AS9104/1 Transition and
Oversight Assessment of
Certification Bodies
Mike Roberts
12 March 2012
Company Confidential
1
AS9104/1 Transition for CBs
• Turn to SR-002:
• Read what is required from the SMS / CBMC
and OP Assessors for AS9104/1 transition of
CBs
• Question: What is required?
-
Office Assessment ?
Witnessed Assessment ?
Any Assessment?
2
Exercise
CB AS9104/1 Transition
• In groups:
• Look at SR-002
• On your flip charts, make a list answering the
question
• What is the AB required to assess to transition
a CB to AS9104/1?
3
Questions?
4
Introducing AS9104/1 for CBs
• AS9104/1 has a number of sections that are
the requirements for CBs:
-
Section 6 - Requirements for CBs
Section 8 - Requirements For Audits And Reporting
which contains the requirements around the audit
process including:
»
»
»
»
»
»
-
Certification Structures (see also Appendix B)
Minimum Audit Durations
Audit Teams
Certificate content
Transfers
ASRP and CAAT
Section 18 – Requirements for Certified
Organisations
5
Introducing AS9104/1 for CBs
• Spend 15 mins reading AS9104/1 section 6
• Any questions
6
Introducing AS9104/1 for CBs
• We are going to spend the next section
looking at AS9104/1 section 8
• We will review:
– Certification Structures
– Audit Durations
– Audit durations when combined with
91XX:2009 transition
7
New Organisational Structures
• AS9104/1 section 8 and Annex B describes new
certification structures:
– Single Site
– Multiple Site
– Campus
– Several Sites
– Complex
• These reflect the unique organisational structures that
exist in the Aviation, Space, and Defence industry
today.
8
Definitions
• To understand the structures more fully we need
to understand some terms from AS9104/1:
– Value Stream
(clause 3.27)
» An end-to-end business process which delivers a
product or service to a customer. The process steps
along the way may both use and produce intermediate
goods, services and information to achieve the end
product or service.
– Site
(clause 3.25)
» A permanent location where an organisation carries
out work or a service.
9
Definitions
• To understand the structures more fully we need
to understand some terms from AS9104/1:
– Organisation
(clause 3.22)
» Any legal entity or defined part of a legal entity
owning a single quality management system that is
subject to an ICOP audit and certification process
– Central Office (also referred to as Central Function)
(clause 3.8)
» The organisation location/activity that controls the
‘common’ quality management system for the
organisation under a single AQMS standard certificate.
10
Certification Structures
(clause 3.11)
• A term utilised to describe how the certification
activities of an A, S and D organisation will be
structured and managed by the contracted CB.
• The defined structure will assist CBs with the
development of a robust and conforming audit
program, and provide industry with visibility of the
structure within the OASIS database
• In all structures there is
:
(8.1.1.c)
– One common quality management system
– Central control of management review and internal audit
– The ability to initiate change and corrective action
centrally.
– The organisation centrally collects and analyses
organisational performance.
11
The Certification Structures
Single Site
• An organisation having one location.
• The organisation may be organised under one large
building or several buildings at one location.
• The organisation may have one or multiple products or
product families flowing though one or multiple
processes.
Example Diagram
12
The Certification Structures
Multiple Site
• An organisation having an identified central function
(the central office, but not necessarily the
headquarters of the organisation) at which certain
activities are planned, controlled or managed
• The organisation has a network of sites at which such
activities are fully or partially carried out.
• With the exception of the central office the processes
within each of the sites are substantially (>=80%) the
same and are operated to the same methods and
procedures (see IAF MD 1, “Multi-site Organization”
definition and eligibility requirements).
13
The Certification Structures
Multiple Site
• Example:
• An organisation has two sites, A and B.
• They make two product families X and Y.
• Product family X is made the same way using the
same processes on both sites A and B.
• Product family Y is only made on site A.
• This organisation makes to customer specification.
• The central function is located on site A.
14
The Certification Structures
Multiple Site
• Example:
• Explanation:
• Site B conducts the same but fewer processes than
site A making the same product X. In this way the
organisation is eligible for a multiple site approach
15
The Certification Structures
Campus
• An organisation having an identified central function
(the central office, but not necessarily the
headquarters of the organisation) at which certain
activities are planned, controlled, or managed
• Has a decentralised, sequential, linked product
realisation process, which is
• Referred to as a value stream in which the outputs
from one site is an input to another site which
ultimately results in the final product or service
16
The Certification Structures
Campus
• Example:
• The organisation has four sites
• Four buildings on site A, four buildings on site B and
one building on each site C and D.
