1
Top Ten Things Auditors Should Know About
9104/1

• OP Assessor Workshop
• San Diego, CA
• Jan 19, 2012
• Tim Lee The Boeing Company
• Chair IAQG OPMT

OP Assessor Workshop San Diego, CA Jan 19, 2012
1
2
Agenda / Contents

• Top Ten Things Auditors Should Know about
  9104/1
• What Is The Current Status Of 9104/1?
• Q A

3
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The auditor must educate themselves on
  certification structures and audit duration
  requirements, as defined in Appendix B and Table
  2
• The CB shall initiate the client certification
  suspension process, when an organization fails to
  demonstrate that conformance to the applicable
  standard has been re-established within 60 days
  from the issuance of a Nonconformity Report (NCR)
  (8.4.d)
• OASIS Feedback Loop - CB auditors are expected to
  address this feedback during their management
  review activity, as well as investigations of
  product, process, and system issues (14.2)

4
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The auditor must educate themselves on
  certification structures and audit duration
  requirements, as defined in Appendix B and Table
  2
• The CB shall initiate the client certification
  suspension process, when an organization fails to
  demonstrate that conformance to the applicable
  standard has been re-established within 60 days
  from the issuance of a Nonconformity Report (NCR)
  (8.4.d)
• OASIS Feedback Loop - CB auditors are expected to
  address this feedback during their management
  review activity, as well as investigations of
  product, process, and system issues (14.2)

5
Appendix B, Page 1
6
Appendix B, Page 2
7
Appendix B, Page 3
8
Chapter 8, Table 2
9
Chapter 8, Table 2
No reductions in frequency or audit duration
allowed, unless specifically defined in the
9104/1 standard.
10
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The auditor must educate themselves on
  certification structures and audit duration
  requirements, as defined in Appendix B and Table
  2
• The CB shall initiate the client certification
  suspension process, when an organization fails to
  demonstrate that conformance to the applicable
  standard has been re-established within 60 days
  from the issuance of a Nonconformity Report (NCR)
  (8.4.d)
• OASIS Feedback Loop - CB auditors are expected to
  address this feedback during their management
  review activity, as well as investigations of
  product, process, and system issues (14.2)

11
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The auditor must educate themselves on
  certification structures and audit duration
  requirements, as defined in Appendix B and Table
  2
• The CB shall initiate the client certification
  suspension process, when an organization fails to
  demonstrate that conformance to the applicable
  standard has been re-established within 60 days
  from the issuance of a Nonconformity Report (NCR)
  (8.4.d)
• OASIS Feedback Loop - CB auditors are expected to
  address this feedback during their management
  review activity, as well as investigations of
  product, process, and system issues (14.2)

12
OASIS Feedback Process (Chapter 14, Figure 1)
13
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The same audit team leader shall be limited to a
  maximum of two consecutive certification cycles
  at the client (organization). Rotation of
  supporting AEAs and auditors after each
  certification cycle is recommended. (8.3.8)
• The CB and audit team leader shall ensure that an
  AEA is on-site and actively involved at each site
  during the entire audit. In addition, the audit
  team leader shall be on-site at one or more sites
  during all audit activity (8.3.3)
• SMS has the right to withdraw or suspend
  authentication based on, but not limited to poor
  performance, non-conformity to requirements, or
  falsification of data. (4.13)

14
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The same audit team leader shall be limited to a
  maximum of two consecutive certification cycles
  at the client (organization). Rotation of
  supporting AEAs and auditors after each
  certification cycle is recommended. (8.3.8)
• The CB and audit team leader shall ensure that an
  AEA is on-site and actively involved at each site
  during the entire audit. In addition, the audit
  team leader shall be on-site at one or more sites
  during all audit activity (8.3.3)
• SMS has the right to withdraw or suspend
  authentication based on, but not limited to poor
  performance, non-conformity to requirements, or
  falsification of data. (4.13)

15
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• The same audit team leader shall be limited to a
  maximum of two consecutive certification cycles
  at the client (organization). Rotation of
  supporting AEAs and auditors after each
  certification cycle is recommended. (8.3.8)
• The CB and audit team leader shall ensure that an
  AEA is on-site and actively involved at each site
  during the entire audit. In addition, the audit
  team leader shall be on-site at one or more sites
  during all audit activity (8.3.3)
• SMS has the right to withdraw or suspend
  authentication based on, but not limited to poor
  performance, non-conformity to requirements, or
  falsification of data. (4.13)

16
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• Auditors who are withdrawn for cause by an AAB
  shall not reapply for authentication for 12
  months in any sector of the ICOP scheme (7.4)
• The CBs audit program shall ensure that a
  certified organizations Control of Purchasing
  process is audited at least annually. (8.2.2.n)
• CBs shall not allow requests by clients for
  auditor changes/substitutions without
  substantiated evidence of improper activity or
  contract violations. (6.12)

17
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• Auditors who are withdrawn for cause by an AAB
  shall not reapply for authentication for 12
  months in any sector of the ICOP scheme (7.4)
• The CBs audit program shall ensure that a
  certified organizations Control of Purchasing
  process is audited at least annually. (8.2.2.n)
• CBs shall not allow requests by clients for
  auditor changes/substitutions without
  substantiated evidence of improper activity or
  contract violations. (6.12)

