Company Confidential Registration Management Committee (RMC) & Auditor Workshop /1 “Completing the Trilogy” Atlanta, GA July 23, 2010 Michael C Roberts 9104/1 Team Lead The Boeing Company Auditor Workshop Atlanta, GA July 22-23, 2010

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Agenda / Contents Task & History Team Activities Audit Day Table Multiple Site Table Site Definition Other Significant Changes What Does This Mean To Auditors Latest Schedule Q & A

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Caveat Emptor The information contained herein is the latest recommendations. But, the final draft has not been released and this material has not been balloted. Any deviations between this presentation and the draft or balloted works of the 9104/1 rewrite team or the special requirements team – the teams’ proposals shall prevail. This presentation is a best effort to summarize the recommended requirements.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, /1 Rewrite Team

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Original Task Requirements Complete the Trilogy of 9104-series documents, by revising 9104A Remove sections made redundant by the release of 9104/2 (Oversight) and 9104/3 (Auditor Training and Qualification) Address the areas of ICOP concern, by enhancing/revising topics identified in the OPMT FMEA (eg. audit days, multi-site, etc.) Upgrade to the new ISO and IAF audit docs.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, History Project initiated in Melbourne AUS in Apr. ’07 Team activity at each Spring and Fall IAQG OPMT meeting Full week face-to-face in Long Beach, Jun. ’08 Several focus meetings due to controversial topics (eg. audit day table, multi-site, ASRP) Formal Preliminary Review 8/09 to 11/09 Formal Ballot initiated 1/10

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, History CONTINUED Ballot failed in the Americas (3/10) due to controversy over definition of ‘site’ Ballot failed in Asia (3/10) due to audit days and a variety of individual concerns. Ballot stopped in Europe (4/10) due to majority voting ‘disapprove’ due to mandatory requirements of audit day table Discovered that Europe and Asia have not been following IAF audit day requirements and fear consequences and costs of requiring suppliers to meet the new requirements.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, History CONTINUED At the Wash DC IAQG meeting, the OPMT reached an impasse, as it was unable to achieve consensus as to what direction to be given to the 9104/1 team to solve the ballot failure issues. The OPMT Sector Leads brought the issue to the SWG for guidance and direction. The SWG ordered that a special, non- advocate team be commissioned to review the issues, identify and resolve conflicts, and define new requirements that, as a minimum, meet the ISO 17xxx and IAF-MD standards.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, History CONTINUED The Special Non-Advocate Review Team Facilitators: Ian Folland & Tim Lee Team Members: Roger Bennett - International Independent Organization for Certification (IIOC) – IAF MD 1 Convener and IAF MD 5 Co-convener Reg Blake - Certification Body (CB) representing the Independent Association of Accredited Registrars (IAAR) Norbert Borzek - German AB - DAkkS – Chair of the IAF Technical Committee. Patrick Boucheron – Turbomeca, France, OPMT Voting Member Buddy Cressionnie - IAQG 9100 International Document Representative (IDR) Randy Dougherty – USA AB - ANAB Director – Chair of the IAF Michel Jacquaniello – Zodiac Aerospace, France Kunihiro Tanabe - Japanese AB - JAB Norikazu Tsuchiya – KHI, Japan, OPMT Voting Member

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Team Recommendations The team developed a detailed document containing the following concepts: –Definitions and eligibility criteria for single site, multiple site, campus, several site, and complex organizations –Audit day calculations methodology for all organizational types (above) –Information in the form of a matrix and diagrams to help understand and train the different types of organizations –Utilized as much of IAF Mandatory Documents language, as possible

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Audit Day Table 2 [same as balloted 9104/1]

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Multiple Site Table 6 [same as balloted 9104/1]

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Sites – New Organizational Structures Single Site Multiple Site Campus Several Sites Complex Sites The above takes into consideration the unique organizational structures that exist in the Aviation, Space, and Defense industry today.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Single Site Structure A1.1 Example of a Single Site Organization The organization has one location. It could be organised under one large building or several buildings in one location. In either case the organisation is located on one site. The organisation has multiple products or product families flowing through multiple processes.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Single Site Structure Eligibility –Stand alone self-supporting organization with no dependencies operating under single QMS Audit Day Req’mt –Table 2, using number of employees at site. –Reductions – none, except for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – one site using Table 2 audit duration –Surveillance – annual using 1/3 Table 2 audit duration –Recertification – using 2/3 Table 2 audit duration Certificate/OASIS –Single address listing –Scope declared –Single OIN

