Working with ANABDo’s and Don’ts

Dale K Gordon – MS Accreditation Manager

20 – July – 2017

ANAB AQMS Topics

• ANAB AS Oversight

• AQMS Transition to 2016 Versions

• OPMT Resolutions

• Other Standards

• Working with ANAB

2

ANAB DATA• 2016 Assessment Results

• Annual Office Audits - AS NCRs

• 97 NCRs for 30 of 37 AQMS CBs

• 15 Majors / 82 AS Minors

• Major OffendersoAS9104/1 – 12.5 – OASIS data (10)

oAS9101 4.2.4 – NCR closure &

ISO17021-1 9.4.9 – NCR / CA (9)

oAS9104/1 8.2.2 - Time, Scope, Objectives, Depth (7)

oAS9101 4.2.2.5 – PEAR form (5)

3

AS9104/1 clause 12.5

The responsibility for the correctness of data in

the OASIS database, regardless of who inputs

the data, is depicted in Table 5.

Data Type & Responsibility

• Organization = Organization

• Audit and Certification = Certification Body

• AQMS Auditor = AQMS Auditor

4

ANAB DATA• 2016 Assessment Results

• Annual AS Witness Audits - NCRs

• 78 NCRs for 26 of 37 AQMS CBs

• 15 Major / 63 Minors

• Major Offenders

oAS9101 – 4.2.1 – Audit Planning

oAS9104/1 – 8.2 (8.2.2) – Audit Planning

• Structure, Duration and Scope

o ISO 17021 – 9.1.9.5.1 – Audit process

(planning)

5

ISO 17021-1• The certification body shall conduct a review of the

application and supplementary information for certification to ensure that:

b) any known difference in understanding between the certification body and the applicant organization is resolved;

• The audit scope shall describe the extent and boundaries of the audit, such as sites, organizational units, activities and processes to be audited. Where the initial or re-certification process consists of more than one audit (e.g. covering different sites), the scope of an individual audit may not cover the full certification scope, but the totality of audits shall be consistent with the scope in the certification document.

• During the audit, information relevant to the audit objectives, scope and criteria (including information relating to interfaces between functions, activities and processes) shall be collected by appropriate sampling and verified to become audit evidence.

6

ANAB Proposed HU on Audit Planning

• ANAB has noted a significant uptick in NCRs

issued during Witnessed Audits in the past year

regarding interrelated requirements of ISO/IEC

17021-1:2015 9.1.1.b, 9.1.2.1.b, 9.2.1.3, 9.2.3.2

and 9.4.4 and AS9101F 4.2.1.a as they relate to

the establishment of an audit plan to assess an

organization’s compliance to ISO 9001:2015

requirements which includes 4.4.1. This clause

specifically addresses an organization’s

responsibility and requirements for establishing

and documenting processes of the QMS their

sequence and their interactions.

7

ANAB Proposed HU on Audit Planning

• What we are clearly seeing is a communication

breakdown between Certification Bodies and

their clients in keeping up to date and current

with established audit plans and the client’s

organizationally defined processes. It is

expected that organizations will change their

processes over time or will have different

understandings of how or what are true QMS

processes and the levels at which they are

described (higher vs lower level processes) and

defining their interactions.

8

ANAB Proposed HU on Audit Planning

Certification Bodies should consider answering these questions during the planning for each audit to be performed;

1. Per ISO 9001 the Client is responsible for identifying the processes and interactions of the organization.

• Does the CB have knowledge of and access to the organization’s process descriptions and interactions for audit planning?

• Does the CB’s audit plan match the processes identified by the organization?

2. An Organization’s sub-processes are often part of higher level process descriptions. Often these sub-processes are detailed in the organizations documentation of their processes

• Is the CB clear on which higher level processes are and which are sub-processes?

• Are these sub-processes reference to or are going be part of the audit program / plan?

3. While interactions of the processes are identified by the organization, some use process maps and diagrams. Does the CB audit program / plan match these descriptions?

4. Has the organization changed descriptions, processes, process names or interactions within the cycle of the certificate and has the CB’s audit program / plan been updated?

9

AQMS Transition Info

10

AQMS Work-in-Process

Transition Activity* (as of 6/29/2017)

11

Standard Applied In-Process Complete(%)

ISO 9001:2015 38 0 38 (100)

17021-1:2015 38 0 38 (100)

AS9100:2016 38 0 38 (100)

AS9110:2016 16 2 14 (88)

AS9120:2016 32 3 29 (94)

*Only reporting on AQMS CBs

Witness Audits of Revised AQMS Standards

1. There are NO changes in auditing requirements

• Minor changes to AS9101

• No changes to AS9104/1 (yet)

2. The standards ARE changed• New concepts, new requirements

• Must look at how ISO 9001 conjoins with the AS requirements – there is an impact

• New AS concepts and requirements

3. WA’s will be looking at auditing depth and soft grading is still an issue

12

Observations to Date

Limited Data Available from Witness Audits

• Comments;

“Auditors are prepared…clients are not”

“Clients are treating the standards as

‘no change’ – hence surprised at

findings”

“Clients are frustrated”

“ Initial audits – no problems – no

baggage from previous rev.”

