Company Confidential 1 AS9104/1 Transition and Oversight Assessment of Certification Bodies Mike...

Company Confidential 1

AS9104/1 Transition andOversight Assessment of

Certification Bodies

Mike Roberts12 March 2012

2

AS9104/1 Transition for CBs• Turn to SR-002:

• Read what is required from the SMS / CBMC and OP Assessors for AS9104/1 transition of CBs

• Question: What is required? - Office Assessment ?- Witnessed Assessment ?- Any Assessment?

3

CB AS9104/1 Transition

• In groups:

• Look at SR-002

• On your flip charts, make a list answering the question

• What is the AB required to assess to transition a CB to AS9104/1?

Exercise

Questions?

4

• AS9104/1 has a number of sections that are the requirements for CBs:- Section 6 - Requirements for CBs- Section 8 - Requirements For Audits And Reporting

which contains the requirements around the audit process including:» Certification Structures (see also Appendix B)» Minimum Audit Durations» Audit Teams» Certificate content» Transfers» ASRP and CAAT

- Section 18 – Requirements for Certified Organisations

5

Introducing AS9104/1 for CBs

6


• Spend 15 mins reading AS9104/1 section 6

• Any questions

7


• We are going to spend the next section looking at AS9104/1 section 8

• We will review:

– Certification Structures

– Audit Durations

– Audit durations when combined with 91XX:2009 transition

8

New Organisational Structures

• AS9104/1 section 8 and Annex B describes new certification structures:

– Single Site

– Multiple Site

– Campus

– Several Sites

– Complex

• These reflect the unique organisational structures that exist in the Aviation, Space, and Defence industry today.

9

Definitions

• To understand the structures more fully we need to understand some terms from AS9104/1:

– Value Stream (clause 3.27)

» An end-to-end business process which delivers a product or service to a customer. The process steps along the way may both use and produce intermediate goods, services and information to achieve the end product or service.

– Site (clause 3.25)

» A permanent location where an organisation carries out work or a service.

10

Definitions

• To understand the structures more fully we need to understand some terms from AS9104/1:

– Organisation (clause 3.22)

» Any legal entity or defined part of a legal entity owning a single quality management system that is subject to an ICOP audit and certification process

– Central Office (also referred to as Central Function) (clause 3.8)

» The organisation location/activity that controls the ‘common’ quality management system for the organisation under a single AQMS standard certificate.

11

Certification Structures (clause 3.11)

• A term utilised to describe how the certification activities of an A, S and D organisation will be structured and managed by the contracted CB.

• The defined structure will assist CBs with the development of a robust and conforming audit program, and provide industry with visibility of the structure within the OASIS database

• In all structures there is (8.1.1.c):– One common quality management system – Central control of management review and internal audit – The ability to initiate change and corrective action centrally. – The organisation centrally collects and analyses

organisational performance.

12

Single Site

• An organisation having one location. • The organisation may be organised under one large

building or several buildings at one location. • The organisation may have one or multiple products

or product families flowing though one or multiple processes.

The Certification Structures

Example Diagram

13

Multiple Site

• An organisation having an identified central function (the central office, but not necessarily the headquarters of the organisation) at which certain activities are planned, controlled or managed

• The organisation has a network of sites at which such activities are fully or partially carried out.

• With the exception of the central office the processes within each of the sites are substantially (>=80%) the same and are operated to the same methods and procedures (see IAF MD 1, “Multi-site Organization” definition and eligibility requirements).


14

Multiple Site

• Example:

• An organisation has two sites, A and B.

• They make two product families X and Y.

• Product family X is made the same way using the same processes on both sites A and B.

• Product family Y is only made on site A.

• This organisation makes to customer specification.

• The central function is located on site A.


15

Multiple Site

• Example:

• Explanation:

• Site B conducts the same but fewer processes than site A making the same product X. In this way the organisation is eligible for a multiple site approach


16

Campus

• An organisation having an identified central function (the central office, but not necessarily the headquarters of the organisation) at which certain activities are planned, controlled, or managed

• Has a decentralised, sequential, linked product realisation process, which is

• Referred to as a value stream in which the outputs from one site is an input to another site which ultimately results in the final product or service


17

Campus

• Example:

• The organisation has four sites

• Four buildings on site A, four buildings on site B and one building on each site C and D.