18
9104/1 Top Ten

• Top Ten Things Auditors Should Know about
  9104/1
• Auditors who are withdrawn for cause by an AAB
  shall not reapply for authentication for 12
  months in any sector of the ICOP scheme (7.4)
• The CBs audit program shall ensure that a
  certified organizations Control of Purchasing
  process is audited at least annually. (8.2.2.n)
• CBs shall not allow requests by clients for
  auditor changes/substitutions without
  substantiated evidence of improper activity or
  contract violations. (6.12)

19
9104/1 Top Ten

• Top Ten (or Eleven or Twelve) Things Auditors
  Should Know about 9104/1
• Classified material or export control
  requirements, related to CB auditor access must
  be determined prior to audit activity (6.11)
• The audit team leader shall present the complete
  audit report to the organization within two weeks
  of the closing meeting using the audit report and
  associated forms defined in the 9101 standard.
  (8.5.a)
• The new 9104/1 standard is firmly based upon the
  new ISO 17xxx series standards and the IAF
  Mandatory Documents MD-series (2.0)

20
9104/1 Top Ten

• Top Ten (or Eleven or Twelve) Things Auditors
  Should Know about 9104/1
• Classified material or export control
  requirements, related to CB auditor access must
  be determined prior to audit activity (6.11)
• The audit team leader shall present the complete
  audit report to the organization within two weeks
  of the closing meeting using the audit report and
  associated forms defined in the 9101 standard.
  (8.5.a)
• The new 9104/1 standard is firmly based upon the
  new ISO 17xxx series standards and the IAF
  Mandatory Documents MD-series (2.0)

21
9104/1 Top Ten

• Top Ten (or Eleven or Twelve) Things Auditors
  Should Know about 9104/1
• Classified material or export control
  requirements, related to CB auditor access must
  be determined prior to audit activity (6.11)
• The audit team leader shall present the complete
  audit report to the organization within two weeks
  of the closing meeting using the audit report and
  associated forms defined in the 9101 standard.
  (8.5.a)
• The new 9104/1 standard is firmly based upon the
  new ISO 17xxx series standards and the IAF
  Mandatory Documents MD-series (2.0)

22
9104/1 Top Ten

• Top Ten (or Eleven or Twelve) Things Auditors
  Should Know about 9104/1
• Classified material or export control
  requirements, related to CB auditor access must
  be determined prior to audit activity (6.11)
• The audit team leader shall present the complete
  audit report to the organization within two weeks
  of the closing meeting using the audit report and
  associated forms defined in the 9101 standard.
  (8.5.a)
• The new 9104/1 standard is firmly based upon the
  new ISO 17xxx series standards and the IAF
  Mandatory Documents MD-series (2.0)

23
(No Transcript)
24
9104-001 Transition
Jan 2012
Transition Ends

• Sector Management Structures (SMS) will establish
  risk mitigation plans to accelerate and manage
  transition activities. (Due 17 Feb 2012)

25

• Active Transition Team Susie Neal, Project
  Chair
• Team face to face meeting - December 2011
• Supplemental Rule SR-002 approved by OPMT (31 Jan
  2012)
• Aggressive plan for transition
• Requirements for all stakeholders
• Sector Risk Mitigation Plans (17 Feb 2012)
• Will include AB commitment date
• 9104-1 Transition Status Reporting Requirements
• Next steps (30 60 Days)
• Finalize OPMT/SMS operating procedures
• Establish certification structure committee (17
  Feb 2012)
• Review SMS Risk Mitigation Plans
• Provide stakeholder support (FAQ)

26
Questions ?
27
Sites New Organizational Structures

• Single Site
• Multiple Site
• Campus
• Several Sites
• Complex Sites

The above takes into consideration the unique
organizational structures that exist in the
Aviation, Space, and Defense industry today.
28
Single Site Structure
A1.1 Example of a Single Site Organization The
organization has one location. It could be
organised under one large building or several
buildings in one location. In either case the
organisation is located on one site. The
organisation has multiple products or product
families flowing through multiple processes.
29
Multiple Site Structure
A1.2 Example of a Multiple Site
Organization The organization has two sites, A
and B. They make two product families X and Y.
Product family X is made the same way using the
same processes on both sites A and B. Product
family Y is only made on site A. This
organization makes to customer specification.
The central function is located on site A.
Explanation Site B conducts the same but fewer
processes than site A making the same product X.
In this way the organization is eligible for a
multiple site approach.
30
Campus Structure
A1.3 Example of a Campus Organization The
organisation has four sites with four buildings
on site A, four buildings on site B and one
building on each site C and D. The organisation
has multiple products and product families that
all flow through substantially similar processes
i.e. one value stream.
31
Several Site Structure
A1.4 Example of a Several Site Organization The
organization has three sites A, B and C that make
different product families by mainly dissimilar
processes although some of processes such as
purchasing are the same. Site C makes to
customer specification. Sites A and B design and
manufacture their products. Some of the
customers for products from each site are the
same, others are not.
32
Complex Organization Structure
A1.5 Example of a Complex Organization This
organization has 6 sites. It has two different
product families. One family is made through
product stream 1, the other through product
stream 2. The processes carried out within sites
C and D are identical realizing the same product
through the same processes. The same is true for
sites E and F however the processes in E and F
are dissimilar from those used in C and D. Sites
A and B support both product streams. Sites and
A and B use the same facilities for all products
even through the types of products manufactured
are different and utilize different technologies
in their production. Where during the
realization processes in sites A and B products
in value stream 1 and in value stream 2 use the
same processes.