Company Confidential Registration Management Committee (RMC) :2009 Revision Workshop Tony Marino The Boeing Company Other Party (OP) Assessor Workshop San Diego, CA January 19, 2012 Quality Management Systems Audit Requirements for Aviation, Space, and Defense Organizations “It’s All About Performing”

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Team Charter “ Revise 9101 to align with the next revision of 9100 and upcoming ISO 17021, review scope and identify any additional stakeholder needs and restructure the standard for a more process-based assessment approach to auditing an organization ’ s quality management system. ” 13 Members on the 9101 Team representing: Americas, Europe, and Asia-Pacific IAQG Sectors 6 Different Countries 8 IAQG member companies 4 Certification Bodies IAQG Initiative Study dated 30 Sept 2006 and presented at the IAQG meeting in Seville, Spain on 5 Oct 06.

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Development Model for Process Based Auditing Audit Records Methods/Tools Process Approach Process-Based Auditing InputsOutputs Performance Focused NCRs PEARs OER Evidence of conformity Evidence of effectiveness Controls Resources

San Diego, CA January 19, 2012 Registration Management Committee (RMC) What has not Changed Determining conformity to the standards. Nonconformities discovered during the audit are to be documented. Based on information collected during the audit, the lead auditor will have to draw conclusions on conformity and effectiveness of the organizations quality management system.

San Diego, CA January 19, 2012 Registration Management Committee (RMC) What is the Effectiveness of an Organization? Process not implemented; planned results are not achieved? Process implemented; planned results are not achieved and appropriate actions not taken? Process implemented; planned results are not achieved, but appropriate actions being taken? Process implemented; planned results are achieved?

San Diego, CA January 19, 2012 Registration Management Committee (RMC) What is Effectiveness? Extent to which planned activities are realized and planned results achieved (Reference ISO 9000 Quality management systems – Fundamentals and Vocabulary)

San Diego, CA January 19, 2012 Registration Management Committee (RMC) What will this Mean to the Auditor? Will use client and client customer performance data to plan audit activities. Review and examine an organization ’ s “ Effectiveness ” from: The customer viewpoint; Satisfaction and performance. Organizational leadership goals and objectives. Operational processes of the organization. Construct and follow “ audit trails ”.

San Diego, CA January 19, 2012 Registration Management Committee (RMC) What will this Mean to an Organization? A QMS Organization should be able to … Demonstrate conformity of the QMS Organization to the standard. Show process mapping (identified, sequence and interaction). Explain process measures identified: –Who reviews the data? –Targets defined? –Targets are met? –Are the measures actionable? –How is the data used? Show actions taken when product quality and on-time delivery performance targets are not met. The ultimate measure of a QMS Organizational effectiveness – Customer Satisfaction

San Diego, CA January 19, 2012 Registration Management Committee (RMC) As an OP Assessor You will See Change in the Auditor’s Planning, Conduct and Results 9 Influences in the planning of the audit. ( ) Knowledge of the client processes, sequence and interaction. ( ) Looking at organizational and process performance. ( ) Testing defined measures (targets defined and are they actionable). Appropriate actions taken when defined measures are not met. ( ) Development of audit trails based on data and performance ( ) Make up of the audit package. (9101 Appendices)

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Opportunity for Improvement Question? 10 Are 9101 audit methodologies being used: –Customer focus –Organizational Leadership –Process management –Process performance –Continual Improvement

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Exercise 11 Witness Audit Auditor is evaluating metric/scorecard package for Management Review. You (OP Assessor) observe a scorecard for 3 programs from customer “X” reflects Red in quality for each program for the past 3 months. Auditor makes inquiry about frequency of Management Reviews, minutes and action logs. No questions regarding customer “X” asked at this moment in time. Thanks the MR and moves on the next part of the audit plan. No further inquiry is made throughout the course of the audit. Audit concluded with no NCR’s. As an observer, what issue might be here?

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Exercise 12 Witness Audit During the opening meeting, auditor followed opening meeting protocols except didn’t discuss/explain PEAR’s. During the closing meeting, PEAR evaluation and conclusions were not covered with the client. As an observer, what issue might be here?

San Diego, CA January 19, 2012 Registration Management Committee (RMC) Exercise 13 Witness Audit - AS9110 During the audit the auditor wrote an NC as follows: –Statement of Nonconformity: No provisions for disposition of out-of-scope defects discovered during maintenance. – Objective Evidence: Business Systems Manual/Processes/Document/Work Instructions do not provide a method/process of disposition of out-of-scope. –NC classified as Minor As an observer, what issue might be here?

San Diego, CA January 19, 2012 Registration Management Committee (RMC) 9101 SUMMARY 9101D represents a significant change to aviation, space and defense auditing. Although auditing for effectiveness has always been an expectation of the standard and to customers, the reality is that most auditors focus on process conformity to procedural requirements overlooking process results. This change sets a stage for a new journey and as with any journey, there will be challenges and continual improvement. We must stay on course.

San Diego, CA January 19, 2012 Registration Management Committee (RMC) 9101 SUMMARY continued… Updates and Improvements are in work: ISO and 9104/1 changes Incorporate FAQ’s Documentation and Records Define Audit Package requirements (single, multi, campus, complex) OER PEAR Move requirements our document instruction to the requirements writing OPMT Audit Package Review feedback We have issues that need to be addressed Auditor Guidance Development - Priority

San Diego, CA January 19, 2012 Registration Management Committee (RMC) QUESTIONS ?