• The organisation has multiple products and product
families that all flow through substantially (>=80%)
similar processes and methods i.e. one value stream
17
The Certification Structures
Campus
• Example:
18
The Certification Structures
Campus
• Explanation:
• Although there are different products that go through
different processes in the organisation the controlling
factors are that more than 80% of the processes in
the realisation of the product are the same and all
products flow through the same overall value chain
before being delivered to the customer.
• Even if site B was split into four separate sites making
different types of detail parts such as machined,
formed, carbon-fibre or similar and where appropriate
using the treatments site this organisation would still
be a campus as all sites contribute to a single value
steam of processes running through the organisation
with a commonality that 80% of the processes and
methods that make up each product are the same.
19
The Certification Structures
Several Sites
• An organisation having an identified central function
(the central office, but not necessarily the
headquarters of the organisation) at which certain
activities are planned, controlled or managed
• A network of sites that do not meet the criteria for
either a multiple site or a campus organisation
• Example:
• The organisation has three sites A, B and C that make
different product families by mainly dissimilar
processes and methods although some of processes
such as purchasing are the same.
• Site C makes to customer specification.
• Sites A and B design and manufacture their products.
• Some of the customers for products from each site are
the same, others are not.
20
The Certification Structures
Several Sites
Value Stream
• Example:
Stream 1
Site A
Customer
Orders
Product X
Customer
Related
Process
Design
Purchasing
Product
Realization
Product X
delivered to
Customers
Central
Function
Site A
Stream 2
Site B
Customer
Orders
Product Y
Customer
Related
Process
Design
Purchasing
Product
Realization
Stream 3
Site C
Customer
Orders
Product Z
Customer
Related
Process
Purchasing
Product Y
delivered to
Customers
Product
Realization
Product Z
delivered to
Customers
• This organisation has three essentially different sites with three
mainly different sets of processes and methods.
• The organisation does not qualify for multiple site because of the
different processes and does not qualify for campus as products
in the value stream do not flow from one site to another.
21
The Certification Structures
Complex
• An organisation having an identified central function
(the central office, but not necessarily the
headquarters of the organization) at which certain
activities are planned, controlled, or managed
• A network of locations that are any combination of
multiple site, campus, several sites, or more than one
campus
22
The Certification Structures
Complex
• Example:
• The organisation has 6 sites and 2 different product families
• One family is made through product stream 1, the other
through product stream 2.
• The processes carried out within sites C and D are identical
realising the same product through the same processes.
• The same is true for sites E and F however the processes and
methods in E and F are dissimilar from those used in C and D.
• Sites A and B support both product streams.
• Sites A and B use the same facilities for all products even
through the types of products manufactured are different and
utilize different technologies in their production.
• Where during the realisation processes in sites A and B the
products in value stream 1 and in value stream 2 use the same
processes.
23
The Certification Structures
Complex
• Example:
24
The Certification Structures
Complex
• Explanation:
• This organisation is a complex organisation because it has
elements of multiple site and several campuses within it.
• Sites C and D are eligible for a multiple site approach.
• Sites E and F would also be eligible for multiple site
approach.
• The combination of C, D, E and F are not eligible for
multiple site all together because the processes are
different between C or D and E or F.
• There are however two campuses within the organization.
The value stream through A, B and C or D and the second
value stream through A, B and E or F.
• This organisation is therefore made up of two campuses
with a multiple site combination within each campus.
25
The Certification Structures
Complex – More Information:
• When a CB determines with its client that the certification
structure will be ‘Complex’ they have to (clause 8.2.1.5):
– Document the rational for the subset organisational types
– The justification to be sent to the IAQG OPMT Certification
Structure Review Sub-Team
– The justification includes:
» applied methodology,
» audit duration calculation,
» planned audit program,
» sampling plan for multiple site organizations, processes for
campus organizations
– Review results to be received from the IAQG OPMT before
proceeding to stage 2 audit (clause 8.1.3)
• Question - What about application of ‘complex’
certification structures during transition?
26
AS9104/1 Annex B
Type of
Certification
Description:
Single Site
 An organization that
operates at one site.
Multiple Site
 An organization having an
identified central function and a
network of sites at which
activities are fully or partially
carried out.
Campus
 An organization having an
identified central function and
a decentralized, sequential,
linked product realization
process.
 Several sites are listed on the
same certificate.