• The organisation has multiple products and product families that all flow through substantially (>=80%) similar processes and methods i.e. one value stream


• Example:

18

Campus


19

Campus• Explanation:

• Although there are different products that go through different processes in the organisation the controlling factors are that more than 80% of the processes in the realisation of the product are the same and all products flow through the same overall value chain before being delivered to the customer.

• Even if site B was split into four separate sites making different types of detail parts such as machined, formed, carbon-fibre or similar and where appropriate using the treatments site this organisation would still be a campus as all sites contribute to a single value steam of processes running through the organisation with a commonality that 80% of the processes and methods that make up each product are the same.


20

Several Sites• An organisation having an identified central function (the

central office, but not necessarily the headquarters of the organisation) at which certain activities are planned, controlled or managed

• A network of sites that do not meet the criteria for either a multiple site or a campus organisation

• Example:• The organisation has three sites A, B and C that make

different product families by mainly dissimilar processes and methods although some of processes such as purchasing are the same.

• Site C makes to customer specification. • Sites A and B design and manufacture their products. • Some of the customers for products from each site are the

same, others are not.


21

Several Sites• Example:

• This organisation has three essentially different sites with three mainly different sets of processes and methods.

• The organisation does not qualify for multiple site because of the different processes and does not qualify for campus as products in the value stream do not flow from one site to another.


CustomerOrders

Product X

Site A

Central Function

Site A

Customer Orders

Product YPurchasing

Customer Related Process

Product Realization

Site B

Product Y delivered to Customers

Design

Customer Orders

Product Z

PurchasingCustomer Related Process

Product Realization

Site C

Product Z delivered to Customers

PurchasingCustomer Related Process

Product Realization

Product X delivered to Customers

Design

Stream 1

Stream 2

Stream 3

Value Stream

22

Complex• An organisation having an identified central function

(the central office, but not necessarily the headquarters of the organization) at which certain activities are planned, controlled, or managed

• A network of locations that are any combination of multiple site, campus, several sites, or more than one campus


23

Complex• Example:

• The organisation has 6 sites and 2 different product families

• One family is made through product stream 1, the other through product stream 2.

• The processes carried out within sites C and D are identical realising the same product through the same processes.

• The same is true for sites E and F however the processes and methods in E and F are dissimilar from those used in C and D.

• Sites A and B support both product streams.

• Sites A and B use the same facilities for all products even through the types of products manufactured are different and utilize different technologies in their production.

• Where during the realisation processes in sites A and B the products in value stream 1 and in value stream 2 use the same processes.


24

Complex• Example:


25

Complex• Explanation:

• This organisation is a complex organisation because it has elements of multiple site and several campuses within it.

• Sites C and D are eligible for a multiple site approach.

• Sites E and F would also be eligible for multiple site approach.

• The combination of C, D, E and F are not eligible for multiple site all together because the processes are different between C or D and E or F.

• There are however two campuses within the organization. The value stream through A, B and C or D and the second value stream through A, B and E or F.

• This organisation is therefore made up of two campuses with a multiple site combination within each campus.


26

Complex – More Information:• When a CB determines with its client that the certification

structure will be ‘Complex’ they have to (clause 8.2.1.5):– Document the rational for the subset organisational types

– The justification to be sent to the IAQG OPMT Certification Structure Review Sub-Team

– The justification includes:

» applied methodology,

» audit duration calculation,

» planned audit program,

» sampling plan for multiple site organizations, processes for campus organizations

– Review results to be received from the IAQG OPMT before proceeding to stage 2 audit (clause 8.1.3)

• Question - What about application of ‘complex’ certification structures during transition?


AS9104/1 Annex B

27

Type of Certification

Single Site Multiple Site Campus Several Sites Complex Organization

Description: An organization that operates at one site.

