1. Company Confidential Registration Management Committee RMC Auditor Workshop Charleston, SC - 22-23 July 2015 1 Supplemental Oversight AS9104/2A & Special Audit Discussion Tim Lee The Boeing Company Chair, IAQG OPMT 23 July 2015

2. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Purpose To provide awareness and understanding of the AS9104/2A criteria for AAQG Member supplemental Certification Body (CB) oversight. –What is it? –Why? –AAQG Member Example To discuss special (short notice) audits, including the: –What –When –How How these processes add “Value” for interested parties Page 2

3. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Supplemental Oversight - What is it? The Industry Controlled Other Party (ICOP) oversight processes described in AS9104/1 and AS9104/2A are part of a globally harmonized shared (industry) oversight scheme In addition to the “shared” oversight, AS9104/2A authorizes individual IAQG member companies to conduct additional independent CB oversight –Outside of the shared oversight process –To support risk mitigation Supplemental oversight is not a duplication of RMC activity –Authorizes IAQG members to conduct additional CB assessments as part of their supplier control processes where risks may be evident Where an IAQG member company conducts supplemental oversight, trained OP assessors and the assessment tools contained within AS9104/2A are to be used. Page 3

4. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee AS9104/2A Criteria Section 7.13: Supplemental Oversight Additionally Supplemental oversight: -May be linked to IAQG member analysis of internal ICOP recognition activity -Activity must be scheduled and coordinated with all affected parties in advance of assessment conduct -Nonconformities are to be recorded on an Oversight Nonconformity Record (see Form D) -IAQG member companies shall maintain records of supplemental oversight -Supplemental oversight activities shall be summarized and reported to SMS on an annual basis Page 4

5. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Why conduct supplemental oversight? -Mitigate risks associated with recognition of a Supplier’s aerospace quality management system certification -Demonstrate conformance to established requirements -AS9104 Series & FAA Order 8120.12A -Demonstrate active engagement in the process to internal customers and regulatory authorities -Industry Controlled Other Party (ICOP) not Third Party -To supplement not duplicate industry oversight activities -Improve conformance and promote continual improvement -AAQG Member, CB and Suppliers Page 5 Supplemental Oversight Example:

6. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee IAQG Member Company Example: Boeing Supplemental Oversight Process Supplemental Oversight Activity  Audit Report Review  AS9101 Reports  Onsite Assessment at Supplier  Client Validation (Audit Report Review & QPA 119)  CB Office Visit  Working together and supplier file review  CB Witness Audit  Auditor competency Boeing Oversight Representative (BOR) Industry Controlled Other Party (ICOP) Supplier Quality Representative (SQR)

7. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Supplemental Oversight – Adding Value Supplemental oversight can add value when: –it is supported by risk analysis (e.g. supplier performance) –CBs and member companies “Work Together” to resolve identified issues –issues are reported and addressed in a timely manner –effective corrective action is established –paradigms do not influence assessment planning or results –Information is shared with the appropriate stakeholders Page 7

8. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audits Page 8 What? When? How?

9. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audit - What ISO17021-1:2015 - Clause 9.6.4 Special audits 9.6.4.1 Expanding scope The certification body shall, in response to an application for expanding the scope of a certification already granted, undertake a review of the application and determine any audit activities necessary to decide whether or not the extension may be granted. This may be conducted in conjunction with a surveillance audit. 9.6.4.2 Short-notice audits It may be necessary for the certification body to conduct audits of certified clients at short notice or unannounced to investigate complaints, or in response to changes, or as follow up on suspended clients. In such cases: a) the certification body shall describe and make known in advance to the certified clients (e.g. in documents as described in 8.5.1) the conditions under which such audits will be conducted; b) the certification body shall exercise additional care in the assignment of the audit team because of the lack of opportunity for the client to object to audit team members. Page 9

10. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audit - When AS9101E 9.4.3.6 - Special Audit The requirements of ISO/IEC 17021 clause 9.5 apply. In addition, special audits can be performed anytime, during the certification cycle, in response to one of the following situations: a. In response to a customer or other interested party request, when a serious issue (supported by objective evidence) has been identified. The requester shall be notified in advance of the audit dates and made aware of the audit results. b. In response to an organization's request to increase the listing of certified sites. c. When transferring certification from one CB to another. These audits shall be coordinated with the organization prior to the visit. The organization shall be given information about the specific reason and subject of the visit. Page 10

11. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audit - When AS9104/1 Clause 6.7 - Requirements for CBs to obtain AQMS standard(s) accreditation shall include at a minimum: j. The CB shall establish a complaint/issue resolution process. The process shall ensure: –all requests for corrective action are responded to within 30 calendar days from receipt of complaint; –all feedback received is reviewed and, if response requested, the response is provided within 30 calendar days from receipt of complaint; –if the CB determines that a short notice audit is necessary, this audit shall be completed within 90 calendar days from receipt of the complaint; and –an effective corrective action process that provides for containment activities, conformance to the applicable standard is re-established, completion of root cause analysis, corrective actions addressing all root causes, and a completion date for the implementation of all corrective actions is defined. Page 11

12. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audit – How Special (short notice) audits shall be performed in accordance with the CBs approved processes and the criteria defined within ISO17021, AS9104/1 and AS9101E. The process should address: –Scope and purpose of the audit –Audit planning »Audit planning in advance of the on site audit is key to adding value –Audit duration –Client and requestor notification AS9101E – 4.3.6 Special Audits –The results for special audits shall be documented on Form 3 (PEAR); Form 4 (NCR), as applicable; and Form 5 (Audit Report) Page 12

13. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee Special Audit –Adding Value When the audit is a direct result of an AAQG Member complaint: –Use member non-conformance data as input into the audit planning process –Do not duplicate AAQG Member activities (e.g. Corrective action) –Focus on auditing the associated QMS processes and evaluate the breadth and depth of the non-conformance issue (e.g. are other customers affected). –Ensure all product escapements are reported in accordance with customer requirements –Make a timely certification decision (e.g.; continued, suspended, withdrawn certificate) Page 13

14. RMC Auditor Workshop Charleston, SC - 22-23 July 2015 Registration Management Committee 14 Thank You For Your Attention!!