 All sites must be doing
substantially the same
manufacturing and/or value
added process.
Eligibility
Criteria:
NOTE:
An organization
must meet ALL
criteria.
 Stand-alone
self-supporting
organization with no
value stream
dependencies from
related companies
operating under the
same QMS.
 One address.
Several Sites
 An organization having an
identified central function and
a network of sites that do not
meet the criteria for a multiple
site or campus organization.
Complex Organization
 An organization having an
identified central function and
a network of locations that are
any combination of multiple
site, campus, several sites, or
more than one campus.
 All sites shall have a legal or
contractual link with the central
office.
 All sites shall have a legal or
contractual link with the
central office.
 All sites shall have a legal or
contractual link with the
central office.
 All sites shall have a legal or
contractual link with the
central office.
 One QMS with central control,
management review and
internal audit.
 One QMS with central
control, management review
and internal audit.
 One QMS with central
control, management review
and internal audit.
 One QMS with central control,
management review, and
internal audit.
 Central office can require other
sites implement corrective
action.
 Central office can require
other sites implement
corrective action.
 Central office can require
other sites implement
corrective action.
 Central office can require
other sites implement
corrective action.
 Central collection and analysis
of data and ability to initiate
organizational change.
 Central collection and
analysis of data and ability to
initiate organizational
change.
 Central collection and
analysis of data and ability to
initiate organizational change.
 Central collection and
analysis of data and ability to
initiate organizational change.
 Processes at each of the
sites is not substantially
similar (i.e., <80% similar).
 Overall structure contains
combinations of multiple site,
campus several sites or more
than one campus.
 Complies with IAF MD 1,
“Multi-site Organization”
definition and eligibility
requirements.
 All QMS processes at all sites
have to be substantially (i.e.,
>80%) the same and are
operated to the same methods
and procedures.
 Some sites may conduct fewer
processes than others.
 Sampling per IAF MD 1 will be
allowed for 9120 certifications.
 One address per site.
 The outputs from one site
are an input to another site to
realize the final product or
service. A single value
stream.
 Can be dissimilar processes
at different sites or
combination of the sites that
contribute to the same
overall product or service
being realized.
 More than one product or
service may be realized
providing they are
substantially (i.e., >80%) the
same (e.g., a family of
products) and realized
through the same methods
and procedures.
 Processes may be operated
to the same or different
methods and procedures that
are controlled through one
common management
system.
 Sites realize different
products or services.
 One address per site.
 Requires IAQG OPMT
approval of rationale,
justification, audit day
calculations, audit program,
and sampling plan (for 9120,
multiple site or campus).
 One address per site and
campus.
 One address per campus.
Audit Day
Calculations:
Initial Audit:
Surveillance:
 9104/1 Table 2 using
total number of
employees.
 9104/1 Table 2 using the
number of employees from
each site.
 No reductions allowed
unless applying ASRP or
CAAT.
 No reductions allowed unless
applying ASRP as part of
Category 2 or CAAT.
 Additions allowed.
 Additions allowed.
 9104/1 Table 2 using the
total number of employee
from all sites added together
as a starting point.
 Required 10% addition to
support communication and
other aspects of audit of a
campus.
 9104/1 Table 2 using the total
number of employees from
each site as a starting point.
 30 % maximum reduction
allowed at each site for
reduced scope complexity
(reference Table 4).
 Any combination of campus,
multiple sites, and/or several
sites. Can include more than
one campus.
 Calculate using requirements
for each type of entity within
the organization using 9104/1
Table 2.
 No reductions allowed unless
applying ASRP or CAAT.
 No other reductions allowed
unless applying ASRP or
CAAT.
 Other additions allowed.
 Additions allowed.
 All sites audited with audit
duration as defined above.
 All sites audited.
 All sites audited using 9104/1
Table 2 for surveillance
(based upon 1/3 of initial
audit duration). Up to 30%
maximum reduction per site
 Dependent on combination.
 One site with audit
duration as defined
above.
 All sites audited with audit
duration as defined above.
 All sites audited.
 Annual surveillance
using 9104/1 Table 2
(based upon 1/3 of initial
audit duration).
 Refer to 9104/1 table 3 for
frequency and table 2 for audit
day calculations.
 All sites audited using 9104/1
Table 2 for surveillance
(based upon 1/3 of initial
audit duration) plus minimum
10% addition.
 CB to allocate total time
between all sites to achieve
an effective audit.
 Requires IAQG OPMT
approval.