13

Pending Issues

15

Proposed New Resolution:

9104-001 Clause 8.5.c and Appendix C

For audits conducted to the 2016 version of the Aerospace Quality

Management System (AQMS) standards; the CB shall be responsible for

input of required data into the OASIS database. This shall include the

utilization of the online functionality for audit planning, 9101:2016

forms completion and corrective action management. The CB shall be

responsible for the OASIS publication of the required data within 30 days

after the certificate issue date. For all other audits to the 2016 version of

the standard, the CB shall ensure OASIS publication of audit results within

90 days after the on-site visit date.

For audits conducted to the previous version of the AQMS standard, the

CB shall be responsible for input of required data into the OASIS

database by using the legacy .pdf upload functionality. The CB shall be

responsible for the upload of the required data within 30 days after the

certificate issue date. For all other audits to the previous version of the

standard, the CB shall ensure upload of audit results within 90 days after

the on-site visit date.

.

IAQG OPMT Resolutions

16

Proposed EAQG Resolution:

9104-001 Clause 8.5.c and Appendix C

When required, certified organizations shall support the OASIS online

corrective action management process via direct input into the OASIS

database. The CB and the Client shall ensure that any references to

individuals or information that is deemed classified or export controlled is not

uploaded to the OASIS database in order to comply with regional, national,

international privacy provisions/regulations and IAQG policy.

For audits conducted to the 9100: 2016 (or later) series of the Aerospace Quality

Management System (AQMS) standards; the CB shall be responsible for input of

the required audit data into the OASIS Next Generation database. This shall include

the utilization of the online functionality for audit planning, 9101:2016 (or later) forms

completion and corrective action management.

Certified organizations shall support the CB AQMS audit process via direct input into

the OASIS Next Generation database, including audit planning and the online

corrective action management process.

For audits conducted to the 9100: 2009 series of the AQMS standards, the CB shall

be responsible for input of required audit data into the OASIS Next Generation

database by using the legacy .pdf upload functionality.

.

IAQG OPMT Resolutions

AR 29 Revision – Sites vs Locations

• The ANAB AR29 has previously required that all “addresses” at “sites” be listed on the certificate, in the scope or certification documentation. This has caused some confusion and questions when minor certification modifications occur to correct an address for single site locations with more than one listed address on the certificate.

• To elevate this situation, ANAB is reworded AR29 to recognize that ISO/IEC 17021-1 does not refer to “addresses” or to “buildings” as AS9104/1 does. Hence, this modification will still require the identification of ALL “locations” within the definition of a “single site” but not necessarily addresses of all buildings at the site on the certification document. The revision still requires that a single address represent the complete site and shall be used in OASIS.

• This modification of AR29 will NOT require any changes to existing certificates issued by CB’s for AQMS standards. However going forward and when updating certificates for single sites, this change should be incorporated.

17

OPMT Resolution Pending

Nonconformity Closure before Suspension 9104/1 – 5.3.8 and 8.4.d

• The terms “closed” and “re-established” with respect to a conformity for ABs to CBs and CBs to certificated organizations does not mean closure of the nonconformity has been completely accomplished in the specified day timeframe with respect to corrective actions. It does mean that all "containment" actions are complete. Containment actions will include taking the necessary action to ensure conformance to the existing requirements.

• Additional root cause and corrective action (to prevent recurrence) may take more than the allotted time to complete but all steps and actions to be taken must be documented within the corrective action response.

18

Proposed Revision of Resolution #1109104-001 clause 8.6. and ISO/IEC 17021 clause 8.2.3.e): 9100 series standards reference on AQMS Certificates or AB Accreditation Documents

When referencing an AQMS standard on a certification or accreditation document, the AQMS standard referenced shall be written in full i.e. the AQMS standard(s) including issue letter or revision year, and shall not be abbreviated or changed i.e. AS9100D, or AS9100:2016 or EN 9100:2016 or JISQ 9100:2016. The AQMS standard(s) identified shall be the AQMS standard(s) used for audit of the client.