An organization having an identified central function and a network of sites at which activities are fully or partially carried out.

All sites must be doing substantially the same manufacturing and/or value added process.

An organization having an identified central function and a decentralized, sequential, linked product realization process.

An organization having an identified central function and a network of sites that do not meet the criteria for a multiple site or campus organization.

Several sites are listed on the same certificate.

An organization having an identified central function and a network of locations that are any combination of multiple site, campus, several sites, or more than one campus.

Eligibility Criteria:

NOTE: An organization must meet ALL criteria.

Stand-alone self-supporting organization with no value stream dependencies from related companies operating under the same QMS.

One address.

All sites shall have a legal or contractual link with the central office.

One QMS with central control, management review and internal audit.

Central office can require other sites implement corrective action.

Central collection and analysis of data and ability to initiate organizational change.

Complies with IAF MD 1, “Multi-site Organization” definition and eligibility requirements.

All QMS processes at all sites have to be substantially (i.e., >80%) the same and are operated to the same methods and procedures.

Some sites may conduct fewer processes than others.

Sampling per IAF MD 1 will be allowed for 9120 certifications.

One address per site.





The outputs from one site are an input to another site to realize the final product or service. A single value stream.

Can be dissimilar processes at different sites or combination of the sites that contribute to the same overall product or service being realized.

More than one product or service may be realized providing they are substantially (i.e., >80%) the same (e.g., a family of products) and realized through the same methods and procedures.

One address per campus.





Processes at each of the sites is not substantially similar (i.e., <80% similar).

Processes may be operated to the same or different methods and procedures that are controlled through one common management system.

Sites realize different products or services.

One address per site.


One QMS with central control, management review, and internal audit.



Overall structure contains combinations of multiple site, campus several sites or more than one campus.

Requires IAQG OPMT approval of rationale, justification, audit day calculations, audit program, and sampling plan (for 9120, multiple site or campus).

One address per site and campus.

Audit Day Calculations:

9104/1 Table 2 using total number of employees.

No reductions allowed unless applying ASRP or CAAT.

Additions allowed.

9104/1 Table 2 using the number of employees from each site.

No reductions allowed unless applying ASRP as part of Category 2 or CAAT.

Additions allowed.

9104/1 Table 2 using the total number of employee from all sites added together as a starting point.

Required 10% addition to support communication and other aspects of audit of a campus.

No reductions allowed unless applying ASRP or CAAT.

Other additions allowed.

9104/1 Table 2 using the total number of employees from each site as a starting point.

30 % maximum reduction allowed at each site for reduced scope complexity (reference Table 4).

No other reductions allowed unless applying ASRP or CAAT.

Additions allowed.

Any combination of campus, multiple sites, and/or several sites. Can include more than one campus.

Calculate using requirements for each type of entity within the organization using 9104/1 Table 2.

Requires IAQG OPMT approval.

Initial Audit: One site with audit duration as defined above.

All sites audited with audit duration as defined above.

All sites audited.

CB to allocate total time between all sites to achieve an effective audit.

All sites audited with audit duration as defined above.

All sites audited.

Surveillance:

Annual surveillance using 9104/1 Table 2 (based upon 1/3 of initial audit duration).

Refer to 9104/1 table 3 for frequency and table 2 for audit day calculations.

All sites audited using 9104/1 Table 2 for surveillance (based upon 1/3 of initial audit duration) plus minimum 10% addition.

All sites audited using 9104/1 Table 2 for surveillance (based upon 1/3 of initial audit duration). Up to 30% maximum reduction per site

Dependent on combination.