27
AS9104/1 Annex B
• Keep Annex B with you
• It will be your guide for answering questions and
evaluating certification structures
• Remember in order to qualify for a particular structure
the client organisation must meet ALL of the eligibility
criteria and not just a few (see 8.1.1 and Appendix B)
• Follow the justification the CB has made and agreed with
its client
• Watch out for incorrect use of ‘Campus’
– There will be a demand from existing 9104 ‘multiple-site’
client organisations
– Many will not be eligible
– Use a major nonconformity if you find errors in this area
because the focus is reduction of audit time and not effective
audits
28
Certification Structures Summary
• AS9104/1 section 8 and Annex B describes new
certification structures:
– Single Site
– Multiple Site
– Campus
– Several Sites
– Complex
• Each structure type is unique in terms of description,
eligibility criteria, audit day calculations, certificate
contents and OASIS entry requirements
• Most EAQG member companies are likely to be
categorised as ‘complex’
• Today 85% of issued certificates are for single site
29
Questions
30
Exercise
Certification Structures
• In groups:
• Examine the description you have for an
organisation and determine the correct
certification structure
• On your flip charts, record the structure you
selected and the justification for why you
selected it
• If you can’t all agree go with the majority and
record the split
• Choose a member of the group to feed back
• Exercise duration 20 minutes
31
Exercise
Certification Structures Description:
• One organisation of 4 sites, meets all of the
criteria of AS9104/1 8.1.1.c)
• Procedures are > 80% the same although
Product Families 1 and 2 use different
technologies in their manufacture but both
produce an aviation vehicle
– Product Family 1 is metal framed and jet
propelled
– Product Family 2 is carbon framed and high
technology turbo-propeller propelled
• Sites and flows are as per the diagram:
32
Exercise
Certification Structures Description:
• What is the structure? – Justification?
Site 1 includes:
Central Functions
Contract Review
Design
Purchasing
Sub Assembly Product Family 1
Assembly Product Family 1
Testing Product Family 1
Despatch to Customer of Product
Family1
Customer Support
Site 2 includes:
Sub Assembly Product Family 2
Assembly Product Family 2
Testing Product Family 2
Despatch to customer of Product
Family 2
Site 4 includes:
Goods Receipt
Detail Parts manufacture for
Product Families 1 and 2
Despatch to Site 1 and Site 2
Site 3 includes:
Goods Receipt
Detail Parts manufacture for
Product Families 1 and 2
Despatch to Site 1 and Site 2
33
Introducing AS9104/1 for CBs
• We are going to spend the next section
looking at AS9104/1 section 8
• We will review:
– Certification Structures
– Audit Durations
– Audit durations when combined with
91XX:2009 transition
34
Audit Duration
• Calculating audit duration is one of the most
difficult parts of the certification process
• It is not an absolute process nor does it
produce an absolute answer
• We know it is used as one of the ways some
Certification Bodies (CBs) try to differentiate
themselves from other CBs
• This presentation does not focus on the cost
of AQMS standard certification only the
methodology for calculating audit duration
35
ISO 17021 and Audit Duration
• ISO / IEC 17021 clause 9.1.4 and 9.1.5 set
out the basic requirements for a CB to
determine audit time
• The CB shall have documented procedures to
determine audit time, and
• For each client the CB shall determine time
needed to plan and accomplish a complete
and effective audit …..
• Determined audit time and the justification
for the determination shall be recorded ….
36
ISO 17021 and Audit Duration
• Clause 9.2.1 - CB to collect significant information
about the clients organisation from an authorised
representative
• Clause 9.2.2 - CB to conduct an application
review to consider all of the information
gathered, resolve any lack of understanding and
to ensure that scope, locations, time required to
complete audits and other factors are considered
• Then determine competencies needed for audit
and decision-making
• And … record a justification for the decision to
undertake the audit
37
IAF and Audit Duration
• ISO 17021 requires a process and procedures but
does not state what the time for an audit should
be
• This creates an open market in which competitive
pressure is to constantly reduce the cost of the
certification service and therefore to reduce audit
days
• ISO 17021 recognises this and in clause 4.2.2
states
– ‘It is recognized that the source of revenue for a
certification body is its client paying for
certification, and that this is a potential threat to
impartiality.’
38
IAF and Audit Duration
• To help the CBs and the ABs the IAF produce
Mandatory Documents (MD Series)
• Their status is that they are mandatory
requirements however the CB may propose and
utilise alternates that are equivalent to the MD.
