Company Confidential
Registration Management Committee (RMC) & Auditor Workshop
11
‘Top Ten’ Things Auditors Should Know About 9104/1
OP Assessor WorkshopSan Diego, CA
Jan 19, 2012
Tim Lee The Boeing Company
Chair IAQG OPMT
OP Assessor WorkshopSan Diego, CAJan 19, 2012
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 2
Agenda / Contents
• ‘Top Ten’ Things Auditors Should Know about 9104/1
• What Is The Current Status Of 9104/1?
• Q & A
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 3
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
1) The auditor must educate themselves on certification structures and audit duration requirements, as defined in Appendix B and Table 2
2) The CB shall initiate the client certification suspension process, when an organization fails to demonstrate that conformance to the applicable standard has been re-established within 60 days from the issuance of a Nonconformity Report (NCR) (8.4.d)
3) OASIS Feedback Loop - CB auditors are expected to address this feedback during their management review activity, as well as investigations of product, process, and system issues (14.2)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 4
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
1) The auditor must educate themselves on certification structures and audit duration requirements, as defined in Appendix B and Table 2
2) The CB shall initiate the client certification suspension process, when an organization fails to demonstrate that conformance to the applicable standard has been re-established within 60 days from the issuance of a Nonconformity Report (NCR) (8.4.d)
3) OASIS Feedback Loop - CB auditors are expected to address this feedback during their management review activity, as well as investigations of product, process, and system issues (14.2)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 5
Appendix B, Page 1
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 6
Appendix B, Page 2
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 7
Appendix B, Page 3
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 8
Chapter 8, Table 2
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 9
Chapter 8, Table 2
No reductions in frequency or audit duration allowed, unless specifically
defined in the 9104/1 standard.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 10
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
1) The auditor must educate themselves on certification structures and audit duration requirements, as defined in Appendix B and Table 2
2) The CB shall initiate the client certification suspension process, when an organization fails to demonstrate that conformance to the applicable standard has been re-established within 60 days from the issuance of a Nonconformity Report (NCR) (8.4.d)
3) OASIS Feedback Loop - CB auditors are expected to address this feedback during their management review activity, as well as investigations of product, process, and system issues (14.2)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 11
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
1) The auditor must educate themselves on certification structures and audit duration requirements, as defined in Appendix B and Table 2
2) The CB shall initiate the client certification suspension process, when an organization fails to demonstrate that conformance to the applicable standard has been re-established within 60 days from the issuance of a Nonconformity Report (NCR) (8.4.d)
3) OASIS Feedback Loop - CB auditors are expected to address this feedback during their management review activity, as well as investigations of product, process, and system issues (14.2)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 12
OASIS Feedback Process (Chapter 14, Figure 1)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 13
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
4) The same audit team leader shall be limited to a maximum of two consecutive certification cycles at the client (organization). Rotation of supporting AEAs and auditors after each certification cycle is recommended. (8.3.8)
5) The CB and audit team leader shall ensure that an AEA is on-site and actively involved at each site during the entire audit. In addition, the audit team leader shall be on-site at one or more sites during all audit activity (8.3.3)
6) SMS has the right to withdraw or suspend authentication based on, but not limited to poor performance, non-conformity to requirements, or falsification of data. (4.13)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 14
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
4) The same audit team leader shall be limited to a maximum of two consecutive certification cycles at the client (organization). Rotation of supporting AEAs and auditors after each certification cycle is recommended. (8.3.8)
5) The CB and audit team leader shall ensure that an AEA is on-site and actively involved at each site during the entire audit. In addition, the audit team leader shall be on-site at one or more sites during all audit activity (8.3.3)
6) SMS has the right to withdraw or suspend authentication based on, but not limited to poor performance, non-conformity to requirements, or falsification of data. (4.13)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 15
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
4) The same audit team leader shall be limited to a maximum of two consecutive certification cycles at the client (organization). Rotation of supporting AEAs and auditors after each certification cycle is recommended. (8.3.8)
5) The CB and audit team leader shall ensure that an AEA is on-site and actively involved at each site during the entire audit. In addition, the audit team leader shall be on-site at one or more sites during all audit activity (8.3.3)
6) SMS has the right to withdraw or suspend authentication based on, but not limited to poor performance, non-conformity to requirements, or falsification of data. (4.13)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 16
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
7) Auditors who are withdrawn for cause by an AAB shall not reapply for authentication for 12 months in any sector of the ICOP scheme (7.4)
8) The CB’s audit program shall ensure that a certified organization’s ‘Control of Purchasing’ process is audited at least annually. (8.2.2.n)
9) CBs shall not allow requests by clients for auditor changes/substitutions without substantiated evidence of improper activity or contract violations. (6.12)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 17
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
7) Auditors who are withdrawn for cause by an AAB shall not reapply for authentication for 12 months in any sector of the ICOP scheme (7.4)
8) The CB’s audit program shall ensure that a certified organization’s ‘Control of Purchasing’ process is audited at least annually. (8.2.2.n)
9) CBs shall not allow requests by clients for auditor changes/substitutions without substantiated evidence of improper activity or contract violations. (6.12)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 18
9104/1 ‘Top Ten’• ‘Top Ten’ Things Auditors Should Know about 9104/1
7) Auditors who are withdrawn for cause by an AAB shall not reapply for authentication for 12 months in any sector of the ICOP scheme (7.4)