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Multiple Site Structure A1.2 Example of a Multiple Site Organization The organization has two sites, A and B. They make two product families X and Y. Product family X is made the same way using the same processes on both sites A and B. Product family Y is only made on site A. This organization makes to customer specification. The central function is located on site A. Explanation: Site B conducts the same but fewer processes than site A making the same product X. In this way the organization is eligible for a multiple site approach.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Multiple Site Structure Eligibility –All sites have a legal, contractual link with central office. One QMS, central control, mgt review, and internal audit. Meets MD-1 criteria. One address per site. Audit Day Req’mt –Table 2, separately using number of employees at each site. –Reductions – none, except for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – all sites audited using Table 2 audit duration –Surveillance – using 9104/1 Table 6 (Cat. 1 & Cat. 2) –Recertification – using 9104/1 Table 6 (Cat. 1 & Cat. 2) Certificate/OASIS –Central function and all sites listed. –Scope declared for each site. Central function identified. –Central Function OIN and all other sites OIN listed.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Campus Structure A1.3 Example of a Campus Organization The organisation has four sites with four buildings on site A, four buildings on site B and one building on each site C and D. The organisation has multiple products and product families that all flow through substantially similar processes i.e. one value stream.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Campus Structure CONTINUED Explanation: Although there are different products that go through different processes in the organisation the controlling factors are that more than 80% of the processes in the realisation of the product are the same and all products flow through the same overall value chain before being delivered to the customer. Even if site B was split into four separate sites making different types of detail parts such as machined, formed, carbon-fibre or similar and where appropriate using the treatments site this organisation would still be a campus as all sites contribute to a value steam of processes running through the organisation with a commonality that 80% of the processes that make up each product are the same.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Campus Structure Eligibility –All sites have a legal, contractual link with central office. One QMS, central control, mgt review, and internal audit. Output (can be dissimilar) of one site feeds input of other sites. One address per campus. Audit Day Req’mt –Table 2, using number of employees from campus. –Reductions – none, except for ASRP or CAAT –Additions – 10% required, plus additions per MD-5 –Initial – all sites, Table 2 for campus population + 10% –Surveillance – 1/3 initial per Table 2 plus 10% –Recertification – 2/3 initial per Table 2 plus 10% Certificate/OASIS –Single controlling address listing on certificate –Scope declared for entire campus. Central function ID’d. –Single OIN for controlling address. Central function ID’d.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Several Site Structure A1.4 Example of a Several Site Organization The organization has three sites A, B and C that make different product families by mainly dissimilar processes although some of processes such as purchasing are the same. Site C makes to customer specification. Sites A and B design and manufacture their products. Some of the customers for products from each site are the same, others are not.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Several Site Structure CONTINUED Explanation: This organization has three essentially different sites with three different sets of processes. The organization does not qualify for multiple site because of the different processes and does not qualify for campus as products in the value stream do not flow from one site to another. The organization is a several site organization.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Several Site Structure Eligibility –All sites have legal contractual link with central office, but processes and products not substantially similar. Audit Day Req’mt –Table 2, using number of employees separately at each site. –Reductions – up to 30% for reduced scope complexity, or reductions for ASRP or CAAT –Additions – allowed/expected per MD-5 –Initial – all sites using Table 2 audit durations –Surveillance – 1/3 Table 2 audit duration, reduced as above –Recertification – 2/3 Table 2 audit duration reduced as above Certificate/OASIS –Central function and all sites listed on certificate –Overall scope declared, and scope for each site –Central function and all sites have unique OIN. CF identified.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Complex Organization Structure A1.5 Example of a Complex Organization This organization has 6 sites. It has two different product families. One family is made through product stream 1, the other through product stream 2. The processes carried out within sites C and D are identical realizing the same product through the same processes. The same is true for sites E and F however the processes in E and F are dissimilar from those used in C and D. Sites A and B support both product streams. Sites and A and B use the same facilities for all products even through the types of products manufactured are different and utilize different technologies in their production. Where during the realization processes in sites A and B products in value stream 1 and in value stream 2 use the same processes.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Complex Organization Structure CONTINUED Explanation: This organization is a complex organization because it has elements of multiple site and several campuses within it. Sites C and D are eligible for a multiple site approach. Sites E and F would also be eligible for multiple site approach. However the combination of C, D, E and F are not eligible for multiple site all together because the processes are different between C or D and E or F. There are however two campuses within the organization. The value stream through A, B and C or D and the second value stream through A, B and E or F. This organization is therefore made up of two campuses with a multiple site combination within each campus, an example of a complex organization.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Complex Organization Structure Eligibility –Sites have legal contractual link with central office. One QMS with combinations of site structures. Requires IAQG OPMT approval. Individual addresses per sites or campus. Audit Day Req’mt –Use Table 2 for each case of single, multiple, campus, several. –Reductions – per individual site type –Additions – per individual site type, & expected per MD-5 –Initial – all sites using Table 2 audit duration –Surveillance – dependent upon combination –Recertification – dependent upon combination Certificate/OASIS –Central Function and all sites and/or campuses. –All sites & campuses scopes declared. CF identified. –All sites & campuses have unique OIN. CF identified.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Reductions (and Additions) “No reductions allowed unless applying ASRP or CAAT.” “Additions allowed” Some reductions allowed for “Several Sites”

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Other Significant Changes Defines AQMS and ICOP Updates to the new ISO-17xxx-series and IAF MD-x – series requirements standards Sets surveillance requirements (# files, # assessments) Sets CB requirements (OASIS data responsibility, administrator, resolution process, suspension and withdrawal requirements, ASRP and CAAT rules, export and confidentiality rules) Sets auditing rules (team lead must be AEA and on-site, site-limited to two certification cycles, 8 hour audit day) Sampling of sites limited to 9120 and in same country

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Other Significant Changes CONTINUED Rules for certificate issuance and transfers, loss of certification, scope changes Rules for adding and auditing multiple AQMS standards Introduces Auditor Authentication Bodies (AABs) and Training Provider Approval Bodies (TPABs) Rules for OASIS responsibility and administration Authority of OPMT and SMS structures Requirements for OASIS Feedback Process Rules for organization access, loss notification, T1 data Rules for confidentiality and conflict of interest

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, What Does This Mean To Auditors The requirements for ICOP have become more controlled and complex. Due to the new ‘site’ structures of the organizations, better audit planning will be required. There is a higher level of expectation of auditor competency. While 9100 focuses on process, 9104/1 adds focus to the ‘central function’ processes. Auditors will be held to a higher standard in the future. Publication of 9104/1 will complete the “Trilogy”, fully describing the aerospace management of quality systems.

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Latest Schedule

Registration Management Committee (RMC) & Auditor Workshop Atlanta, GA July 22-23, Questions ?