• There are two principle documents affecting audit
duration and time on site:
– IAF MD 5:2009 IAF Mandatory Document for Duration of
QMS and EMS Audits
– IAF MD 1:2007 IAF Mandatory Document for the
Certification of Multiple Sites Based on Sampling
• MD 5 is mainly for single site and MD 1 for multiple sites
39
AS9104/1 and Audit Time
• AS9104/1 tells CBs how to calculate on-site audit
duration
– To reduce commercial competitive pressures on CBs
– To simply the calculation process
• AS9104/1 Clause 8 and Appendix B contain the
requirements
• There is a process as before but it is simplified as
follows:
– Use AS9104/1 Appendix B table to select the correct
certification structure using the eligibility criteria in
addition to the definitions and requirements
– Use section 8 instructions for the certification
structure to determine minimum on-site audit days
40
AS9104/1 and Audit Time
• AS9104/1 Table 2 is used as the basis for all
structures
– The table is IAF MD 5 plus 9104:2006 Table 2
– It is audit days on-site and not audit duration:
» Read AS9104/1 sections 8.2 and 8.2.2 for application
– For 9110 / 9110 ‘including design’ no reduction has
been made on the IAF MD 5 times
– Some limited reduction has been incorporated for ‘no
design’ and ‘9120’ based on the removal of
requirements
– There is therefore no need to make reductions to
Table 2 and for most certification structures audit
time reductions are NOT ALLOWED
41
AS9104/1 and Audit Time
• As a result when comparing AS9104/1 Table 2
to existing contacts based on 9104:2006
– The more creative the CB has been, the bigger the
increase in on-site audit time will be
– If the CB has not correctly applied IAF MD 1 for
multiple site you may see a big increase
– If you CB has not made reductions and has been
effective and fair you will see little or no change in
audit days
• The IAQG OPMT will use of the IAQG OPMT
Complex Certification Structure Oversight
Committee (CSOC) to review complaints
including alleged large increases in audit days!
– Complaints: see IAQG OPMT Procedure 201
42
AS9104/1 and Audit Time
Single Site
• Description
– An organisation that operates at one site
• Eligibility
– Stand-alone self-supporting organisation with no value
stream dependencies from related companies operating
under the same QMS.
– One address.
• Audit Day Requirement
–
–
–
–
–
–
Table 2, using number of employees at site.
Reductions – none, except for ASRP or CAAT
Additions – allowed and expected per MD-5
Initial – one site using Table 2 audit days
Surveillance –using Table 2 surveillance audit days
Recertification – using Table 2 recertification audit days
43
AS9104/1 and Audit Time
Multiple Site
• Description
– An organisation having an identified central function and a
network of sites at which activities are fully or partially
carried out.
– All sites must be doing substantially the same
manufacturing and/or value added process.
• Eligibility
– All sites shall have a legal or contractual link with the
central office.
– One QMS with central control, management review and
internal audit.
– Central office can require other sites implement corrective
action.
– Central collection and analysis of data and ability to initiate
organisational change.
44
AS9104/1 and Audit Time
Multiple Site
• Eligibility (continued)
– Complies with IAF MD 1, “Multi-site Organisation”
definition and eligibility requirements.
– All QMS processes at all sites have to be substantially (i.e.
>80%) the same and are operated to the same methods
and procedures.
– Some sites may conduct fewer processes than others.
– Sampling per IAF MD 1 will be allowed for 9120
certifications.
– One address per site.
45
AS9104/1 and Audit Time
Multiple Site
• Audit Day Requirement
– Table 2, separately using number of employees at each
site.
– Reductions – none, except for ASRP (Cat. 2) or CAAT
– Additions – allowed and expected per MD-5
– Initial – all sites audited using Table 2 audit days
– Surveillance – using 9104/1 Table 3 (Cat. 1 & Cat. 2) for
sampling frequency and Table 2 for audit days at each site
– Recertification – using 9104/1 Table 3 (Cat. 1 & Cat. 2)
for sampling frequency and Table 2 for audit days at each
site
Note:
–
Category 1 (Cat. 1) = meets IAF MD 1 criteria only
–
Category 2 (Cat. 2) = meets MD 1 and MD 3 criteria
46
AS9104/1 and Audit Time
Campus
• Description
– An organisation having an identified central function and a
decentralised, sequential, linked product realisation
process.
• Eligibility
– All sites shall have a legal or contractual link with the
central office.
– One QMS with central control, management review and
internal audit.
– Central office can require other sites implement corrective
action.