8) The CB’s audit program shall ensure that a certified organization’s ‘Control of Purchasing’ process is audited at least annually. (8.2.2.n)
9) CBs shall not allow requests by clients for auditor changes/substitutions without substantiated evidence of improper activity or contract violations. (6.12)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 19
9104/1 ‘Top Ten’• ‘Top Ten’ (or Eleven or Twelve) Things Auditors Should
Know about 9104/1
10) Classified material or export control requirements, related to CB auditor access must be determined prior to audit activity (6.11)
11) The audit team leader shall present the complete audit report to the organization within two weeks of the closing meeting using the audit report and associated forms defined in the 9101 standard. (8.5.a)
12) The new 9104/1 standard is firmly based upon the new ISO 17xxx –series standards and the IAF Mandatory Documents [MD-series] (2.0)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 20
9104/1 ‘Top Ten’• ‘Top Ten’ (or Eleven or Twelve) Things Auditors Should
Know about 9104/1
10) Classified material or export control requirements, related to CB auditor access must be determined prior to audit activity (6.11)
11) The audit team leader shall present the complete audit report to the organization within two weeks of the closing meeting using the audit report and associated forms defined in the 9101 standard. (8.5.a)
12) The new 9104/1 standard is firmly based upon the new ISO 17xxx –series standards and the IAF Mandatory Documents [MD-series] (2.0)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 21
9104/1 ‘Top Ten’• ‘Top Ten’ (or Eleven or Twelve) Things Auditors Should
Know about 9104/1
10) Classified material or export control requirements, related to CB auditor access must be determined prior to audit activity (6.11)
11) The audit team leader shall present the complete audit report to the organization within two weeks of the closing meeting using the audit report and associated forms defined in the 9101 standard. (8.5.a)
12) The new 9104/1 standard is firmly based upon the new ISO 17xxx –series standards and the IAF Mandatory Documents [MD-series] (2.0)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 22
9104/1 ‘Top Ten’• ‘Top Ten’ (or Eleven or Twelve) Things Auditors Should
Know about 9104/1
10) Classified material or export control requirements, related to CB auditor access must be determined prior to audit activity (6.11)
11) The audit team leader shall present the complete audit report to the organization within two weeks of the closing meeting using the audit report and associated forms defined in the 9101 standard. (8.5.a)
12) The new 9104/1 standard is firmly based upon the new ISO 17xxx –series standards and the IAF Mandatory Documents [MD-series] (2.0)
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 23
Certification Structure
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012
9104-001 Transition
Tran
sitio
n En
ds
• Sector Management Structures (SMS) will establish risk mitigation plans to accelerate and manage transition activities. (Due 17 Feb 2012)
Jan 2012
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012
• Active Transition Team – Susie Neal, Project Chair– Team face to face meeting - December 2011– Supplemental Rule SR-002 approved by OPMT (31 Jan 2012)
» Aggressive plan for transition» Requirements for all stakeholders» Sector Risk Mitigation Plans (17 Feb 2012)
• Will include AB commitment date» 9104-1 Transition Status Reporting Requirements
– Next steps (30 – 60 Days)» Finalize OPMT/SMS operating procedures» Establish certification structure committee (17 Feb 2012)» Review SMS Risk Mitigation Plans» Provide stakeholder support (FAQ)
SR-002 31 Jan 2012
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 26
Questions ?
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 27
Sites – New Organizational Structures
•Single Site
•Multiple Site
•Campus
•Several Sites
•Complex Sites
The above takes into consideration the unique organizational structures that exist in the Aviation, Space, and Defense industry today.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 28
Single Site StructureA1.1 Example of a Single Site Organization
The organization has one location. It could be organised under one large building or several buildings in one location. In either case the organisation is located on one site. The organisation has multiple products or product families flowing through multiple processes.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 29
Multiple Site StructureA1.2 Example of a Multiple Site Organization
The organization has two sites, A and B. They make two product families X and Y. Product family X is made the same way using the same processes on both sites A and B. Product family Y is only made on site A. This organization makes to customer specification. The central function is located on site A.
Explanation: Site B conducts the same but fewer processes than site A making the same product X. In this way the organization is eligible for a multiple site approach.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 30
Campus StructureA1.3 Example of a Campus Organization
The organisation has four sites with four buildings on site A, four buildings on site B and one building on each site C and D. The organisation has multiple products and product families that all flow through substantially similar processes i.e. one value stream.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 31
Several Site Structure
CustomerOrders
Product X
Site A
Central Function
Site A
Customer Orders
Product YPurchasing
Customer Related Process
Product Realization
Site B
Product Y delivered to Customers
Design
Customer Orders
Product ZPurchasing
Customer Related Process
Product Realization
Site C
Product Z delivered to Customers
PurchasingCustomer Related Process
Product Realization
Product X delivered to Customers
Design
Stream 1
Stream 2
Stream 3
Value Stream
A1.4 Example of a Several Site Organization
The organization has three sites A, B and C that make different product families by mainly dissimilar processes although some of processes such as purchasing are the same. Site C makes to customer specification. Sites A and B design and manufacture their products. Some of the customers for products from each site are the same, others are not.
Registration Management Committee (RMC) & Auditor Workshop
OP Assessor WorkshopSan Diego, CAJan 19, 2012 32
Complex Organization StructureA1.5 Example of a Complex Organization
This organization has 6 sites. It has two different product families. One family is made through product stream 1, the other through product stream 2. The processes carried out within sites C and D are identical realizing the same product through the same processes. The same is true for sites E and F however the processes in E and F are dissimilar from those used in C and D. Sites A and B support both product streams. Sites and A and B use the same facilities for all products even through the types of products manufactured are different and utilize different technologies in their production. Where during the realization processes in sites A and B products in value stream 1 and in value stream 2 use the same processes.