28

AS9104/1 Annex B• Keep Annex B with you

• It will be your guide for answering questions and evaluating certification structures

• Remember in order to qualify for a particular structure the client organisation must meet ALL of the eligibility criteria and not just a few (see 8.1.1 and Appendix B)

• Follow the justification the CB has made and agreed with its client

• Watch out for incorrect use of ‘Campus’ – There will be a demand from existing 9104 ‘multiple-site’ client

organisations

– Many will not be eligible

– Use a major nonconformity if you find errors in this area because the focus is reduction of audit time and not effective audits

29

Certification Structures Summary• AS9104/1 section 8 and Annex B describes new

certification structures:– Single Site

– Multiple Site

– Campus

– Several Sites

– Complex

• Each structure type is unique in terms of description, eligibility criteria, audit day calculations, certificate contents and OASIS entry requirements

• Most EAQG member companies are likely to be categorised as ‘complex’

• Today 85% of issued certificates are for single site

Questions

30

31

Certification Structures

• In groups:

• Examine the description you have for an organisation and determine the correct certification structure

• On your flip charts, record the structure you selected and the justification for why you selected it

• If you can’t all agree go with the majority and record the split

• Choose a member of the group to feed back

• Exercise duration 20 minutes

Exercise

32

Certification Structures Description:• One organisation of 4 sites, meets all of the

criteria of AS9104/1 8.1.1.c)

• Procedures are > 80% the same although Product Families 1 and 2 use different technologies in their manufacture but both produce an aviation vehicle

– Product Family 1 is metal framed and jet propelled

– Product Family 2 is carbon framed and high technology turbo-propeller propelled

• Sites and flows are as per the diagram:

Exercise

33

Certification Structures Description:• What is the structure? – Justification?

Exercise

Site 1 includes:Central FunctionsContract Review

DesignPurchasing

Sub Assembly Product Family 1Assembly Product Family 1

Testing Product Family 1Despatch to Customer of Product

Family1Customer Support

Site 2 includes:Sub Assembly Product Family 2

Assembly Product Family 2Testing Product Family 2

Despatch to customer of Product Family 2

Site 3 includes:Goods Receipt

Detail Parts manufacture for Product Families 1 and 2

Despatch to Site 1 and Site 2




34


• We are going to spend the next section looking at AS9104/1 section 8

• We will review:

– Certification Structures

– Audit Durations

– Audit durations when combined with 91XX:2009 transition

35

Audit Duration

• Calculating audit duration is one of the most difficult parts of the certification process

• It is not an absolute process nor does it produce an absolute answer

• We know it is used as one of the ways some Certification Bodies (CBs) try to differentiate themselves from other CBs

• This presentation does not focus on the cost of AQMS standard certification only the methodology for calculating audit duration

36

ISO 17021 and Audit Duration

• ISO / IEC 17021 clause 9.1.4 and 9.1.5 set out the basic requirements for a CB to determine audit time

• The CB shall have documented procedures to determine audit time, and

• For each client the CB shall determine time needed to plan and accomplish a complete and effective audit …..

• Determined audit time and the justification for the determination shall be recorded ….

37

ISO 17021 and Audit Duration

• Clause 9.2.1 - CB to collect significant information about the clients organisation from an authorised representative

• Clause 9.2.2 - CB to conduct an application review to consider all of the information gathered, resolve any lack of understanding and to ensure that scope, locations, time required to complete audits and other factors are considered

• Then determine competencies needed for audit and decision-making

• And … record a justification for the decision to undertake the audit

38

IAF and Audit Duration

• ISO 17021 requires a process and procedures but does not state what the time for an audit should be

• This creates an open market in which competitive pressure is to constantly reduce the cost of the certification service and therefore to reduce audit days

• ISO 17021 recognises this and in clause 4.2.2 states

– ‘It is recognized that the source of revenue for a certification body is its client paying for certification, and that this is a potential threat to impartiality.’

39

IAF and Audit Duration

• To help the CBs and the ABs the IAF produce Mandatory Documents (MD Series)

• Their status is that they are mandatory requirements however the CB may propose and utilise alternates that are equivalent to the MD.

