Company Confidential

Industry Controlled Other Party (ICOP)9100 Certification

Improvement Initiatives

Robust–Recognized–Valued

Presented byTim Lee

Chairman, IAQG OPMT The Boeing Company

EASA “Other Party Supplier Control" Workshop10 May 2011 Cologne

2

Briefing Purpose

• To provide a summary of IAQG OPMT oversight and improvement initiatives related to the Industry Controlled Other Party (ICOP) Aviation, Space and Defense Quality Management System (QMS) certification scheme.

• IAQG 5 Year Vision– ICOP program shall be robust, recognized and

valued

3

Other Party Management Team

Other Party Management TeamOther Party Management Team

OPMTCommittee

IAQG Council

OPMT(Europe)

JRMC(Asia / Pacific)

RMC(Americas)

• Mission

Management and oversight of the 9100 series Aerospace Quality Management System certification program.

• Vision

Ensure that the program is robust, recognized and valued.

Sector Management Structures

Voting Members;ABs;

CBs; andIndustry

Representatives

Voting Members;ABs;

CBs; andIndustry

Representatives

Voting Members;ABs;

CBs; andIndustry

Representatives

• IAQG Website

• EAQG Website

• OASIS

International Aerospace Quality Group (IAQG)Industry Controlled Other Party (ICOP)

WEB LINKS

4

OASIS DATA

Status as of May 2011• 40,200 users

• 1173* (855) registered Aerospace Auditors (*Updated to list entry level Auditors)

• 85 (85) approved CBs

• 14,210 Certified supplier organization sites

• 12,883 (9100) certified sites:

– 7261 in Americas

– 4960 in Europe

– 662 in Asia/Pacific

Number of Certificated Suppliers ( Valid Sites )

0

2000

4000

6000

8000

10000

12000

14000

Aug-03

Feb-0

4Aug

- 04

Feb-0

5Aug

-05

Feb-0

6Aug

- 06

Feb-0

7Aug-0

7Feb

-08

Aug- 0

8Feb

-09

Aug-09

Feb-1

0Aug

- 10

Feb-1

1

Total Europe Americas Asia Pacific

5

What is ICOP?

• ICOP is a globally harmonized Aerospace Quality Management System (AQMS) certification process defined by the IAQG

– Industry Controlled:

» The IAQG through each sector provides direct oversight of all AQMS certification activities

– Other Party:

» Certification activities are conducted by accredited Certification Bodies (CB) and authenticated Aerospace Auditors that are recognized through the ICOP process

• The ICOP process is managed by the IAQG Other Party Management Team (OPMT)

• Operating for more than 10 years

6

ICOP is Not

• The only method used in managing the supply base

• Prevention in buying from poor performing suppliers

• Certification of product and manufacturing processes

• A process that prevents human errors

• A traditional 3rd party certification scheme

• Without risks

7

8

ActionsShared Auditing and Measuring

Accreditation Bodies

Certification Bodies

Suppliers

Industry

2nd party audits

accreditation

3rd partyCertificationfor ISO 9001

The ‘traditional’ scheme

Suppliers

Accreditation Bodies

Certification Bodies

Suppliers

Industry

The Aerospace ‘ICOP’ scheme

Auditors

Approvaland

oversight

certification

ICOP (Industry Controlled Other Party)

Surveillance basedon risk

analysis&

product audit

Other partyCertification

for 9100/9110/9120

9

“ISO as Supplemented by”

• The IAQG Quality Management System certification scheme utilizes ISO for basic requirements and supplements ISO with Aviation, Space and Defense (ASD) unique requirements.

– ISO 9001 as supplemented by 9100

» ISO 17021 and IAF Mandatory Documents

Web Site Web Site Web Site

ICOP Criteria

• 9104/1 – Accreditation/Certification Requirements

– Sector Management Structure (SMS)

– Recognized Accreditation Bodies (ABs)

– Accredited Certification Bodies (CBs)

– Authenticated Aerospace Auditors

– Auditor Authentication Bodies (AABs)

– OASIS database management

• 9104/2- Oversight

– Oversight and surveillance process to ensure conformance to established aerospace industry 9100-series standard accreditation/certification requirements

• 9104/3 – Auditor Authentication & Training

– A common process for aerospace auditor training and authentication to be utilized by all the IAQG sectors

10

11

OASIS Feedback Process

• The OASIS feedback process facilitates two of three identified feedback loops present in the ICOP process

•On the following flow chart these three feedback loops are shown

– Feedback Loop A – Customer to Supplier *

– Feedback Loop B – Customer to CB

– Feedback Loop C – CB to Customer

• Feedback Loop A is not facilitated by the OASIS Feedback Process. This is typically an organization’s corrective action process.

