Michelle Barton – Lead Technical Reviewer/Auditor UL DQS Inc. AS9104/1 Transition Presented by: Michelle Barton – Lead Technical Reviewer/Auditor UL DQS Inc.

Welcome New industry requirements that impact both of us. We must continue to work together to satisfy.

AGENDA for AS9104/1 Transition Webinar General overview of AS9104/1 Significant Changes Identified OASIS Reporting Audit Day Duration Transfer Process Suspension/Withdrawal Contract Addendum Certification Structure and we encourage all to purchase AS9104/1 from SAE website to become more intimate with the requirements

UL DQS website postings Customer Communications Impact newsletter Two webinars Direct mailings UL DQS Auditors UL DQS website postings Please let your customer service rep know if you are not receiving these.

AS9104/1 Overview Requirements for Aviation, Space, and Defense Quality Management System Certification Programs. Replaces AS9104 – currently referenced on all AS9100/9110/9120 certificates.

Audit Process Improvements (AS9101 Rev D) AS9104/1 Revision Audit Process Improvements (AS9101 Rev D) Consistency of Auditor Training (AATT) Various other changes in the aerospace registration scheme requirements Feedback from the IAQG leadership resulted in improvements to the aerospace registration scheme (ICOP)

AS9104/1 Revision Continued… This revision of AS9104/1 is a complete rewrite of the original 9104 document The document increased from 30 to 49 pages

Implementation Supplemental Rule 002 (SR-002) document contains supplemental rules for all stakeholders (including certified organizations) to facilitate the transition from the existing AS9104 standard to the new AS9104/1 standard. Available on the SAE OASIS website

Timeline All audits performed on or after January 1, 2013 must be in compliance with AS9104/1.

Notification Changes You MUST notify UL DQS in case a major finding is issued by a customer You MUST notify UL DQS of significant changes (address, ownership, key management, employee count, scope of operations, etc.) You MUST notify customers immediately if your AQMS certification is withdrawn

Nonconformance Changes Certified organizations face suspension if you fail to demonstrate conformance within 60 days from issue of NCR. Certified organizations required to notify customer where applicable (containment of potential NC product, major finding, etc.) More robust corrective action process. Greater emphasis on containment and root cause. Available resources include: ANAB Heads Up #137 – Corrective action guidelines IAQG Supply Chain Management Handbook (best practices) Inadequate CA responses will be rejected.

Role of OASIS Administrator Must be identified prior to certificate being issued and inclusion in OASIS Failure to maintain an admin. can result in suspension Responsible for maintaining data in OASIS Must access OASIS at a minimal of every 3 months or will be deactivated. with respect to org name and address, identification of OASIS Administrator, and contact person

Significant Changes to OASIS Reporting Certified Organizations must allow CB to post Tier 1 and Tier 2 Audit Data to OASIS Database. Tier 1 is Public Information Agree to provide access to Tier 2 data to their customers and potential customers upon request Tier 1 is Public Information (name, scope, exclusions, certificate) Agree to provide access to Tier 2 data (Report, PEARs, PMR, NCRs) to their customers and potential customers upon request (unless justified by competition confidentiality, conflict of interest, etc.)

OASIS Feedback Process

Significant Changes to CB Requirements Ensure access for audits involving areas and materials which are classified and/or export controlled prior to audit. The scope of certification shall not include processes that were not audited to sufficient depth to verify client (organization) conformance. ‘Control of Purchasing’ process audited annually. NCRs must be left at the end of the on-site audit the remaining documents delivered within 2 weeks. CB and any legal entity may not consult

Changes to Auditor Assignment Lead auditor MUST rotate after 2 audit cycles Can return after being off for 1 audit cycle Client may not request auditor changes unless there are significant issues. Client may not request auditor changes unless there are citizenship issues, confidentiality/conflict of interest, or substantiated evidence of improper activity or contract violations

Significant Changes to Audit Duration New table specifies Initial, Surveillance, & Recertification Days for 9100/9110, 9100/9110 less Design, and 9120. NO reductions from Audit Day Table are allowed, unless specifically defined. Increases to Audit Day Table are both allowed and expected.

Significant Changes to Audit Duration Audit Day Table: DOES NOT include Non-Audit Time (travel, meals, extended breaks, etc.) DOES NOT include Auditor Time for Audit Planning, Writing of Reports, Filling Out 9101 Forms, etc. Extra time for correction and corrective action verification, use of translators, etc.