• There are two principle documents affecting audit duration and time on site:

– IAF MD 5:2009 IAF Mandatory Document for Duration of QMS and EMS Audits

– IAF MD 1:2007 IAF Mandatory Document for the Certification of Multiple Sites Based on Sampling

• MD 5 is mainly for single site and MD 1 for multiple sites

40

AS9104/1 and Audit Time

• AS9104/1 tells CBs how to calculate on-site audit duration– To reduce commercial competitive pressures on CBs – To simply the calculation process

• AS9104/1 Clause 8 and Appendix B contain the requirements

• There is a process as before but it is simplified as follows:– Use AS9104/1 Appendix B table to select the correct

certification structure using the eligibility criteria in addition to the definitions and requirements

– Use section 8 instructions for the certification structure to determine minimum on-site audit days

41

AS9104/1 and Audit Time• AS9104/1 Table 2 is used as the basis for all

structures

– The table is IAF MD 5 plus 9104:2006 Table 2

– It is audit days on-site and not audit duration:

» Read AS9104/1 sections 8.2 and 8.2.2 for application

– For 9110 / 9110 ‘including design’ no reduction has been made on the IAF MD 5 times

– Some limited reduction has been incorporated for ‘no design’ and ‘9120’ based on the removal of requirements

– There is therefore no need to make reductions to Table 2 and for most certification structures audit time reductions are NOT ALLOWED

42

AS9104/1 and Audit Time• As a result when comparing AS9104/1 Table 2 to

existing contacts based on 9104:2006 – The more creative the CB has been, the bigger the

increase in on-site audit time will be– If the CB has not correctly applied IAF MD 1 for multiple

site you may see a big increase– If you CB has not made reductions and has been effective

and fair you will see little or no change in audit days

• The IAQG OPMT will use of the IAQG OPMT Complex Certification Structure Oversight Committee (CSOC) to review complaints including alleged large increases in audit days!

– Complaints: see IAQG OPMT Procedure 201

43

Single Site• Description

– An organisation that operates at one site

• Eligibility

– Stand-alone self-supporting organisation with no value stream dependencies from related companies operating under the same QMS.

– One address.

• Audit Day Requirement

– Table 2, using number of employees at site.– Reductions – none, except for ASRP or CAAT– Additions – allowed and expected per MD-5 – Initial – one site using Table 2 audit days– Surveillance –using Table 2 surveillance audit days– Recertification – using Table 2 recertification audit days


44

Multiple Site• Description

– An organisation having an identified central function and a network of sites at which activities are fully or partially carried out.

– All sites must be doing substantially the same manufacturing and/or value added process.

• Eligibility

– All sites shall have a legal or contractual link with the central office.

– One QMS with central control, management review and internal audit.

– Central office can require other sites implement corrective action.– Central collection and analysis of data and ability to initiate

organisational change.


45

Multiple Site• Eligibility (continued)

– Complies with IAF MD 1, “Multi-site Organisation” definition and eligibility requirements.

– All QMS processes at all sites have to be substantially (i.e. >80%) the same and are operated to the same methods and procedures.

– Some sites may conduct fewer processes than others.

– Sampling per IAF MD 1 will be allowed for 9120 certifications.

– One address per site.


46

Multiple Site• Audit Day Requirement

– Table 2, separately using number of employees at each site.

– Reductions – none, except for ASRP (Cat. 2) or CAAT

– Additions – allowed and expected per MD-5

– Initial – all sites audited using Table 2 audit days

– Surveillance – using 9104/1 Table 3 (Cat. 1 & Cat. 2) for sampling frequency and Table 2 for audit days at each site

– Recertification – using 9104/1 Table 3 (Cat. 1 & Cat. 2) for sampling frequency and Table 2 for audit days at each site

Note:

– Category 1 (Cat. 1) = meets IAF MD 1 criteria only

– Category 2 (Cat. 2) = meets MD 1 and MD 3 criteria


47

Campus• Description

– An organisation having an identified central function and a decentralised, sequential, linked product realisation process.

• Eligibility



– Central office can require other sites implement corrective action.

– Central collection and analysis of data and ability to initiate organisational change.


48

Campus• Eligibility (continued)

– The outputs from one site are an input to another site to realise the final product or service. A single value stream.

– Can be dissimilar processes at different sites or combination of the sites that contribute to the same overall product or service being realised.

