Company Confidential Registration Management Committee (RMC) Mike Roberts Boeing OP Assessor Workshop Other Party (OP) Assessor Workshop San Diego, CA January 20, 2011

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Agenda / Contents Task & History Special Team Recommendations OPMT (Executive) Decisions Significant Changes From 9104A Status Latest Schedule+ What Does This Mean To OP Assessors Q & A [Note: Site Descriptions Included in Presentation Media]

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Original Re-write Task Requirements Complete the Trilogy of 9104-series documents, by revising 9104A Remove sections made redundant by the release of 9104/2 (Oversight) and 9104/3 (Auditor Training and Qualification) Address the areas of ICOP concern, by enhancing/revising topics identified in the OPMT FMEA (eg. audit days, multi-site, etc.) Upgrade to the new ISO and IAF audit docs.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) History Project initiated in Melbourne AUS in Apr. 07 Team activity at each Spring and Fall IAQG OPMT meeting Full week face-to-face in Long Beach, Jun. 08 Several focus meetings due to controversial topics (eg. audit day table, multi-site, ASRP) Formal Preliminary Review 8/09 to 11/09 Formal Ballot initiated 1/10

San Diego, CA January 20, 2011 Registration Management Committee (RMC) History CONTINUED Ballot failed in the Americas (3/10) due to controversy over definition of site Ballot failed in Asia (3/10) due to mandatory audit days and a variety of individual concerns. Ballot stopped in Europe (4/10) due to majority voting disapprove due to mandatory (no reductions) requirements of audit day table In total, over 60 pages (over 350 comments) were collected related to the ballot process. It was discovered that Europe and Asia have not been following IAF audit day requirements. They now feared the consequences and costs of requiring suppliers to meet the new increased day requirements.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) History CONTINUED At the Wash DC IAQG meeting, the OPMT reached an impasse; it was unable to achieve consensus as to what direction would be given to the 9104/1 team to solve the ballot failure issues. The OPMT Sector Leads brought the issue to the SWG for guidance and direction. Some on SWT questioned whether ISO 9001-basis and ISO/IAF compliance was necessary. The SWG ordered that a special, non-advocate team be commissioned to review the issues, identify and resolve conflicts, and define new requirements that, as a minimum, meet the ISO 17xxx and IAF-MD standards. The team was given a June 23 rd deadline to complete.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) History CONTINUED The Special Non-Advocate Review Team Facilitators: Ian Folland & Tim Lee Team Members: Roger Bennett - International Independent Organization for Certification (IIOC) – IAF MD 1 Convener and IAF MD 5 Co-convener Reg Blake - Certification Body (CB) representing the Independent Association of Accredited Registrars (IAAR) Norbert Borzek - German AB - DAkkS – Chair of the IAF Technical Committee. Patrick Boucheron – Turbomeca, France, OPMT Voting Member Buddy Cressionnie - IAQG 9100 International Document Representative (IDR) Randy Dougherty – USA AB - ANAB Director – Chair of the IAF Michel Jacquaniello – Zodiac Aerospace, France Kunihiro Tanabe - Japanese AB - JAB Norikazu Tsuchiya – KHI, Japan, OPMT Voting Member

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Team Recommendations The special team recommended keeping the previously developed (first ballot) audit day table [Table 2] and multiple site requirements table [Table 6]. The team developed new definitions and criteria for sites. The team created a detailed 17 page Recommendations document and 9104/1 Certification Matrix

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Sites – New Organizational Structures Single Site Multiple Site Campus Several Sites Complex Sites These take into consideration the unique organizational structures that exist in the Aviation, Space, and Defense industry today.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Audit Day Table 2 [same as balloted 9104/1]

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Multiple Site Table 6 [same as balloted 9104/1]

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Reductions (and Additions) No reductions allowed unless applying ASRP or CAAT. Additions allowed and expected Some reductions allowed for Several Sites

San Diego, CA January 20, 2011 Registration Management Committee (RMC) OPMT (Executive) Decisions Accepted the Special Team Definitions for Sites and Auditor Day Requirements –Five Categories of Site Certification Structures »Single Site »Multiple Site »Campus »Several Site »Complex –Table 2 from Previous Ballot Remains the Same –Table 6 from Previous Ballot Remains the Same