Significant Changes to Audit Day Audit Day is 8 Hours More than 8 hours = 8 hours Must audit ALL working shifts Shift auditing still meets 8 hour daily limitation If work less than 8 hours per day, extra days must be added to maintain on-site duration If stage 1 is required at recertification, audit time is to be added to the minimal Triennial Days More than 8 hours = 8 hours (cannot do 4 days of 10 hrs to equal 40 hours)

Significant Changes to Transfer Process Desktop review still required. On-site special visit required by an AEA before certificate issuance. If existing certificate expires within the next 12 months, an S1 and S2 are required. If any NCRs from the previous audits were not verified and closed within 90 days of issuance, S1 and S2 are required

Significant Changes to Oversight Activity Increased number of witness audits. Industry has access to audit reports in OASIS. Certified organizations must allow 3rd parties (AB, etc.) to accompany UL DQS for witness audits. Some AS&D primes are reviewing reports in OASIS. Industry has access to audit reports in OASIS and they are looking at them. Certified organizations must allow 3rd parties (AB’s, OP Assessors, regulatory bodies) right to accompany UL DQS during oversight witness audits Some AS&D primes are reviewing the reports in OASIS as part of their supplier evaluation process.

Significant Changes to Suspension/Withdraw If not in conformance within 60 days of the issuance of the NCR, suspension If no OASIS administrator, possible suspension. If OASIS information is not kept up-to-date, possible suspension. If withdrawn, immediate notification to AS&D customers by client Failure to abide by AS9104/1 shall be cause for certification withdrawal

Contract addendum will be sent to each certified organization. Significant Changes to Contract (Addendum) AS9104/1 requires UL DQS to flow down requirements and amend existing contracts. Contract addendum will be sent to each certified organization.

New additions to Contract ID of appropriate certification structure Access to tier 1 & 2 data Provide access to the Tier 2 data in the OASIS database Notification to customers if AQMS certification is withdrawn Notification to UL DQS in case a major finding is issued by a customer ID of OASIS administrator Robust corrective action process

New additions to Contract Effective complaint resolution process and right to perform short notice audit within 90 days Disclosure of classified material/export requirements relating to UL DQS access to processes/materials Right of 3rd parties to accompany UL DQS during oversight witness audits Certificate withdrawal due to failure to comply with contract addendum and AS9104/1 Constraints to request for auditor changes/substitutions Disclosure of top 5 aviation, space & defense customers, contact information & percent of business

Certification Structure Types Single site Multiple site Campus Several site Complex Industry anticipates that (~)80% of registrations will be Single Sites Must be determined prior to audit days being determined as method depends on structure.

Single Site An organization having one location. The organization may be operating under one large building or several buildings at that location. The organization may have one or multiple products or product families flowing though one or multiple processes.

all sites are subject to the organization’s internal audit program, Common eligibility criteria for all certification structures except single site: all sites have a legal, organizational, or contractual link with the central office and are subject to a common management system, the organization’s management system is subject to a common management review; all sites are subject to the organization’s internal audit program, the central office has the authority to require that the site(s) implement corrective action

Common eligibility criteria cont… The organization collects and analyzes data from all sites. The central office is able to demonstrate its authority and ability to initiate organizational change, in regard to: system documentation; system changes; management review; complaints; evaluation of corrective actions; internal audit planning and evaluation of the associated audit results; and legal requirements.

Multiple Site An organization having an identified central function (the central office, but not necessarily the headquarters of the organization) at which certain activities are planned, controlled, or managed and a network of sites at which such activities are fully or partially carried out. With the exception of the central office the processes within each of the sites are substantially the same and are operated to the same methods and procedures.

Campus An organization having an identified central function (the central office, but not necessarily the headquarters of the organization) at which certain activities are planned, controlled, or managed; and that has a decentralized, sequential, linked product realization process. For the purposes of this standard, it is referred to as a value stream where the outputs from one site are an input to another site, which ultimately results in the final product or service.

Several Sites An organization having an identified central function (the central office, but not necessarily the headquarters of the organization) at which certain activities are planned, controlled, or managed and a network of sites, that do not meet the criteria for either a multiple site or a campus organization.

Complex An organization having an identified central function (the central office, but not necessarily the headquarters of the organization) at which certain activities are planned, controlled, or managed and a network of locations that are any combination of multiple site, campus, several sites, or more than one campus.

Appendix B, Page 1

Appendix B, Page 2

Appendix B, Page 3

How Certification Structures are used UL DQS and the certified organization will need to agree on the appropriate certification structure for your organization based on criteria defined in appendix B of AS9104/1. Certification structure form – Questionnaire to be filled out by UL DQS certified organizations. Certificate and OASIS will identify certification structure

How Certification Structures are used cont… Auditors will be required to validate structure type on-site The IAQG/OPMT Certification Structure Oversight Committee (CSOC) is required to review and approve all complex certification structures.

Summary Introduction of new certification structure types New audit day requirements OASIS administrator Requirements related to NCR responses Robust corrective action and complaint resolution process Limits to request for auditor changes Requirements for transferring Additional industry oversight UL DQS contract addendum

Thank you for attending. If you have any questions, please visit: http://ul-dqsusa.com/services/quality-management/aerospace-industry/ and send us an email!