•OASIS also allows for direct feedback to CB or AB

12

Supplier CustomerCertificationBody

Products/product qualityaudit

Auditfindings

PAH/POA holder

Feedback B

Feedback C

Feedback B:Information on product quality problems to CB:-When related to possible QM system causes-to focus CB audit activities on potentialweak spots

Feedback C:Information on findings to the customer found by the CB during the audit:-to determine possible impact on product quality- to determine additional audits (surveillance) or other actions to the supplier

Feedback AFeedback A:Information on product quality non-conformance to supplier:- to perform root cause analysis- to take corrective/preventive action, also on Quality system level

OASIS Feedback Process

13

9104-001 – Scope of Revision

• The standard underwent a major revision in order to:

– Complete the Trilogy of 9104-series documents, by

revising EN 9104:2006

– Remove sections made redundant by the release of

9104-002 (Oversight) and 9104-003 (Auditor

Training and Qualification)

– Address the areas of ICOP concern, by

enhancing/revising topics identified in the OPMT

FMEA (eg. audit days, multi-site, etc.)

– Upgrade to the new ISO and IAF audit docs.

• Once effectively implemented, the following changes

will significantly improve the ICOP scheme

14

Accreditation Bodies• Conformance to ISO 17011 and IAF ML 4

• AB Decision Personnel Aviation, Space and Defence competence

• CB Application and Review Process detail

• Scope of Accreditation for CBs by AQMS

• Surveillance requirements (new table)

• No. of CB Client Files and No. of Witness Assessments to be assessed annually

• CB NCR closure timescales

• CB suspension and withdrawal process

• Complaint and issue resolution process

9104-001 Significant Changes

15

Certification Bodies

• CBs must have a Complaint / Issue Resolution Process

• CBs Audit Programme to conform to 9101, 9104 and 17021

• Responsibility for Integrity and Validity of Certificates

• Rules and consequences for CB Suspension and Withdrawal

• Audits involving areas and materials which are Classified and/or Export Controlled

• Restrictions on clients demanding audit team changes without good reason

9104-001 Significant Changes

16

Audits and Reporting

• Certification Structures defined in Annex B

– New: campus, several sites and complex organisations

– As before: single site and multiple site

• Eligibility Criteria for each structure (Annex B)

• CB and client to agree structure type

• CB to retain records of structure determination

• IAQG OPMT to have Certification Oversight Review Committee

9104-001 Significant Changes

DR AFT O NLY

APP ENDIX B – INDUS TRY CONTROLL ED O THER P ARTY SCHEM E CERTIFICATION S T RUCT URES M ATRIX FOR 910 0/9 110 /91 20 :200 9 CERTIFICAT ION AUDIT S

Typ e of

Certific ation Sing le Site M ultip le Site Camp us Sev eral Sites Com p lex Org anization

Desc ription : • An org an ization tha t o pe rate s a t one site.

• A n o rgan izat io n h avin g a n ide nti fied centra l fun ctio n a nd a net work of s ites a t which a ctiv it ies are ful ly o r p a rtia lly carrie d o u t.

• A ll sites mu st b e d oin g subs tant ial ly the sam e m an ufact urin g a nd /o r valu e -add ed pro ce ss.

• An o rga niza t io n h aving a n ide n ti fie d c en tra l fun ctio n an d a decen tral ize d, seq ue ntia l, lin ke d p rodu ct re a lizatio n pro cess .

• A n org aniza tio n ha vin g an ide nt if ied ce n tra l func tion an d a ne tw ork o f sites tha t d o n ot m ee t the crite ria for a mult iple s ite or cam pu s organ izat ion.

• S eve ral s ites a re listed o n the s ame c ert if ica te.

• An org a nization ha ving a n ident if ie d central funct io n an d a n e tw ork o f locations tha t a re a n y co mb in ation of mu lt ip le si tes, cam pu s (can be m ore tha n o n e cam pu s), or seve ra l si tes.

Eligib ility C riteria:

N OTE: An orga n izat ion mu st m ee t ALL cri teria.

• Stand -alon e self-su ppo rt in g o rg anizat io n , with n o va lue stream d ep en d encies fro m re lated c omp anie s, ope rat in g u n der the same qu a lity ma n ageme nt system .

• O ne ad dre ss.

• A ll sites sh all ha ve a leg al or contractu al link with th e central of fice.

• On e q ual i ty ma na ge me nt system with ce ntra l co ntrol , m an ag em ent re vie w, an d intern a l a udit.

• C en tral o ff ice c an re q uire o ther site s implem ent correc tive act io n.

• C en tral col lec tion and a na lysis o f da ta, an d w ith the a bi lit y to ini tiate o rga n izationa l chan g e.

• C om plies with IAF MD 1, “Mult i-s ite Org an izat ion” d ef in i tion and el ig ibi lit y requ irem ents.