San Diego, CA January 20, 2011 Registration Management Committee (RMC) OPMT (Executive) Decisions (Continued) Time for filling out forms was not included in previous Audit Day Table (8.2.2.c), but was added: –Note: The entry of data on the 9101 Obective Evidence Record (OER) during on site audit time is acceptable. Audit calculations shall round up to the nearest ½ day. Audit activity shall never be less than 1 audit day per site.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) OPMT (Executive) Decisions (Continued) Combined and Integrated Audits –Certification of a site to more than one AQMS »Fully Integrated and Partially Integrated Rules and Criteria Defined »Audit Team Technical Areas Defined » Audit Day Requirements Add 15% for Fully Integrated Add 30% for Partially Integrated ASRP and CAT shall not reduce this number Not Integrated requires separate 100% audits.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Significant 9104/1 Changes Unchanged From Previous Failed Ballot Defines AQMS and ICOP Updates with the new ISO-17xxx-series and IAF MD-x – series requirements standards Sets surveillance requirements (# files, # assessments) Sets CB requirements (OASIS data responsibility, administrator, resolution process, suspension and withdrawal requirements, ASRP and CAAT rules, export and confidentiality rules) Sets auditing rules (team lead must be AEA and on-site, site-limited to two certification cycles, 8 hour audit day) Sampling of sites limited to 9120 and in same country

San Diego, CA January 20, 2011 Registration Management Committee (RMC) More Significant Changes CONTINUED Rules for certificate issuance and transfers, loss of certification, scope changes Rules for adding and auditing multiple AQMS standards Introduces Auditor Authentication Bodies (AABs) and Training Provider Approval Bodies (TPABs) Rules for OASIS responsibility and administration Authority of OPMT and SMS structures Requirements for OASIS Feedback Process Rules for organization access, loss notification, T1 data Rules for confidentiality and conflict of interest

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Status: 1/14/2011

San Diego, CA January 20, 2011 Registration Management Committee (RMC) 9104/1 Best-Case Schedule

San Diego, CA January 20, 2011 Registration Management Committee (RMC) What Does This Mean To OP Assessors The requirements for ICOP have become more controlled and complex. Due to the new site structures of the organizations, better audit planning will be required. There is a higher level of expectation of auditor competency. While 9100 focuses on process, 9104/1 adds focus to the central function processes. Auditors will be held to a higher standard in the future. Publication of 9104/1 will complete the Trilogy, fully describing the aerospace management of quality systems.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Questions ?

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Back-up Slides

San Diego, CA January 20, 2011 Registration Management Committee (RMC) 9104/1 Rewrite Team

San Diego, CA January 20, 2011 Registration Management Committee (RMC) What Does This Mean To The RMC We have been waiting 4 years to complete the Trilogy. We had to compensate by preparing alternate plans for the implementation of 9100C and 9101D. Due to the new site structures for organizations, new audit planning will be required for each certified organization. There is a higher level of expectation of auditor competency. While 9100 focuses on process, 9104/1 adds focus to the central function processes. OASIS changes will be required.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Issues and Comments We have reduced auditor days for organizations with no design. But we also have a number of organizations with no manufacturing. Should we consider no manufacturing be an or criteria for the no design reduced audit day table column?

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Site Descriptions

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Sites – New Organizational Structures Single Site Multiple Site Campus Several Sites Complex Sites The above takes into consideration the unique organizational structures that exist in the Aviation, Space, and Defense industry today.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Single Site Structure A1.1 Example of a Single Site Organization The organization has one location. It could be organised under one large building or several buildings in one location. In either case the organisation is located on one site. The organisation has multiple products or product families flowing through multiple processes.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Single Site Structure Eligibility –Stand alone self-supporting organization with no dependencies operating under single QMS Audit Day Reqmt –Table 2, using number of employees at site. –Reductions – none, except for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – one site using Table 2 audit duration –Surveillance – annual using 1/3 Table 2 audit duration –Recertification – using 2/3 Table 2 audit duration Certificate/OASIS –Single address listing –Scope declared –Single OIN