– Central collection and analysis of data and ability to initiate
organisational change.
47
AS9104/1 and Audit Time
Campus
• Eligibility (continued)
– The outputs from one site are an input to another site to
realise the final product or service. A single value stream.
– Can be dissimilar processes at different sites or
combination of the sites that contribute to the same overall
product or service being realised.
– More than one product or service may be realized providing
they are substantially (i.e., >80%) the same (e.g., a family
of products) and realised through the same methods and
procedures.
– One address per campus.
48
AS9104/1 and Audit Time
Campus
• Audit Day Requirement
– Table 2, using total number of employees from campus.
– Reductions – none, except for ASRP or CAAT
– Additions – +10% required, plus additions per MD-5
– Initial – all sites using Table 2 for total campus population
+ 10% to Table 2 audit days
– Surveillance – all sites using surveillance per Table 2 for
total campus population + 10% to Table 2 audit days
– Recertification – all sites using recertification per Table 2
for total campus population + 10% to Table 2 audit days
49
AS9104/1 and Audit Time
Several Sites
• Description
– An organisation having an identified central function and a
network of sites that do not meet the criteria for a multiple
site or campus organisation.
– Several sites are listed on the same certificate
• Eligibility
– All sites shall have a legal or contractual link with the central
office.
– One QMS with central control, management review and
internal audit.
– Central office can require other sites implement corrective
action.
– Central collection and analysis of data and ability to initiate
organisational change.
50
AS9104/1 and Audit Time
Several Sites
• Eligibility (continued)
– Processes at each of the sites is not substantially similar
(i.e., <80% similar).
– Processes may be operated to the same or different methods
and procedures that are controlled through one common
management system.
– Sites realise different products or services.
– One address per site.
51
AS9104/1 and Audit Time
Several Sites
• Audit Day Requirement
– Table 2, using number of employees separately at each site.
– Reductions – up to 30% for reduced scope complexity only
as allowed in Table 4, or reductions for ASRP or CAAT
Category
% Decrease *
No Human Resources Processes
10%
No Production or Service Realization
20%
No Purchasing
10%
No Customer Related Processes
10%
No QMS Documentation Control (not applicable for the central
function)
10%
* Up to a maximum 30% cumulative reduction, with justification.
– Additions – allowed and expected per MD-5
– Initial – audit all sites using Table 2 audit durations with
allowable Table 4 reductions at each site
– Surveillance – audit all sites using Table 2 for surveillance
audit days with allowable Table 4 reductions at each site
– Recertification – audit all sites using Table 2 recertification
audit days with allowable Table 4 reductions at each site
52
AS9104/1 and Audit Time
Complex
• Description
– An organisation having an identified central function and a
network of locations that are any combination of multiple
site, campus, several sites, or more than one campus.
• Eligibility
– All sites shall have a legal or contractual link with the central
office.
– One QMS with central control, management review, and
internal audit.
– Central office can require other sites implement corrective
action.
– Central collection and analysis of data and ability to initiate
organizational change.
53
AS9104/1 and Audit Time
Complex
• Eligibility (continued)
– Overall structure contains combinations of multiple site,
campus, several sites or more than one campus.
– Requires IAQG OPMT approval of rationale, justification,
audit day calculations, audit program, and sampling plan (for
9120, multiple site or campus).
– One address per site and campus
54
AS9104/1 and Audit Time
Complex
• Audit Day Requirement
– Use Table 2 for each case of multiple sites, campus, or
several sites.
– Reductions – only as each individual type allows (i.e. several
sites) and for ASRP and/or CAAT if applicable
– Additions – allowed as per each individual type and expected
per MD-5
– Initial – all sites audited based on Table 2 audit days by
combination of types
– Surveillance – dependent upon combination of types
– Recertification – dependent upon combination of types
55
AS9104/1 and Audit Time
Multiple AQMS Certification
• Additional audit days added based on level of integration
– Determine audit days using correct certification structure and
based on Table 2 for the primary standard, based on total
number of employees in the organisation or at each site as
applicable.
– Increase audit days by 15% for fully integrated organisations
– Increase audit days by 30% for partially integrated
organisations
– No reduction for ASRP or CAAT for full or partial integration
– For an organisation that is not integrated the audit days for
each AQMS standard audit shall be independent from one
another using 100% of the required audit days from Table 2.
» The number of employees related to each certification shall be
used to determine each audit day calculation.