• A ll q ua lity ma na g em ent system proce sse s at a l l sites h ave to b e sub stan tia lly (i. e., >8 0% ) th e sam e and are

• All sites sh al l have a leg al o r contractu al l ink with th e cen tral of fice .

• On e q ua lity ma n age me nt system with ce n tra l co ntrol , ma nag em en t revie w, an d interna l a ud it.

• Cen tral office ca n re qu ire oth er site s imp lem ent co rrect ive ac tion.

• Cen tral colle ctio n an d an alysis of d a ta , and with th e a bil ity to ini tia te o rga n izat ion al c ha nge .

• Th e o utp uts fro m on e si te are an inp ut to an oth er site to rea lize the final pro du ct o r service; a s ing le valu e stre am .

• Can be diss imilar pro cesses a t dif fe ren t site s or co mb in at ion of site s tha t c on trib ute to the sam e o vera ll pro d uct or service.

• A ll si te s s ha ll have a lega l o r c ontra ctua l lin k w ith the c entra l o ff ice .

• O n e qu a lity ma na gem en t s yste m w ith ce ntral c on tro l , m an ag eme nt review , and internal au dit .

• C en tral of fice ca n req u ire o the r s ites im pleme nt c orre ct ive a ctio n.

• C en tral collec tion a nd a na lysis of data, w ith th e a bi lity to init ia te o rgan izat iona l c han ge .

• P roce sse s a t each of the sites a re n ot sub stan tial ly simila r (i .e. , <80 % sim ila r).

• P roce sse s m ay b e op era ted to th e sa me o r d if fere nt m etho ds a nd proced ure s that a re co ntro lle d thro ug h o ne c omm on q uali ty ma na ge me nt

• Al l si te s sh all ha ve a leg al o r co n tra ctua l link w ith the ce n tra l o ffice.

• O ne qu a lity mana gemen t sys tem w ith cen tral con trol, m an ageme nt re view , an d inte rna l au dit.

• C e ntral of fice can requ ire o th e r s ites impleme n t co rre ctive a ction.

• C e ntral col lect io n a n d an alys is o f data, w ith the abi l ity to init iate orga niza tional ch an g e.

• O veral l stru cture co n ta in s co mb inatio ns of mu lt iple site s, ca mp us (ca n be m ore tha n o n e cam pu s), or se vera l site s.

• R e quires IAQ G O PMT a p proval o f ra tio nale , jus ti fica tion , a ud itor d ay ca lcula tio ns, audit prog ram, a n d sam pling plan ( fo r 9 12 0 ,

Annex B

17

Audits and Reporting

• Nonconformities

– Client suspension if conformance not established within 60 days from issue of NCR

– Customer notification included where applicable

• NCRs as a minimum to be provided at closing meeting

• Complete audit report within two weeks of closing meeting

• Certified organisations to provide a copy of audit report to customers upon request

9104-001 Significant Changes

18

Process Based Auditing 9101:2009 (Revision D)

AuditRecords

Methods/Tools

Process Approach

Process-Based Auditing

Inputs Outputs

Performance Focused

1 Auditing Company Name Nonconformity Report (NCR)

2 Auditing Company

Logo 3 Organization: 5 Site/OIN:

4 Audit Report ID/type:

4 NCR Number:

6 Issue Date:

7 SECTION 1 - DETAILS OF NONCONFORMITY: 8 Process/Area/Department:

9 Requirement/Clause No.(s): 10 Classification (ma/mi):

11 Statement of Nonconformity:

12 Objective Evidence:

13 Due Date:

14 Auditor 15 Auditee Representative Acknowledgement NAME: Signature: Name: Signature:

7SECTION 2- AUDITEE PLANNED ACTIONS (Attach separate sheet, as needed.) 16 Containment Action(s), including correction, with s upporting completion date(s):

17 Planned Completion Date:

18 Actual Completion Date:

19 Root Cause:

20 Cause Code:

21 Corrective Action(s), including supporting completi on date(s): 22 Planned

Completion Date:

23 Actual Completion Date:

15 Auditee Representative Name and Signature:

Date:

24 Auditor Signature for Acceptance of C/A(s):

Date:

7/25 SECTION 3 - DETAILS OF AUDITOR VERIFICATION OF ACTI ON:

7/26 SECTION 4 - NCR CLOSURE (Auditor Name /Signature/Date):

27 Approved by Audit Team Leader (Name/Signature/Date):

NCRs PEARs

OER

Evidence of conformity Evidence of effectiveness

Controls

Resources

3Site: 4Issued Date:

7Support Process(es) Assessed:

69100/9110/9120 Section Reference:

5□ Core Process Assessed:

□ Support Process Assessed:

□ Foundation Process Assessed:

Effectiveness Assessment Record1Organization: 2Report Number:

8Statement of Effectiveness:

□The assessed core/support/foundation process has been determined to be effective .

□The assessed core/support/foundation process has been determined to be ineffective.