– More than one product or service may be realized providing they are substantially (i.e., >80%) the same (e.g., a family of products) and realised through the same methods and procedures.

– One address per campus.


49

Campus• Audit Day Requirement

– Table 2, using total number of employees from campus.

– Reductions – none, except for ASRP or CAAT

– Additions – +10% required, plus additions per MD-5

– Initial – all sites using Table 2 for total campus population + 10% to Table 2 audit days

– Surveillance – all sites using surveillance per Table 2 for total campus population + 10% to Table 2 audit days

– Recertification – all sites using recertification per Table 2 for total campus population + 10% to Table 2 audit days


50

Several Sites• Description

– An organisation having an identified central function and a network of sites that do not meet the criteria for a multiple site or campus organisation.

– Several sites are listed on the same certificate

• Eligibility



– Central office can require other sites implement corrective action.

– Central collection and analysis of data and ability to initiate organisational change.


51

Several Sites• Eligibility (continued)

– Processes at each of the sites is not substantially similar (i.e., <80% similar).

– Processes may be operated to the same or different methods and procedures that are controlled through one common management system.

– Sites realise different products or services.

– One address per site.


52

Several Sites• Audit Day Requirement

– Table 2, using number of employees separately at each site.

– Reductions – up to 30% for reduced scope complexity only as allowed in Table 4, or reductions for ASRP or CAAT

– Additions – allowed and expected per MD-5

– Initial – audit all sites using Table 2 audit durations with allowable Table 4 reductions at each site

– Surveillance – audit all sites using Table 2 for surveillance audit days with allowable Table 4 reductions at each site

– Recertification – audit all sites using Table 2 recertification audit days with allowable Table 4 reductions at each site


Category % Decrease *

No Human Resources Processes 10%

No Production or Service Realization 20%

No Purchasing 10%

No Customer Related Processes 10%

No QMS Documentation Control (not applicable for the central function)

10%

* Up to a maximum 30% cumulative reduction, with justification.

53

Complex• Description

– An organisation having an identified central function and a network of locations that are any combination of multiple site, campus, several sites, or more than one campus.

• Eligibility– All sites shall have a legal or contractual link with the

central office.– One QMS with central control, management review, and

internal audit.– Central office can require other sites implement corrective

action.– Central collection and analysis of data and ability to initiate

organizational change.


54

Complex• Eligibility (continued)

– Overall structure contains combinations of multiple site, campus, several sites or more than one campus.

– Requires IAQG OPMT approval of rationale, justification, audit day calculations, audit program, and sampling plan (for 9120, multiple site or campus).

– One address per site and campus


55

Complex• Audit Day Requirement

– Use Table 2 for each case of multiple sites, campus, or several sites.

– Reductions – only as each individual type allows (i.e. several sites) and for ASRP and/or CAAT if applicable

– Additions – allowed as per each individual type and expected per MD-5

– Initial – all sites audited based on Table 2 audit days by combination of types

– Surveillance – dependent upon combination of types

– Recertification – dependent upon combination of types


56

Multiple AQMS Certification• Additional audit days added based on level of integration

– Determine audit days using correct certification structure and based on Table 2 for the primary standard, based on total number of employees in the organisation or at each site as applicable.

– Increase audit days by 15% for fully integrated organisations

– Increase audit days by 30% for partially integrated organisations

– No reduction for ASRP or CAAT for full or partial integration

– For an organisation that is not integrated the audit days for each AQMS standard audit shall be independent from one another using 100% of the required audit days from Table 2. » The number of employees related to each certification shall be used

to determine each audit day calculation.