56
AS9104/1 and Audit Time
ASRP and Audit Time
(Clause 8.9)
• Advanced Surveillance and Recertification Procedures:
– ASRP is allowed but not mandatory, if used the eligibility
requirements of IAF MD 3 are to be met
– Application of ASRP shall not in itself be a reason to reduce
audit duration
– The ASRP process outlined in IAF MD 3 shall not reduce the
Table 2 required on-site audit duration by more than 30% for
single, campus, several, and complex site certification
structures
– ASRP reductions for multiple site certifications are contained
in Table 3
– NOTE: The organization’s internal auditors shall meet the AA
requirements of 9104/3 and the internal AQMS audit function
shall be led by an individual meeting the requirements of an
AEA
57
AS9104/1 and Audit Time
CAAT and Audit Time
(Clause 8.10)
• Computer Aided Auditing Techniques:
– Use of CAAT is not mandatory
– If use CAAT, conformance to IAF MD 4 is mandatory
– Use of CAAT shall not reduce the Table 2 required onsite audit duration by more than 30%
– Reduced on-site audit time is not eliminated; instead it
shall be allocated to the remote audit time using
appropriate CAAT
– Combined use of CAAT and ASRP shall not reduce the
Table 2 required on-site audit duration by more than
30%
58
Summary
• AS9104/1 introduces new certification structures
• The structures increase complexity
• However, having identified the correct certification
structure the actual calculation of audit days is
simplified under AS9104/1
• Reductions are not allowed except for Several Sites
and for the application of ASRP and CAAT
• Clear requirements for audit days for Multiple AQMS
have been established based on the level of
integration of the systems, processes and methods
• Beware of large claims of increase in audit days –
often it will mean that 9104:2006 requirements
have not been correctly applied
59
Questions
60
Exercise
Calculating On-site audit time:
• In groups you have 20 minutes to:
• Use the site certification structure your group
determined in the earlier exercise:
– Calculate the minimum on-site initial audit duration
assuming no application of ASRP or CAAT and the at
the organisation with EN 9100:2009 certification
– Record (as a separate line) the amount of time for
Preparation and Audit Reporting
– Write a justification for the arrived at minimum time
on site
• Record results on a flip chart
• Nominate one person to feed back
61
Exercise
Calculating On-site Audit Time:
Site 1 includes:
Central Functions
Contract Review
Design
Purchasing
Sub Assembly Product Family 1
Assembly Product Family 1
Testing Product Family 1
Despatch to Customer of Product
Family1
Customer Support
Employees:
Central Functions – 123
Contract Review - 8
Design – 66
Purchasing – 20
Customer Support 20
Product Realisation – 1175
Where functions are shared
employees are split 50% to each
product family (all sites)
Site 2 includes:
Sub Assembly Product Family 2
Assembly Product Family 2
Testing Product Family 2
Despatch to customer of Product
Family 2
Employees:
Product Realisation – 876
Site 4 includes:
Goods Receipt
Detail Parts manufacture for
Product Families 1 and 2
Despatch to Site 1 and Site 2
Employees:
Product Realisation – 478
Site 3 includes:
Goods Receipt
Detail Parts manufacture for
Product Families 1 and 2
Despatch to Site 1 and Site 2
Employees:
Product Realisation – 263
62
Questions
63
Reminder
Hierarchy of Requirements
• Accreditation of CBs to perform ISO 9001
audits includes:
ISO 17021:2006 or ISO 17021:2011
•
IAF Mandatory Documents 1 to 5
•
AB terms and conditions
• In addition the ICOP process adds:
Increasing
Precedence
•
•
For 91xx:2009: 9101:2009 requirements
•
9104 series (AS9104/1, AS9104/2 and AS9104/3)
•
IAQG OPMT Supplemental Rules
•
ICOP Resolutions (IAQG and EAQG OPMT)
64
Reminder
Oversight of CBs:
• Oversight of CBs is essentially the same
processes that an AB uses when assessing a CB
• Described in AS9104/2 clause 8
• Oversight uses two assessment techniques:
-
Assessment of the CB Office
» Management system implementation
» Evidence of deployment and competent operation
-
Witness Assessment
» Assessing the deployment of the CB competence system
through on-site observation
• These techniques are used both in joint team
assessment and industry only OP Assessor
oversight assessment of CBs
65
Reminder
Oversight of CBs:
• AS9104/2 requires that oversight of each CB
each year comprising a minimum of one each:
-
