by the organization based for

#5 - monitoring and measuring results.

• Clarification

– Monitoring and measuring results link back to clause 9.1.1 with this linkage shown in ISO/TS 9002:2016. The content for discussion would include what is the organization monitoring and measuring to evaluate the performance and effectiveness of the quality management system.


Existing Clarification Review

• Clarification Request 8.4.3 Technical Data

– The standard 9100:2009, clause 7.4.2 requires that purchasing information shall identify purchased product including revision status of technical data. The standard 9100, clause 8.4.3 does not include this requirement. This information is no more required?

• Clarification

– The clause 8.4.3a requirement... identification of relevant technical data...would include the revision status if applicable or required to fully define the product or service or configuration required.

– So “current engineering revision” is not compliant with AS9100D.


Questions?

28Registration Management Committee – July, 2019 - Torrance, CA

as9100-series auditing and clarifications

Documents