57

ASRP and Audit Time (Clause 8.9)

• Advanced Surveillance and Recertification Procedures:

– ASRP is allowed but not mandatory, if used the eligibility requirements of IAF MD 3 are to be met

– Application of ASRP shall not in itself be a reason to reduce audit duration

– The ASRP process outlined in IAF MD 3 shall not reduce the Table 2 required on-site audit duration by more than 30% for single, campus, several, and complex site certification structures

– ASRP reductions for multiple site certifications are contained in Table 3

– NOTE: The organization’s internal auditors shall meet the AA requirements of 9104/3 and the internal AQMS audit function shall be led by an individual meeting the requirements of an AEA


58

CAAT and Audit Time (Clause 8.10)

• Computer Aided Auditing Techniques:

– Use of CAAT is not mandatory

– If use CAAT, conformance to IAF MD 4 is mandatory

– Use of CAAT shall not reduce the Table 2 required on-site audit duration by more than 30%

– Reduced on-site audit time is not eliminated; instead it shall be allocated to the remote audit time using appropriate CAAT

– Combined use of CAAT and ASRP shall not reduce the Table 2 required on-site audit duration by more than 30%


59

Summary• AS9104/1 introduces new certification structures

• The structures increase complexity

• However, having identified the correct certification structure the actual calculation of audit days is simplified under AS9104/1

• Reductions are not allowed except for Several Sites and for the application of ASRP and CAAT

• Clear requirements for audit days for Multiple AQMS have been established based on the level of integration of the systems, processes and methods

• Beware of large claims of increase in audit days – often it will mean that 9104:2006 requirements have not been correctly applied

Questions

60

61

Calculating On-site audit time:• In groups you have 20 minutes to:

• Use the site certification structure your group determined in the earlier exercise:

– Calculate the minimum on-site initial audit duration assuming no application of ASRP or CAAT and the at the organisation with EN 9100:2009 certification

– Record (as a separate line) the amount of time for Preparation and Audit Reporting

– Write a justification for the arrived at minimum time on site

• Record results on a flip chart

• Nominate one person to feed back

Exercise

62

Calculating On-site Audit Time:

Exercise

Site 1 includes:Central FunctionsContract Review

DesignPurchasing

Sub Assembly Product Family 1Assembly Product Family 1

Testing Product Family 1Despatch to Customer of Product

Family1Customer Support

Employees:Central Functions – 123

Contract Review - 8Design – 66

Purchasing – 20Customer Support 20

Product Realisation – 1175Where functions are shared

employees are split 50% to each product family (all sites)

Site 2 includes:Sub Assembly Product Family 2

Assembly Product Family 2Testing Product Family 2

Despatch to customer of Product Family 2

Employees:Product Realisation – 876









Questions

63

64

Hierarchy of Requirements• Accreditation of CBs to perform ISO 9001

audits includes:• ISO 17021:2006 or ISO 17021:2011

• IAF Mandatory Documents 1 to 5

• AB terms and conditions

• In addition the ICOP process adds:• For 91xx:2009: 9101:2009 requirements

• 9104 series (AS9104/1, AS9104/2 and AS9104/3)

• IAQG OPMT Supplemental Rules

• ICOP Resolutions (IAQG and EAQG OPMT)

Increasin

g

Preced

ence

Reminder

65

Oversight of CBs:

• Oversight of CBs is essentially the same processes that an AB uses when assessing a CB

• Described in AS9104/2 clause 8• Oversight uses two assessment techniques:

- Assessment of the CB Office» Management system implementation» Evidence of deployment and competent operation

- Witness Assessment» Assessing the deployment of the CB competence system

through on-site observation

• These techniques are used both in joint team assessment and industry only OP Assessor oversight assessment of CBs

Reminder

66

Oversight of CBs:• AS9104/2 requires that oversight of each CB each

year comprising a minimum of one each:- CB Office Assessment (8.6.2) including:

» A review of CB activity to ensure conformance with EN 9104 and AS9104/1 and applicable industry standards (ISO 17021 and IAF MD)

» a review of the latest CB oversight office assessment reports, including actions taken

- CB Witness Assessment (8.2) assessing:» Team competence» Conformity to established requirements» The effectiveness of the audit program» Conformity of the audit team with the CB procedures and

processes

• Requirements are complimentary / compatible with AB expectations

Reminder

67

CB Assessment:• OP Assessor Requires:

