Company Confidential Registration Management Committee 1 Industry Controlled Other Party (ICOP) Oversight Market Surveillance AS9104/2A Supplemental Oversight Tool Tim Lee/Jerry Johnson The Boeing Company July 17, 2014

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee To provide awareness of AAQG RMC initiative to utilize the International Accreditation Forum (IAF) Market Surveillance process as a supplemental oversight tool (IAF ID 4:2012) Discuss: –The Plan –Criteria –Initial Results –Next Steps 2

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 3 AAQG RMC Initiative  In advance of AS9104/2A release AAQG RMC launched beta test initiative to conduct Market Surveillance assessments using the IAF defined process. (Assessments conducted in 2013 & 2014)  RMC will use lessons learned to document the process and incorporate this assessment process in our future “shared” oversight process.  The Beta Test to include:  OP Assessor Training  Selection of CBs and Suppliers based on indentified issues/risk  Communication/collaboration with CB, Client & RMC  Participation by RMC Members and/or AB upon request  Documentation of any identified CB nonconformance's (AS9104/2A Form D)  Reporting results with go forward recommendations to the RMC, IAQG OPMT & IAF  Incorporation of feedback into RMC Oversight procedure.

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 4 Market Surveillance (IAF ID 4:2012)  Process is defined in IAF Information Document (IAF ID 4:2012)  This IAF informative document provides suggestions about how short market surveillance visits might be used by accreditation bodies or others in lieu of witness audits.  Process Includes:  Planning  Conducting  Client Survey  Grading of results

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 5 Market Surveillance: visit is typically a short (one-day) visit to a certified organization, to determine the level of confidence in the conformity of the management system to specified requirements and the effectiveness of the accredited certification process. NOTE: A market surveillance visit is not a “repeat audit”, and is not intended to identify or document specific nonconformities; the visit is intended only to provide confidence in the activities of the CB. Market Surveillance (IAF ID 4:2012)

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 6 Conduct the assessment: Initial Lesson Learned: Checklist will need to be modified to support Aerospace unique criteria (ISO 9001 Based)

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 7 AS9104/2A “Oversight” The recently released standard provides for use of IAF ID 4 to support supplemental oversight: i - Supplemental oversight may be accomplished by utilizing guidance provided in the IAF document, “Market Surveillance Visits to Certified Organizations” (see IAF ID 4). Process is defined in IAF Information Document (IAF ID 4:2012) NOTE: This process may be used to improve the level of confidence in the conformity of the management system of the supplier and the effectiveness of the accredited certification process. This may be conducted in support of an IAQG member company’ supply chain risk mitigation activities.

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 8 Market Surveillance Results (2013 Assessments) Checklist completion feedback: Scoring was straightforward Seven scores of 2 (across 3 CB’s) One Form D for certification decision One CB had 3 scores of 5 Good comments and objective evidence recorded Assessor Feedback Preparation before the onsite (review of OASIS Tier 2 data, certificate review) helps the onsite process One day agenda could be a challenge for a larger organization Does not address a Multi-Site certificate Depth of audit – Objective Evidence – 1 to 3 as opposed to 8 or 10

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 9 OP Assessor Feedback Document Some questions were “wide open” to interpretation (12 and 14 given as examples) Size of company can affect agenda and duration Document does not address how to address client nonconformance conditions noted during assessment (follow up, lose agenda time) Additional Annex for AS requirements CB role – Recommend participation as observer or participant

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 10 Market Surveillance Results Recommendations for document: Guidance to perform OASIS tier 2 data and certificate review prior to onsite activity Agenda/duration variance in relation to organization size Direction for documenting client nonconformance Document baseline is ISO 9001 Recommendation for AS supplemental template AS&D requirements tailoring Possible “Supermarket” of topics to build agenda Output should be a list of recommendations, Summary Report

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee Market Surveillance Oversight Monthly meetings CB selection based on Boeing risk model Discussions for client selection, scheduling activity Coordination/collaboration with CB Report event completions, give team feedback Post-event follow up with assessors Feedback session at Jan 2015 RMC meeting Process “lessons learned” Document enhancement suggestions Go forward recommendations

RMC Workshop Long Beach, CA 16 – 17 July 2014 Registration Management Committee 12