9How was process effectiveness determined (methodolo gy)?

10Objective Evidence, Observed Conditions, Data, and Comments to Support Effectiveness Determination

11Assessment Team Leader 12Signature and Date

Signature indicates that all relevant requirements (including requirements for support processes identif ied in Block #7) have been assessed to determine ef fectiveness of the core or support process identif ied in Block #5.

Focused on Process Conformance, Performance and Eff ectiveness

19

Certified Organisations

• Requires certified organisations to comply with 9104

• Requires CBs to flow down requirement to certified clients

• Certified Organizations must allow CB to post Tier 1 and Tier 2 Audit Data to OASIS Database.

- Agree Tier 1 is Public Information

- Agree to provide access to Tier 2 upon request of A, S and D customers (unless justification of competition confidentiality, conflict of interest, etc.)

- Agree to Notify their A, S and D customers in case of Loss of Certification

• Shall provide ‘Right of Access’ to their facilities, people, and processes for review

• Failure to abide by requirements is cause for withdrawal of AQMS certification

9104-001 Significant Changes

20

9100/9110/9120:2009 Transition

Supplemental Rule SR-001

• Facilitate transition to the 9100/9110/9120:2009 AQ MS standards, including 9101:2009

• Updated to provide clarification and incorporate le ssons learned.

– Exhibit B – Transition Options

• Rules to be posted to OASIS

• Requires use of 9101:2009

Sanctioned Aerospace Auditor Training

• All aerospace authenticated auditors will be required to take the IAQG-sanctioned training, prior to authentication to 9100/9110/9120:2009 standards

– 9101 Process based auditing

• Competency-based examination and evaluation

• Deployed in all global sectors

• Supported by IAQG Subject Matter Experts (SME)

• Approved Training Providers and Trainers

21

22

Improvement Initiatives

9104/1 Major Rewrite

• Min. Audit Days – no reductions

• Ramifications for Poor Performance

• Criteria for Multiple Site Certification

• OASIS Improvements and Feedback

(In Ballot – Publication Sept 2011)

9104/3 Revision

• Competency-based Auditor Authentication

• IAQG Sanctioned Aerospace Auditor Training Program

9104/2 Revision

• Additional Witness Audits

• Updated Oversight Tools

• Annual Review and Metrics

9101 Major Rewrite

• Process Approach

• Updated Tools

• Audit Guidance

• Corrective Action Requirements

Certification Body Operations Auditor Competency

Audit and C/A Effectiveness SMS Oversight of Process

23

EASA Involvement

• EASA has been involved since the initial development of the ICOP recognition process

• EASA has observed ICOP oversight activities

�Witness audits

• The IAQG will continue to team with EASA

�Advisor position seat available within the EAQG OPMT

24

Supplier(CB Client)

ICOP Certification

ICOP Certification Body (CB)

(9100, 9110, 9120)

IAQGMember Company

Representatives

On-line Aerospace Supplier

Information System(OASIS)

SMS AB, CB , and Auditor Approval

Shared Oversight

IAQG OPMT Oversight of SMS

Europe, Asia /Pacific, Americas

ICOP Accreditation Body (AB)

(9100, 9110, 9120)

IAQG(Supplier Surveillance, Product/Process Audit)

Certification Recognition

International Accreditation Forum (IAF) Peer Review

Oversight

Conformance

Product/Process

Conformance DATA

IAQG & SMS Oversight

Oversight

ICOP Oversight Scheme

Next Steps

• Support the writings teams efforts to get the standards updated and successfully balloted/published

– 9104-001 Oct 2011

– 9104-002 Jan 2012

– 9104-003 Jan 2012

• Support IAQG Council’s timeline and concepts for 9100-series standard (2009) transition

• Support IAQG Vision

– IAQG Aerospace Quality Management System (AQMS) certification program is robust, recognized, and valued

» Update the 9104-series standards

» Improve ICOP effectiveness metrics

» Improve stakeholder communication

25

26

Summary

• The effective implementation of the updated 9104 Series standard is key to ICOP improvement

• Conformance assessments using the 9101 Process Approach will improve audit effectiveness

• Sanctioned training program will ensure consistent interpretation and improved auditor competency

• The OPMT will continue to evaluate the effectiveness of these improvement initiatives (P-D-C-A)

– FMEA

– Sanctioned Training updates

– Stakeholder collaboration

• EASA part of the oversight process

• Communication is key to success

27

EASA Part 21 Compliance

Revision to Part 21 AMCs (No. 1 & 2 to 21A.139b) on “Supplier Control” by POA Holders:

• ICOP scheme is robust and suitable as “Other Party” system, developed and managed by the IAQG Aviation, Space & Defense industry

• Under POA Holder full responsibility

(Delegated to “Other Party” under conditions controlled by POA Holder)

28

Questions