CB Office Assessment (8.6.2) including:
» A review of CB activity to ensure conformance with EN
9104 and AS9104/1 and applicable industry standards
(ISO 17021 and IAF MD)
» a review of the latest CB oversight office assessment
reports, including actions taken
-
CB Witness Assessment (8.2) assessing:
»
»
»
»
Team competence
Conformity to established requirements
The effectiveness of the audit program
Conformity of the audit team with the CB procedures
and processes
• Requirements are complimentary / compatible
with AB expectations
66
Reminder
CB Assessment:
• OP Assessor Requires:
-
EN AS9104/2 Forms
»
»
»
»
-
K - Oversight Assessment Summary Report
J – Oversight Nonconformity Record
F - CB Office Assessment Checklist
G - CB Witness Assessment Checklist
Standards and Reference Documents:
»
»
»
»
»
-
Annex
Annex
Annex
Annex
EN 9104 series (9104, AS9104/1, AS9104/2, AS9104/3)
ISO / IEC 17021
IAF Mandatory Documents 1 to 5 inclusive
IAQG Supplemental Rules (e.g. SR 001, SR 002)
IAQG and EAQG OPMT Resolutions Log
Audit Plan
Copy of previous assessment and oversight reports
including verification evidence for any nonconformities
67
AS9104/2 Check sheets: Annex F & G
•
•
•
•
•
The AS9104/2 check sheets are out of date
They will be updated by the IAQG OPMT
Unlikely to be available until 30th March 2012
Until then, use the existing checklists
Recommended that, if possible, oversight be
delayed until new checklists are available and
AS9104/1 is implemented
• If you need to conduct oversight:
‒ Be very cautious with requirements
‒ Is the oversight to 9104:2006 or AS9104/1, and
using ISO 17021:2006 and / or ISO 17021:2011?
‒ If needed for AS9104/1 oversight, amend the check
sheet to reflect AS9104/1 requirements
68
AS9104/2 Annex F Checklist:
• Use the checklist with caution
• Know your checklist:
-
-
Refers to ISO / IEC Guide 62 which is obsolete – do
you know the ISO 17021:2006 and ISO 17021:2011
references?
Refers to 9104 without the underlying 17021
references
No references to AS9104/1 - if needed amend the
check sheet to reflect AS9104/1 requirements
Not all references are accurate
Split into three sections but does not follow CB
processes
Use of a checklist is mandatory but you can change
it – it is guidance
69
AS9104/2 Annex G Checklist:
• Use the checklist with caution
• Know your checklist:
-
-
Common checklist with AB Witness Assessment
Know which questions refer to AB and which to CB
Refers to ISO / IEC Guide 62 which is obsolete – do
you know the ISO 17021:2006 or ISO 17021:2011
references?
Refers to 9104 without the underlying 17021
references
No references to AS9104/1 - if needed amend the
check sheet to reflect AS9104/1 requirements
Not all references are accurate
Use of a checklist is mandatory but you can change
it – it is guidance
70
Reminder
AS9104/2 Annex B-H – Checklists:
•
•
Each checklist has an information
block on first page
Indicate Assessment Results in this
column for each item
-
•
•
Assessment evidence / comments
box must have the objective
evidence reviewed recorded against
each item assessed – DO NOT
LEAVE BLANK
For Observations or Opportunities
for Improvement:
-
•
A - Acceptable
X – Issue identified
NA – Not applicable
NE – Not evaluated
Mark assessment results ‘A’ – Acceptable
Note the Obs or OFI in the comments box
Make sure you have prepared all of
the required checklists
71
Reminder
AS9104/2 Annex B-H – Checklists:
• Assessment Results – mark the column:
-
A - Acceptable
X – Issue identified
NA – Not applicable
NE – Not evaluated
• If NA, justify why it is not applicable:
– e.g. CB requirement not applicable to AB assessment
• If NE, justify why it was not evaluated:
– e.g. example not seen during assessment
– DO NOT write NE and then record partial evidence of
evaluation
» e.g. AB internal audit, if the AB has not sampled ICOP
scheme client files in the internal audit you still need
to evaluate the AB internal audit process
72
AS9104/1 Transition and Oversight:
• Remember:
– No specific oversight assessment is required as
AB will manage the AS9104/1 transition
– The AB must accredit the CB before the CB can
transition clients
– Oversight may be more effective after
transition to AS9104/1
– Combined transition for CB clients to
91XX:2009 and AS9104/1 will become
confusing
– Take care if combining AS9104/1 transition and
normal oversight assessments
– Watch out for a landslide towards Campus
certification structures!
73
Questions?
74