- EN AS9104/2 Forms» Annex K - Oversight Assessment Summary Report» Annex J – Oversight Nonconformity Record» Annex F - CB Office Assessment Checklist» Annex G - CB Witness Assessment Checklist

- Standards and Reference Documents:» EN 9104 series (9104, AS9104/1, AS9104/2, AS9104/3)» ISO / IEC 17021» IAF Mandatory Documents 1 to 5 inclusive» IAQG Supplemental Rules (e.g. SR 001, SR 002)» IAQG and EAQG OPMT Resolutions Log

- Audit Plan- Copy of previous assessment and oversight reports including

verification evidence for any nonconformities

Reminder

68

AS9104/2 Check sheets: Annex F & G • The AS9104/2 check sheets are out of date• They will be updated by the IAQG OPMT • Unlikely to be available until 30th March 2012• Until then, use the existing checklists• Recommended that, if possible, oversight be delayed

until new checklists are available and AS9104/1 is implemented

• If you need to conduct oversight:‒ Be very cautious with requirements‒ Is the oversight to 9104:2006 or AS9104/1, and using ISO

17021:2006 and / or ISO 17021:2011?‒ If needed for AS9104/1 oversight, amend the check sheet to

reflect AS9104/1 requirements

69

AS9104/2 Annex F Checklist:

• Use the checklist with caution• Know your checklist:

- Refers to ISO / IEC Guide 62 which is obsolete – do you know the ISO 17021:2006 and ISO 17021:2011 references?

- Refers to 9104 without the underlying 17021 references- No references to AS9104/1 - if needed amend the check

sheet to reflect AS9104/1 requirements- Not all references are accurate- Split into three sections but does not follow CB

processes- Use of a checklist is mandatory but you can change it –

it is guidance

70

AS9104/2 Annex G Checklist:

• Use the checklist with caution• Know your checklist:

- Common checklist with AB Witness Assessment- Know which questions refer to AB and which to CB- Refers to ISO / IEC Guide 62 which is obsolete – do you

know the ISO 17021:2006 or ISO 17021:2011 references?

- Refers to 9104 without the underlying 17021 references

- No references to AS9104/1 - if needed amend the check sheet to reflect AS9104/1 requirements

- Not all references are accurate- Use of a checklist is mandatory but you can change it –

it is guidance

71

AS9104/2 Annex B-H – Checklists:• Each checklist has an information block

on first page• Indicate Assessment Results in this

column for each item- A - Acceptable- X – Issue identified- NA – Not applicable- NE – Not evaluated

• Assessment evidence / comments box must have the objective evidence reviewed recorded against each item assessed – DO NOT LEAVE BLANK

• For Observations or Opportunities for Improvement:

- Mark assessment results ‘A’ – Acceptable- Note the Obs or OFI in the comments box

• Make sure you have prepared all of the required checklists

Reminder

72

AS9104/2 Annex B-H – Checklists:

• Assessment Results – mark the column:- A - Acceptable- X – Issue identified- NA – Not applicable- NE – Not evaluated

• If NA, justify why it is not applicable: – e.g. CB requirement not applicable to AB assessment

• If NE, justify why it was not evaluated:– e.g. example not seen during assessment– DO NOT write NE and then record partial evidence of

evaluation» e.g. AB internal audit, if the AB has not sampled ICOP

scheme client files in the internal audit you still need to evaluate the AB internal audit process

Reminder

73

AS9104/1 Transition and Oversight:

• Remember:– No specific oversight assessment is required as AB

will manage the AS9104/1 transition – The AB must accredit the CB before the CB can

transition clients– Oversight may be more effective after transition

to AS9104/1– Combined transition for CB clients to 91XX:2009

and AS9104/1 will become confusing – Take care if combining AS9104/1 transition and

normal oversight assessments– Watch out for a landslide towards Campus

certification structures!

Questions?

74

Company Confidential 1 AS9104/1 Transition and Oversight Assessment of Certification Bodies Mike...

Documents

Transcript of Company Confidential 1 AS9104/1 Transition and Oversight Assessment of Certification Bodies Mike...