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Multiple Site Structure A1.2 Example of a Multiple Site Organization The organization has two sites, A and B. They make two product families X and Y. Product family X is made the same way using the same processes on both sites A and B. Product family Y is only made on site A. This organization makes to customer specification. The central function is located on site A. Explanation: Site B conducts the same but fewer processes than site A making the same product X. In this way the organization is eligible for a multiple site approach.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Multiple Site Structure Eligibility –All sites have a legal, contractual link with central office. One QMS, central control, mgt review, and internal audit. Meets MD-1 criteria. One address per site. Audit Day Reqmt –Table 2, separately using number of employees at each site. –Reductions – none, except for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – all sites audited using Table 2 audit duration –Surveillance – using 9104/1 Table 6 (Cat. 1 & Cat. 2) –Recertification – using 9104/1 Table 6 (Cat. 1 & Cat. 2) Certificate/OASIS –Central function and all sites listed. –Scope declared for each site. Central function identified. –Central Function OIN and all other sites OIN listed.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Campus Structure A1.3 Example of a Campus Organization The organisation has four sites with four buildings on site A, four buildings on site B and one building on each site C and D. The organisation has multiple products and product families that all flow through substantially similar processes i.e. one value stream.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Campus Structure CONTINUED Explanation: Although there are different products that go through different processes in the organisation the controlling factors are that more than 80% of the processes in the realisation of the product are the same and all products flow through the same overall value chain before being delivered to the customer. Even if site B was split into four separate sites making different types of detail parts such as machined, formed, carbon-fibre or similar and where appropriate using the treatments site this organisation would still be a campus as all sites contribute to a value steam of processes running through the organisation with a commonality that 80% of the processes that make up each product are the same.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Campus Structure Eligibility –All sites have a legal, contractual link with central office. One QMS, central control, mgt review, and internal audit. Output (can be dissimilar) of one site feeds input of other sites. One address per campus. Audit Day Reqmt –Table 2, using number of employees from campus. –Reductions – none, except for ASRP or CAAT –Additions – 10% required, plus additions per MD-5 –Initial – all sites, Table 2 for campus population + 10% –Surveillance – 1/3 initial per Table 2 plus 10% –Recertification – 2/3 initial per Table 2 plus 10% Certificate/OASIS –Single controlling address listing on certificate –Scope declared for entire campus. Central function IDd. –Single OIN for controlling address. Central function IDd.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Several Site Structure A1.4 Example of a Several Site Organization The organization has three sites A, B and C that make different product families by mainly dissimilar processes although some of processes such as purchasing are the same. Site C makes to customer specification. Sites A and B design and manufacture their products. Some of the customers for products from each site are the same, others are not.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Several Site Structure CONTINUED Explanation: This organization has three essentially different sites with three different sets of processes. The organization does not qualify for multiple site because of the different processes and does not qualify for campus as products in the value stream do not flow from one site to another. The organization is a several site organization.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Several Site Structure Eligibility –All sites have legal contractual link with central office, but processes and products not substantially similar. Audit Day Reqmt –Table 2, using number of employees separately at each site. –Reductions – up to 30% for reduced scope complexity, or reductions for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – all sites using Table 2 audit durations –Surveillance – 1/3 Table 2 audit duration, reduced as above –Recertification – 2/3 Table 2 audit duration reduced as above Certificate/OASIS –Central function and all sites listed on certificate –Overall scope declared, and scope for each site –Central function and all sites have unique OIN. CF identified.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Complex Organization Structure A1.5 Example of a Complex Organization This organization has 6 sites. It has two different product families. One family is made through product stream 1, the other through product stream 2. The processes carried out within sites C and D are identical realizing the same product through the same processes. The same is true for sites E and F however the processes in E and F are dissimilar from those used in C and D. Sites A and B support both product streams. Sites and A and B use the same facilities for all products even through the types of products manufactured are different and utilize different technologies in their production. Where during the realization processes in sites A and B products in value stream 1 and in value stream 2 use the same processes.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Complex Organization Structure CONTINUED Explanation: This organization is a complex organization because it has elements of multiple site and several campuses within it. Sites C and D are eligible for a multiple site approach. Sites E and F would also be eligible for multiple site approach. However the combination of C, D, E and F are not eligible for multiple site all together because the processes are different between C or D and E or F. There are however two campuses within the organization. The value stream through A, B and C or D and the second value stream through A, B and E or F. This organization is therefore made up of two campuses with a multiple site combination within each campus, an example of a complex organization.

San Diego, CA January 20, 2011 Registration Management Committee (RMC) Complex Organization Structure Eligibility –Sites have legal contractual link with central office. One QMS with combinations of site structures. Requires IAQG OPMT approval. Individual addresses per sites or campus. Audit Day Reqmt –Use Table 2 for each case of single, multiple, campus, several. –Reductions – per individual site type –Additions – per individual site type, & expected per MD-5 –Initial – all sites using Table 2 audit duration –Surveillance – dependent upon combination –Recertification – dependent upon combination Certificate/OASIS –Central Function and all sites and/or campuses. –All sites & campuses scopes declared. CF identified. –All sites & campuses have unique OIN. CF identified.