Where there is a requirement for the CB's or AB's client to refer to more than one equivalent AQMS standard issued by other IAQG sectors, the primary AQMS standard shall be referenced in full and the technically equivalent standards shall be referenced as per one of the following examples given in preferred order:

- AS9100:2016 (technically equivalent to EN 9100:2016 and JISQ 9100:2016)

- EN 9100:2016, AS9100:2016, JISQ 9100:2016

- JISQ 9100:2016 / EN 9100:2016 / AS9100:2016

Where the standard is not numbered “9100” but is a sanctioned 9100 standard or translation of a 9100 standard it can be stated as “technically equivalent” to any of the AS or EN or JISQ versions of the standard as noted above.

• The form AS / EN / JISQ 9100:2016 or similar shall not be used.

Page 19

Pending Resolution on Certificate Transfers w/in 12 months of recertification

Current situation, per 9104-001 8.8.c. says:

• For transfer of AQMS certificates, IAF MD 2 is applicable in full with the following additional requirements:• Transfer of existing certificates expiring within the next 12 months shall require a

Stage 1 and Stage 2 audit.

It does not say that the Stage 1 and Stage 2 must be completed before the transfer of the certificate, but it can be implied.

And, per 9104-001 8.8.d. says:• The accepting CB shall ensure that, prior to certificate issuance, a special audit (on-

site) is carried out by an AEA to confirm the validity of the certification being transferred.

The question is can the “special audit” for a transfer w/in 12 months be the stage 1 and then the stage 2 recert audit be performed after transfer?

Page 20

Proposed Resolution on Certificate Transfersw/in 12 months of recertification

• MD 2:2007 2.2.1 – “Pre transfer Review” - A competent person from the accepting certification body shall carry out a review of the certification of the prospective client. This review shall be conducted by means of a documentation review and should, normally, include a visit to the prospective client. Reasons for not conducting a visit shall be fully justified and documented and a visit shall be conducted if no contact can be made with the issuing certification body.

This does not Mandate an on-site review but it is recommended.

• MD2:2007 2.3.4 - If no further outstanding or potential problems are identified by the pre-transfer review a certification may be issued following the normal decision making process. The program of ongoing surveillance should be based on the previous certification regime unlessthe accepting certification body has conducted an initial or recertification audit as a result of the review.

There is no mention of w/in 12 month limitation

Page 21

Proposed Resolution on Certificate Transfersw/in 12 months of recertification

9101:2016 (and previous) 4.3.6.b. Special Audit• In addition, special audits shall be conducted, during the

certification cycle, in response to one of the following situations:

• transferring certification from one CB to another (see 9104/1 clause 8.8).

But there are no specifics on what must be included in a “special audit”

NOTE: 9101 should not be imposing requirements on organizations, or CBs – this belongs in 9104 only.

Page 22

Proposed Resolution on Certificate Transfersw/in 12 months of recertification

• FAQ #39 currently says - The stage 1 on site audit, which includes validation of the adequacy and validity of the existing certification, can satisfy the requirements for pre-transfer review and the stage 2 audit can satisfy the requirements for the special audit.

FAQ is guidance only and not a requirements document unless made a resolution. The “onsite” Stage 1 should be considered the special audit, then the transfer decision must be made before any recertification Stage 2 audit. Otherwise an organization will have 3 full audits performed if they transfer w/in 12 months of certification. We need to make clear that the transfer decision takes place before the stage 2 audit recertification audit. A Stage 1 is neither surveillance or recertification audit but if we want to retain the 9101 requirement then we have to mandate that the stage 1 is used in lieu of a special audit.

The Alternative is Organizations will just expire their certificates and begin with a new CB (least costly)

Page 23

Proposed Resolution on Certificate Transfers w/in 12 months of recertification

4

• 9104-001 clause 8.8.c.& d., 9101 clause 4.3.6.b and IAF MD 2:2007 – Transfer of certification between accredited Certification Bodies (CBs) w/in 12 months of expiry.

• When an organization is transferring a valid AQMS certificate within 12 months of recertification the CB shall conduct a pre-transfer review per IAQG OPMT resolution 124 and an onsite stage 1 audit which will serve as the special audit.

• Then a transfer decision can be made and followed with a Stage 2 recertification audit at least 3 months before the certificate expiry date.

FAQ #39 then should be cancelled.

Other Standards

• AS 9115 – QMS for Software

• AS9136 – Root Cause Analysis and

Problem Solving (9S Methodology)

• AS9145 - Requirements for Advanced

Product Quality Planning and

Production Part Approval Process

• AS9162 - Aerospace Operator Self-

Verification Programs

25

Working with ANAB

• All Assessors are not always in Agreement• ANAB holds annual training

• When Reading a Standard words matter• Don’t assume to know intent

• When a question or conflict arises…ask• Don’t assume the answer will be no

• Let ANAB know what the issues are• ANAB advocates for the CBs in the AQMS

scheme

26

Open FloorWe’re all Ears…

27